Launch gate: independent security, UX, provenance and external-pilot reviewers #230

Purpose — convert qualified development into independently reviewed, usable infrastructure

Date opened: 2026-10-17. This is a review and integration gate, not a new feature PR, merge authorization, release certificate, or claim of independent user adoption. The North Star is maximal trustworthy reuse, low-friction usability, and organic developer distribution.

Frozen review subjects, based on live GitHub readback

Verification product draft #228

• Source: 837c931d059f74dcda06432d83f5bde759f53d0a; based on main=79370539ca9b26a0a6b01f6ac6ab6923243f40f4.
• Cumulative diff: 104 commits, 49 changed files. This includes draft integration: preserve pilot evidence integrity and release provenance across drafts #225 and fix(source)+feat(product): bind PR merge evidence and publish scoped read-only job summaries #227 by ancestry; security(action): prevent unbound manifest results becoming PR-wide checks #226 has one separate history commit, yet tests/test_action_combined_identity_contract.py has identical blob SHA in security(action): prevent unbound manifest results becoming PR-wide checks #226/feat(product): package source-scoped advisory PR summary for reuse #228. Review the actual source bytes, not just the ancestry.
• Exact-head workflows all SUCCESS: CI 38853899851, six-platform Repro 38853899711, Native Tier 1 38853899837, Native Tier 1b 38853899744. Real dogfood validates local merge-preview/receipt/evidence agreement and emits an unsigned, non-authoritative advisory report.
• Caveat: Passing software tests is not a source-to-IR semantic proof, authenticated event/runner, independently adjudicated safety result, production relying policy, or verified external adoption.

Website draft #229

• Source: 59be60c89c1382a9bcc01b73994846d60cac9b23 on same main.
• 20 commits, 9 changed files, separate from the verification engine. Site quality 38857678905, CI 38857678593, Repro 38857678602 SUCCESS.
• Client-only curated search over 51 indexed documentation/resources. No live guarantee/evidence search or verification execution. GitHub Pages is not enabled. Review the site as a documentation/discovery frontend, not a certificate portal.

Release controls issue #25

• Current main protected=false, rulesets=[]; latest GitHub Release v1.2.1 has an unsigned tag and is not immutable.
• GitHub connector has no repository-admin mutation for branch/tag rulesets. An actual authorized administrator must configure and independently read back effective protections before merging/releasing. A PR's green CI does not close this.

Distinct review roles — record real GitHub identities; do not fill with placeholders as approvals

• Reviewer A — source/event identity and verification security. Person independent of implementation, competent in GitHub Actions/fork trust, Python CLI, evidence formats. Review action.yml, prepare_verified_change_input.py, ovk/core/source_binding_identity.py, context.py, check.py, kernel.py, signed-envelope and report code. Actively challenge base/head/merge drift, unbound manifests and caller-supplied diffs, stale artifacts, altered event payloads, absent data, misleading allow, redaction/data leakage, least permissions. Reproduce exact SHA and inspect outputs.
• Reviewer B — website, usability, accessibility and claims. Person independent of site implementation, preferably unfamiliar with OVK. Test navigation and search from blank start, novice/expert queries, keyboard-only, screen reader, 320px mobile, focus, contrast, no-results, broken links, local offline preview, prompt-free setup. Verify all 51 indexed references exist at pinned paths and draft-only source is explicitly labeled. Confirm no fake check/certificate, sensitive data collection, or public deployment.
• Reviewer C — distribution, legal and release provenance. Independent repository maintainer/security reviewer. Verify dependency/install provenance and published release identity; critically review diff's LICENSE replacement (full Apache-2.0 text) and new NOTICE, ownership/third-party attribution and package metadata. Apply active main and v* rulesets, test effective protections and bypasses, then independently authorize any exact-SHA signed-tag publishing under the documented release procedure. No unsigned historical v1.2.1 reattribution.
• Reviewer D — external natural-PR pilot. Outside engineering maintainer who explicitly consents to read-only non-blocking evaluation. Check in-scope source constructs before installing; all natural PRs/unsupported cases go in the denominator. Maintain independent adjudications and reviewer-time logs. No person has consented as of this issue opening.

Evidence each reviewer must attach before approval

Full GitHub handle; role; reviewer independence/conflict statement; exact source SHA; all documents and runtime paths inspected; concrete adversarial cases; reproducible commands and CI/artifact URLs; critical unresolved uncertainties; explicit approve / request changes / insufficient evidence decision. GitHub submitted review is authoritative for PR review status; a project-authored comment or CI success does not count as independent review. Cross-team pilot consent must be recorded separately.

Release and integration order

1. Obtain independent A/B/C reviews and enabled, live-read-back branch/tag governance. Make targeted, review-driven corrections only; any source edit invalidates prior exact-head CI qualification.
2. Prefer independently integrating the small, non-executing site PR feat(site): accessible searchable OVK resource explorer (static preview) #229 once B/C and content/publication review are complete; do not activate hosting without an approved domain, privacy decision, and pinned deployment provenance.
3. Integrate one cumulative product candidate feat(product): package source-scoped advisory PR summary for reuse #228, after A/C review and complete final-head gates on the actual target base. Preserve historical PRs fix(pilot): prevent circular false-positive metrics and unsafe strict promotion #217/docs: correct unsigned release-tag claims and unsafe pilot promotion guidance #219/release: fail-closed Action version pin and accurate public adoption guidance #220/security(action): bind PR diff to checked-out merge preview and refuse stale source identity #223/integration(security): qualify release installer and PR source binding together #224/integration: preserve pilot evidence integrity and release provenance across drafts #225/security(action): prevent unbound manifest results becoming PR-wide checks #226/fix(source)+feat(product): bind PR merge evidence and publish scoped read-only job summaries #227 as reviewable provenance, and explicitly mark superseded branches only once source equivalence/unique fixes are established. Do not blindly merge the individual drafts again.
4. Release via a new authorized signed annotated tag and bound publication ledger; do not conflate main merge with verified public release.
5. Recruit one consenting maintainer after an attributable read-only preview is safe. In the first 14 days, record setup time, all eligible/unsupported natural PRs, source-model claim, exact source/evidence identities, independent adjudication, reviewer utility, and second PR/second teammate reuse.

Exit criteria

This issue closes only with real submitted independent review records, governance proof, an agreed integration/release decision with pinned SHAs, and a separate active external-pilot execution ticket. Do not infer customer adoption, semantic support, valid historical evidence transport, or strict authorization from a reviewer signature alone.

Related: North Star #216, external pilot #20, source binding #222, Lean support #195, historical applicability #177.