# Multiplayer artifact supply chain

Container references in the repository are immutable `@sha256:` digests. The
base manifests may contain a zero digest only as a deployment template; a
release overlay must replace it with a registry-resolved digest and run the
checker with `--require-concrete`.

The release pipeline must, for every image and exported server artifact:

1. generate and retain an SBOM tied to the exact digest;
2. scan OS and application dependencies and fail on a critical or disallowed
   vulnerability;
3. sign the image and provenance with the offline release authority, and
   verify both at cluster admission; and
4. publish the digest, SBOM, scan result, signature and provenance as one
   immutable release record.

Critical vulnerability fixes are triaged immediately and a patched release is
cut within 24 hours of confirmation. A release with an unaccepted critical
finding or unverifiable signature is not eligible for admission.

`python3 scripts/verify_supply_chain.py` is the dependency-free repository
guard. Registry signing/scanning and admission require the release environment
and are intentionally not simulated by this local check.