Freeze 2026 08 25

.github/CODEOWNERS

@@ -0,0 +1,38 @@
+# Default ownership until additional GitHub users are added as maintainers.
+* @fraware
+
+# Acquisition and DSP (frozen fingerprint algorithm er-dsp-2 lives here).
+/packages/acquisition/ @fraware
+/packages/dsp/ @fraware
+
+# Empirical validation contracts, evidence parsers, provenance, Atlas contracts.
+/packages/validation/ @fraware
+/docs/VALIDATION.md @fraware
+/docs/VALIDATION_EVIDENCE.md @fraware
+/docs/EMPIRICAL_CAMPAIGN.md @fraware
+/packages/er-cli/ @fraware
+
+# Research / identity (object models, retrieval, calibration, material/spatial).
+/packages/fingerprint/ @fraware
+
+# Backend / security (production Atlas surfaces; directories may be added later).
+/apps/atlas-api/ @fraware
+/packages/atlas-client/ @fraware
+/.github/workflows/atlas-production-conformance.yml @fraware
+/.github/workflows/full-vision-software-qualification.yml @fraware
+
+# Web consumer and campaign/release consoles.
+/apps/web/ @fraware
+
+# Gate protocol docs (freeze-sensitive; do not treat edits as empirical threshold changes).
+/docs/GATE_A.md @fraware
+/docs/GATE_B.md @fraware
+/docs/GATE_C.md @fraware
+/docs/GATE_*.md @fraware
+
+# Freeze-sensitive validation UI and independent verification tooling.
+/apps/web/src/ReleaseApp.tsx @fraware
+/apps/web/src/CampaignAuthorApp.tsx @fraware
+/apps/web/src/CampaignCollectionApp.tsx @fraware
+/docs/RELEASE_CHECKLIST.md @fraware
+/docs/CLAIM_REGISTRY.md @fraware

.github/workflows/atlas-production-conformance.yml

@@ -0,0 +1,90 @@
+# Atlas software-contract conformance lane.
+#
+# A green run qualifies the checked Atlas client/API contracts on one exact
+# software revision. It is not a public-network qualification, security audit,
+# physical-object claim, or empirical release gate.
+name: atlas-production-conformance
+
+on:
+  pull_request:
+    branches:
+      - post-freeze-development
+  push:
+    branches:
+      - post-freeze-development
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: atlas-production-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  VITE_SOFTWARE_REVISION: ${{ github.event.pull_request.head.sha || github.sha }}
+
+jobs:
+  contracts:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 22
+      - name: Enable Corepack
+        run: corepack enable
+      - name: Install frozen dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck Atlas client
+        run: pnpm --filter @everything-rings/atlas-client typecheck
+      - name: Test Atlas client
+        run: pnpm --filter @everything-rings/atlas-client test
+      - name: Typecheck Atlas API
+        run: pnpm --filter @everything-rings/atlas-api typecheck
+      - name: Test Atlas API contracts, HTTP surface, persistence, and V2 records
+        run: pnpm --filter @everything-rings/atlas-api test
+      - name: Emit scoped conformance report
+        run: |
+          set -euo pipefail
+          mkdir -p qualification
+          cat > qualification/atlas-production-conformance.json <<EOF
+          {
+            "conformanceContractVersion": "atlas-production-conformance-1",
+            "status": "software-contract-qualified",
+            "softwareOnly": true,
+            "physicalObjectTested": false,
+            "releaseGateEquivalent": false,
+            "publicNetworkQualified": false,
+            "sourceRevision": "${VITE_SOFTWARE_REVISION}",
+            "workflowRunId": "github-run:${{ github.run_id }}",
+            "atlasApiPackagePresent": true,
+            "atlasClientPackagePresent": true,
+            "localFileStorePresent": true,
+            "httpSurfacePresent": true,
+            "qualifiedChecks": [
+              "atlas-client-typecheck-and-tests",
+              "atlas-api-typecheck-and-tests",
+              "atlas-v2-contract-tests",
+              "http-contract-tests",
+              "local-persistence-tests",
+              "service-conformance-tests"
+            ],
+            "pendingProductionChecks": [
+              "production-authentication-and-authorization",
+              "rate-limits-and-abuse-controls",
+              "multi-tenant-durability-backup-and-restore",
+              "operational-rollback-and-recovery",
+              "deployment-security-review",
+              "load-and-concurrency-characterization"
+            ]
+          }
+          EOF
+          cat qualification/atlas-production-conformance.json
+      - name: Upload conformance report
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: atlas-production-conformance-${{ env.VITE_SOFTWARE_REVISION }}
+          path: qualification/atlas-production-conformance.json
+          if-no-files-found: error

.github/workflows/ci.yml

@@ -3,19 +3,24 @@ name: ci
 on:
   pull_request:
   push:
-    branches: [main]
+    branches: [main, post-freeze-development]
 
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
-      VITE_SOFTWARE_REVISION: ${{ github.sha }}
+      VITE_SOFTWARE_REVISION: ${{ github.event.pull_request.head.sha || github.sha }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22
       - name: Enable Corepack

