Supply-chain qualification

Supply-chain evidence covers locked dependencies, action pinning, component manifests, SBOM generation, provenance, signature verification, TUF metadata, offline closure, transactional activation, health checks, and rollback targets.

T76 assembled these controls into a reproducible, published candidate. T77 will verify the exact candidate independently and record the human release decision.

Until that sequence succeeds, the repository remains source development at 0.0.0-qualification.