bce-engine@0.3.0 release verification#

bce-engine@0.3.0 was published on 2026-09-05 from the immutable annotated v0.3.0 tag. This record binds the registry artifact, source, provenance, six GitHub Release assets, and the two fix-forward incidents without converting first-party release evidence into an adoption or efficacy claim.

Published identity#

The registry exposes two attestations, including SLSA provenance whose subject is pkg:npm/bce-engine@0.3.0. It binds the package digest to .github/workflows/release.yml@refs/tags/v0.3.0, the source commit above, and attempt 2 of the linked GitHub Actions run. The annotated Git tag is not claimed as a cryptographic signature.

Immutable assets#

The canonical Release contains exactly these six uploaded assets:

The signed payload manifest records 393 package entries, npm integrity and shasum identical to the registry values above, and manifest digest sha256:ffafc9ef7b5468a0248b0ea7f4b1046673f6b39ccfc848218dc2474f03e7aa33. The EvidenceRecord is a score-100 pass over source 9fe4a02d39c05dbdf280b359e9b364de84e1eda8 with chain hash 475688ae528309bfb261f2cd0c72fecb183ad6b23d60ae8392c76752eda806d9.

Both bundles verify against:

• certificate issuer: https://token.actions.githubusercontent.com;
• certificate identity: https://github.com/blueprint-conformance/bce/.github/workflows/release.yml@refs/tags/v0.3.0.

Their Rekor log indexes are 2729653987 for the EvidenceRecord and 2729655622 for the payload manifest.

Incidents and fix-forward#

The tag's release gate and macOS controller passed. Attempt 1 then created and verified the first Sigstore attestation, but the second attestation timed out while creating its Rekor entry. The job failed before a draft Release existed and before npm publication. Registry and GitHub state were checked as absent, then only failed jobs were rerun against the same tag and source commit.

Attempt 2 generated and verified both bundles, staged all six digest-bound assets on a draft, and published the exact attached tarball to npm with provenance. The isolated finalizer then failed before publishing the draft because it intentionally had no checkout while its gh release view call omitted an explicit repository target; GitHub CLI reported fatal: not a git repository. The npm version was not republished.

Before the draft was manually finalized, all six assets were downloaded and matched byte-for-byte to the publish job's SHA-256 outputs. Both Sigstore identities verified, the tarball's SHA-512 and SHA-1 matched npm, its package name/version matched bce-engine@0.3.0, the payload manifest matched the registry, and the EvidenceRecord chain verified at score 100. The intended finalizer operation was then run with an explicit --repo blueprint-conformance/bce; the resulting Release reported isDraft=false, isImmutable=true, and the same six asset digests.

PR #66 fixes the checkout-free finalizer and adds a release-policy negative control that rejects repository inference. The Actions attempt stays visibly failed at its finalizer step; this record does not rewrite that history.

Independent replay#

Registry identity can be checked without trusting this page:

npm view bce-engine@0.3.0 version dist.integrity dist.shasum dist.attestations
npm pack bce-engine@0.3.0
printf 'sha512-%s\n' "$(openssl dgst -sha512 -binary bce-engine-0.3.0.tgz | openssl base64 -A)"
shasum -a 1 bce-engine-0.3.0.tgz

Download and verify the immutable Release assets from a clean source checkout:

gh release download v0.3.0 --repo blueprint-conformance/bce
shasum -a 256 release-evidence-record.json release-evidence-record.sigstore \
  release-compliance-report.json release-payload-manifest.json \
  release-payload-manifest.sigstore bce-engine-0.3.0.tgz
npm ci
node node_modules/@sigstore/cli/bin/run verify \
  release-evidence-record.sigstore \
  --certificate-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-uri https://github.com/blueprint-conformance/bce/.github/workflows/release.yml@refs/tags/v0.3.0
node node_modules/@sigstore/cli/bin/run verify \
  release-payload-manifest.sigstore \
  --certificate-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-uri https://github.com/blueprint-conformance/bce/.github/workflows/release.yml@refs/tags/v0.3.0

This is release-supply-chain and deterministic-mechanism evidence. It is not independent adoption, private-product dogfood, or efficacy evidence, and it does not enter the sealed comparative-study outcome ledger.