.github/workflows/digital-twin-qualification.yml

@@ -14,18 +14,26 @@ on:
       - "apps/web/**"
       - "scripts/**"
       - "docs/DIGITAL_TWIN_QUALIFICATION.md"
+  push:
+    branches:
+      - post-freeze-development
 
 permissions:
   contents: read
 
+concurrency:
+  group: digital-twin-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   qualify:
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     env:
-      VITE_SOFTWARE_REVISION: ${{ github.sha }}
+      VITE_SOFTWARE_REVISION: ${{ github.event.pull_request.head.sha || github.sha }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22
       - name: Enable Corepack
@@ -45,12 +53,14 @@ jobs:
           cat > /tmp/everything-rings-digital-twin-qualification.json <<EOF
           {
             "schemaVersion": 1,
-            "qualificationContractVersion": "digital-twin-qualification-1",
-            "softwareRevision": "${GITHUB_SHA}",
+            "qualificationContractVersion": "digital-twin-qualification-2",
+            "softwareRevision": "${VITE_SOFTWARE_REVISION}",
+            "workflowRunId": "github-run:${{ github.run_id }}",
             "releaseGateEquivalent": false,
             "physicalMicrophonePathTested": false,
             "physicalObjectTested": false,
             "layers": [
+              "frozen-dependency-install",
               "typecheck",
               "unit-tests",
               "digital-twin-acoustic-stress",
@@ -63,8 +73,8 @@ jobs:
           EOF
           cat /tmp/everything-rings-digital-twin-qualification.json
       - name: Upload qualification report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: digital-twin-qualification-${{ github.sha }}
+          name: digital-twin-qualification-${{ env.VITE_SOFTWARE_REVISION }}
           path: /tmp/everything-rings-digital-twin-qualification.json
           if-no-files-found: error

.github/workflows/full-vision-software-qualification.yml

@@ -0,0 +1,132 @@
+name: full-vision-software-qualification
+
+on:
+  pull_request:
+    branches:
+      - post-freeze-development
+  push:
+    branches:
+      - post-freeze-development
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: full-vision-software-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  VITE_SOFTWARE_REVISION: ${{ github.event.pull_request.head.sha || github.sha }}
+
+jobs:
+  qualify:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 22
+      - name: Enable Corepack
+        run: corepack enable
+      - name: Install frozen dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck all workspaces
+        run: pnpm typecheck
+      - name: Run all software and digital-twin tests
+        run: pnpm test
+      - name: Build all workspaces
+        run: pnpm build
+      - name: Browser and lifecycle qualification
+        run: bash scripts/browser-smoke.sh
+      - name: Emit machine-readable qualification report
+        run: |
+          mkdir -p qualification
+          cat > qualification/full-vision-software.json <<EOF
+          {
+            "qualificationContractVersion": "full-vision-software-qualification-2",
+            "sourceRevision": "${VITE_SOFTWARE_REVISION}",
+            "workflowRunId": "github-run:${{ github.run_id }}",
+            "qualifiedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "softwareOnly": true,
+            "physicalObjectTested": false,
+            "humanPerceptualValidationPerformed": false,
+            "realPlaybackTransducerValidated": false,
+            "releaseGateEquivalent": false,
+            "checks": {
+              "frozenDependencyInstall": "pass",
+              "typecheck": "pass",
+              "unitAndDigitalTwinTests": "pass",
+              "build": "pass",
+              "browserAndLifecycleQualification": "pass"
+            },
+            "capabilityFamilies": [
+              "acquisition-software-path",
+              "er-dsp-2",
+              "research-high-resolution-estimator",
+              "modal-reconstruction",
+              "playable-instrument",
+              "measurement-provenance",
+              "artifact-integrity",
+              "nuisance-characterization",
+              "acoustic-object-model",
+              "spatial-modal-field",
+              "verification-baseline",
+              "specimen-retrieval",
+              "held-out-data-bound-calibration",
+              "risk-coverage",
+              "algorithm-promotion-governance",
+              "research-material-inference",
+              "station-calibration-contract",
+              "atlas-registry",
+              "atlas-search",
+              "atlas-snapshots",
+              "atlas-collections-and-graph",
+              "atlas-service-conformance",
+              "machine-readable-assurance",
+              "browser-twin-lab",
+              "browser-atlas-lab"
+            ]
+          }
+          EOF
+      - name: Upload qualification report
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: full-vision-software-qualification-${{ env.VITE_SOFTWARE_REVISION }}
+          path: qualification/full-vision-software.json
+          if-no-files-found: error
+
+  # Schema migration discipline (owned by packages/validation): every versioned
+  # artifact contract requires parser + validator + ArtifactMigrationRegistryV1
+  # tests before it is used in a release. This job does not change empirical
+  # v8 evidence semantics.
+  sbom:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Prepare SBOM output directory
+        run: mkdir -p qualification
+      - name: Generate CycloneDX SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: qualification/sbom.cdx.json
+          upload-artifact: false
+          upload-release-assets: false
+          dependency-snapshot: false
+      - name: Digest SBOM bytes
+        run: |
+          set -euo pipefail
+          test -f qualification/sbom.cdx.json
+          sha256sum qualification/sbom.cdx.json | tee qualification/sbom.cdx.json.sha256
+      - name: Upload CycloneDX SBOM
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: cyclonedx-sbom-${{ env.VITE_SOFTWARE_REVISION }}
+          path: |
+            qualification/sbom.cdx.json
+            qualification/sbom.cdx.json.sha256
+          if-no-files-found: error

.github/workflows/pages.yml

@@ -53,8 +53,8 @@ jobs:
     needs: pages-status
     if: needs.pages-status.outputs.enabled == 'true'
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22
       - name: Enable Corepack
@@ -63,8 +63,8 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: Build static site
         run: pnpm --filter @everything-rings/web exec vite build --base=/EVERYTHING-RINGS/
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v4
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
+      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: apps/web/dist
 
@@ -77,4 +77,4 @@ jobs:
     steps:
       - name: Deploy
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5