release(draft): integrate deployed ancestry, guarded queue recovery and exact-head CodeQL

.echo/certification.json

@@ -0,0 +1,4 @@
+{
+  "version": 1,
+  "journey": ["python3", "-B", "scripts/certforge_journey.py"]
+}

.echo/sdk.json

@@ -46,6 +46,7 @@
     "echo.certforge.projects.create",
     "echo.certforge.projects.list",
     "echo.certforge.public_verification",
+    "echo.certforge.publish",
     "echo.certforge.r5.status",
     "echo.certforge.r5.submit_async",
     "echo.certforge.run",

.github/workflows/ci.yml

@@ -11,15 +11,28 @@ name: certification-forge-ci
 permissions:
   contents: read
 
+env:
+  ECHO_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+  ECHO_SCAN_REF: ${{ github.event_name == 'pull_request' && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }}
+
 jobs:
   test:
+    name: CI
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Check out exact source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ env.ECHO_SOURCE_SHA }}
+          persist-credentials: false
+      - name: Verify source identity
+        run: |
+          echo_actual_sha=$(git rev-parse HEAD)
+          test "$echo_actual_sha" = "$ECHO_SOURCE_SHA"
+          printf 'Verified source: %s\n' "$echo_actual_sha"
       - name: Configure Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
           cache: pip
@@ -37,9 +50,40 @@ jobs:
         run: python scripts/p7_acceptance.py
       - name: Upload verification evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: certification-forge-evidence-${{ github.sha }}
+          name: certification-forge-evidence-${{ env.ECHO_SOURCE_SHA }}
           path: artifacts/
           if-no-files-found: error
           retention-days: 30
+
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    steps:
+      - name: Check out exact source for static analysis
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ env.ECHO_SOURCE_SHA }}
+          persist-credentials: false
+      - name: Verify source identity
+        run: |
+          echo_actual_sha=$(git rev-parse HEAD)
+          test "$echo_actual_sha" = "$ECHO_SOURCE_SHA"
+          printf 'Verified source: %s\n' "$echo_actual_sha"
+      - name: Initialize Python analysis
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          languages: python
+          build-mode: none
+      - name: Analyze and upload results
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          category: /language:python
+          ref: ${{ env.ECHO_SCAN_REF }}
+          sha: ${{ env.ECHO_SOURCE_SHA }}

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.2.0] - 2026-08-30
+
+### Added
+
+- A pinned-key-signed production E2E gate required before any `PRODUCTION_READY` verdict.
+- Exact E2E bindings for source, deployment, target, environment, accounts, and clients.
+
 All notable changes to Echo Certification Forge are documented here. Versions follow Semantic
 Versioning; dates use ISO 8601.
 

artifacts/p1_acceptance_report.json

@@ -1,10 +1,10 @@
 {
-  "manifest_digest": "0ca325c3e6d39b7f22cdd3d01068c8f99dcd976c4422200b5b4d4cfe452f29f7",
+  "manifest_digest": "9e9f963377374e827ccc9c8b07ea82cc7966e25a2392838997d3c1371f5a4e5c",
   "manifest_id": "certforge.release-strict.v1",
   "passed": true,
   "phase": "P1",
-  "platform": "Windows-11-10.0.22631-SP0",
-  "python": "3.13.0 (tags/v3.13.0:60403a5, Oct  7 2024, 09:38:07) [MSC v.1941 64 bit (AMD64)]",
+  "platform": "Windows-11-10.0.26200-SP0",
+  "python": "3.12.10 (tags/v3.12.10:0cc8128, Apr  8 2025, 12:21:36) [MSC v.1943 64 bit (AMD64)]",
   "scenarios": {
     "default_block": {
       "passed": true,
@@ -17,27 +17,30 @@
         "mandatory_rule_missing:environment_identity",
         "mandatory_rule_missing:evidence_integrity",
         "mandatory_rule_missing:immutable_target_identity",
+        "mandatory_rule_missing:production_e2e",
         "mandatory_rule_missing:runner_control_channel",
         "mandatory_rule_missing:signing_authority_separation",
         "mandatory_rule_missing:tenant_isolation",
+        "production_e2e_attestation_missing",
         "run_outcome_inconclusive"
       ],
       "verdict": "NOT_READY"
     },
+    "source_only_blocks": {
+      "deploy_gate_allowed": false,
+      "evidence_merkle_root": "41a4fc282a478767dc16f6c64128c93ab2535866e620a3f5b0ae922220ffb449",
+      "passed": true,
+      "payload_sha256": "a7255f5bae53fcd49b1e049b3edd1feb6c9b03f4520b0e2abb0e44f0da7138e7",
+      "signing_key_id": "ed25519:e222f1c31e85f1b8a6d8cfed30fd2300",
+      "verdict": "NOT_READY"
+    },
     "tamper_blocks": {
       "deploy_gate_allowed": false,
       "passed": true,
       "reasons": [
-        "current_evidence_invalid"
+        "current_evidence_invalid",
+        "verdict_not_production_ready"
       ]
-    },
-    "verified_ready": {
-      "deploy_gate_allowed": true,
-      "evidence_merkle_root": "438efda29a515669d0db0472f6527c201c55d0d80afebf2963123d11c77a7d73",
-      "passed": true,
-      "payload_sha256": "db3fe179c7c950a9ffaf90cfef6d475fc915af87f0d1b10a85071c7d8411b975",
-      "signing_key_id": "ed25519:4592da038060823a957506d477e49114",
-      "verdict": "PRODUCTION_READY"
     }
   },
   "schema_version": "1.0.0"

