CosmicClash/docs/SUPPLY-CHAIN.md

Multiplayer artifact supply chain

Container references in the repository are immutable @sha256: digests. The base manifests may contain a zero digest only as a deployment template; a release overlay must replace it with a registry-resolved digest and run the checker with --require-concrete.

The release pipeline must, for every image and exported server artifact:

1. generate and retain an SBOM tied to the exact digest;
2. scan OS and application dependencies and fail on a critical or disallowed vulnerability;
3. sign the image and provenance with the offline release authority, and verify both at cluster admission; and
4. publish the digest, SBOM, scan result, signature and provenance as one immutable release record.

Critical vulnerability fixes are triaged immediately and a patched release is cut within 24 hours of confirmation. A release with an unaccepted critical finding or unverifiable signature is not eligible for admission.

python3 scripts/verify_supply_chain.py is the dependency-free repository guard. Registry signing/scanning and admission require the release environment and are intentionally not simulated by this local check.