artifacts/p6_acceptance.json

@@ -1,8 +1,8 @@
 {
   "phase": "P6",
   "title": "deployment enforcement and platform integration \u2014 live local acceptance",
-  "generated_at": "2026-07-26T02:18:04.411111Z",
-  "python": "3.13.0 (tags/v3.13.0:60403a5, Oct  7 2024, 09:38:07) [MSC v.1941 64 bit (AMD64)]",
+  "generated_at": "2026-08-30T12:40:31.960114Z",
+  "python": "3.12.10 (tags/v3.12.10:0cc8128, Apr  8 2025, 12:21:36) [MSC v.1943 64 bit (AMD64)]",
   "passed": true,
   "checks": [
     {
@@ -11,7 +11,7 @@
       "passed": true,
       "detail": {
         "exit": 2,
-        "stdout": "{\"admission_id\": \"dep-3413cd5f5334d3b106b9ce81f7c7a26b\", \"allowed\": false, \"artifact_sha256\": \"cc9a65d96c25c8f96ba720e01628b734d6df4f5a1057238506ab6d504fb998fd\", \"chain_hash\": \"ab88eb7a583dc68353ca39d53cd4e37d9737ac4b6fa0e6c9b0ab8c659325a64d\", \"created_at\": \"2026-07-26T02:17:59.537952Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a1\", \"reasons\": [\"artifact_not_certified\", \"staging_acceptance_missing\"], \"rollback_candidate\": null, \"run_id\": null, \"tenant_id\": \"tenant-alpha\"}"
+        "stdout": "{\"admission_id\": \"dep-39149ed9c3643c355bbe8f4f09eec260\", \"allowed\": false, \"artifact_sha256\": \"cc9a65d96c25c8f96ba720e01628b734d6df4f5a1057238506ab6d504fb998fd\", \"chain_hash\": \"ff5f335a43355fdc85e2b64c11e7429ad3aa9070dca78655a74bf0d929da28b0\", \"created_at\": \"2026-08-30T12:40:27.987414Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a1\", \"reasons\": [\"artifact_not_certified\", \"staging_acceptance_missing\"], \"rollback_candidate\": null, \"run_id\": null, \"tenant_id\": \"tenant-alpha\"}"
       }
     },
     {
@@ -29,7 +29,7 @@
       "passed": true,
       "detail": {
         "exit": 2,
-        "stdout": "{\"admission_id\": \"dep-f49980b48837ae58dec6fa3ffbc216e4\", \"allowed\": false, \"artifact_sha256\": \"11d7d626a19af7cf0b64c0862b3214a15fac77e3aa1400d70e6902f1a77fdb86\", \"chain_hash\": \"40c1d83374649745ee6fcd3c42c58ce5b6257e362aa6e22954f224c7284b61f5\", \"created_at\": \"2026-07-26T02:17:59.744469Z\", \"deployment_environment\": \"staging\", \"deployment_id\": \"deploy-a2\", \"reasons\": [\"artifact_not_certified\"], \"rollback_candidate\": null, \"run_id\": null, \"tenant_id\": \"tenant-alpha\"}"
+        "stdout": "{\"admission_id\": \"dep-de226c922ca25e4fe770043fa5cce489\", \"allowed\": false, \"artifact_sha256\": \"11d7d626a19af7cf0b64c0862b3214a15fac77e3aa1400d70e6902f1a77fdb86\", \"chain_hash\": \"1b08dbf5ba6527bbb6b743ab658e726bb487454d6ab95bd8ec1ec7889764501a\", \"created_at\": \"2026-08-30T12:40:28.129813Z\", \"deployment_environment\": \"staging\", \"deployment_id\": \"deploy-a2\", \"reasons\": [\"artifact_not_certified\"], \"rollback_candidate\": null, \"run_id\": null, \"tenant_id\": \"tenant-alpha\"}"
       }
     },
     {
@@ -38,7 +38,7 @@
       "passed": true,
       "detail": {
         "exit": 2,
-        "stdout": "{\"admission_id\": \"dep-8ac38cbd2ade07ff1bb5c59d63d2582c\", \"allowed\": false, \"artifact_sha256\": \"67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0\", \"chain_hash\": \"5d31c6a43518753dc06259bee965f1e8fb91e4114f86c47bf61adde8a84ff4dd\", \"created_at\": \"2026-07-26T02:17:59.912909Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a4\", \"reasons\": [\"staging_acceptance_missing\"], \"rollback_candidate\": null, \"run_id\": \"cert-p6-v1\", \"tenant_id\": \"tenant-alpha\"}"
+        "stdout": "{\"admission_id\": \"dep-393b3f1c13aeaf883a659c67fe3a6062\", \"allowed\": false, \"artifact_sha256\": \"67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0\", \"chain_hash\": \"4adc5c6ca6c45d5664c517904d6b86304b4ae573fa525cef6397e6a315d30422\", \"created_at\": \"2026-08-30T12:40:28.260911Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a4\", \"reasons\": [\"staging_acceptance_missing\"], \"rollback_candidate\": null, \"run_id\": \"cert-p6-v1\", \"tenant_id\": \"tenant-alpha\"}"
       }
     },
     {
@@ -57,21 +57,21 @@
       "passed": true,
       "detail": {
         "failure_candidate": {
-          "admission_id": "dep-c3f042d865f9fcd3c85e9d0a1c91484a",
-          "admitted_at": "2026-07-26T02:18:00.438507Z",
+          "admission_id": "dep-88177f711ac3ea76d71d3f5657753a8a",
+          "admitted_at": "2026-08-30T12:40:28.640308Z",
           "artifact_sha256": "67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0",
           "deployment_id": "deploy-a3-prd",
           "run_id": "cert-p6-v1"
         },
         "rollback_target": {
           "artifact_sha256": "67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0",
           "run_id": "cert-p6-v1",
-          "admission_id": "dep-c3f042d865f9fcd3c85e9d0a1c91484a",
+          "admission_id": "dep-88177f711ac3ea76d71d3f5657753a8a",
           "deployment_id": "deploy-a3-prd",
-          "admitted_at": "2026-07-26T02:18:00.438507Z"
+          "admitted_at": "2026-08-30T12:40:28.640308Z"
         },
         "rolled_back": {
-          "admission_id": "dep-d1f547a64a4ddb086ca7a521e0d1a4ce",
+          "admission_id": "dep-368a34d3be4daeb9870a2b93e41ebf45",
           "artifact_sha256": "6cf9eb2e75fbaf4037393188b98be82a05499dcfc0c45a6eeeb840bd7f775c20",
           "deployment_environment": "production",
           "detail": "restored v1",
@@ -87,7 +87,7 @@
       "passed": true,
       "detail": {
         "exit": 2,
-        "stdout": "{\"admission_id\": \"dep-4ec864d16bf5447abf4145975d62ed0a\", \"allowed\": false, \"artifact_sha256\": \"67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0\", \"chain_hash\": \"928bee7494d599c95422e4d3f6c8db2a7e80c2ec1ff5837056aead46be211115\", \"created_at\": \"2026-07-26T02:18:01.842335Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a5\", \"reasons\": [\"verdict_revoked\"], \"rollback_candidate\": null, \"run_id\": \"cert-p6-v1\", \"tenant_id\": \"tenant-alpha\"}"
+        "stdout": "{\"admission_id\": \"dep-1d051283684978484ff174d2f3cc5b7b\", \"allowed\": false, \"artifact_sha256\": \"67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0\", \"chain_hash\": \"8cbb0ce94045d583aaaaa7e150f5a997759f188f1de824d89f973711ef9a5754\", \"created_at\": \"2026-08-30T12:40:29.545903Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a5\", \"reasons\": [\"verdict_revoked\"], \"rollback_candidate\": null, \"run_id\": \"cert-p6-v1\", \"tenant_id\": \"tenant-alpha\"}"
       }
     },
     {

artifacts/p6_acceptance.summary.json

@@ -3,5 +3,5 @@
   "passed": true,
   "checks_total": 12,
   "checks_passed": 12,
-  "generated_at": "2026-07-26T02:18:04.411111Z"
+  "generated_at": "2026-08-30T12:40:31.960114Z"
 }

contracts/certforge-sdk-capabilities.v1.json

@@ -1412,6 +1412,33 @@
         "type": "object"
       }
     },
+    "echo.certforge.publish": {
+      "input_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "command": {
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "run_id": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "command",
+          "run_id"
+        ],
+        "type": "object"
+      },
+      "operation": "POST /v1/subscriber/certifications/{run_id}/publish",
+      "output_schema": {
+        "additionalProperties": {
+          "type": "string"
+        },
+        "type": "object"
+      }
+    },
     "echo.certforge.r5.status": {
       "input_schema": {
         "additionalProperties": false,
@@ -2295,7 +2322,7 @@
       }
     }
   },
-  "capability_count": 60,
+  "capability_count": 61,
   "policy": "Every Certification Forge SDK action has a command-bearing strict input schema and an output schema derived from its production route contract.",
   "schema_version": "1.0.0"
 }

contracts/schemas/certification-run.v1.json

@@ -3,7 +3,7 @@
   "$id": "https://cert.echoforge.com/contracts/certification-run.v1.json",
   "title": "CertificationRunV1",
   "type": "object",
-  "required": ["run_id", "tenant_id", "state", "run_outcome", "release_verdict", "target_identity_digest", "environment_identity_digest", "policy_version"],
+  "required": ["run_id", "tenant_id", "state", "run_outcome", "release_verdict", "target_identity_digest", "environment_identity_digest", "policy_version", "production_e2e"],
   "properties": {
     "run_id": {"type": "string", "minLength": 1, "maxLength": 128},
     "tenant_id": {"type": "string", "minLength": 1, "maxLength": 128},
@@ -14,6 +14,25 @@
     "environment_identity_digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
     "policy_version": {"type": "string", "minLength": 1, "maxLength": 128},
     "evidence_merkle_root": {"type": ["string", "null"], "pattern": "^[0-9a-f]{64}$"},
+    "production_e2e": {
+      "type": "object",
+      "required": ["verified", "profile", "attestation_id", "source_commit", "deployment_sha", "target_identity_digest", "environment_identity_digest", "canonical_target", "tool_count", "signature_verified", "collector_key_id", "attestation_envelope_sha256"],
+      "properties": {
+        "verified": {"type": "boolean"},
+        "profile": {"type": ["string", "null"]},
+        "attestation_id": {"type": ["string", "null"]},
+        "source_commit": {"type": ["string", "null"], "pattern": "^[0-9a-f]{40}(?:[0-9a-f]{24})?$"},
+        "deployment_sha": {"type": ["string", "null"], "pattern": "^[0-9a-f]{40}(?:[0-9a-f]{24})?$"},
+        "target_identity_digest": {"type": ["string", "null"], "pattern": "^[0-9a-f]{64}$"},
+        "environment_identity_digest": {"type": ["string", "null"], "pattern": "^[0-9a-f]{64}$"},
+        "canonical_target": {"type": ["string", "null"]},
+        "tool_count": {"type": ["integer", "null"], "minimum": 0},
+        "signature_verified": {"type": "boolean"},
+        "collector_key_id": {"type": ["string", "null"], "pattern": "^ed25519:[0-9a-f]{32}$"},
+        "attestation_envelope_sha256": {"type": ["string", "null"], "pattern": "^[0-9a-f]{64}$"}
+      },
+      "additionalProperties": false
+    },
     "created_at": {"type": "string", "format": "date-time"},
     "updated_at": {"type": "string", "format": "date-time"}
   },