[Phase 16] S12 — Release DAG and release-time evidence #898

Roadmap · Phase 16, step S12 · size XL · 9 unit(s) · planned in docs/roadmap/phase-16-trust-surface-hardening.md:636-680

Summary

Every unit is a defect in the release DAG or in the evidence that DAG should produce, and they share one blast radius: they can only be verified by pushing throwaway tags. Zero lines of the wheel's Python modules execute in any of the twelve release-matrix cells — tests/__init__.py plus pytest's default prepend import mode put the checkout ahead of site-packages — and the SBOM step is metadata-only. What the matrix really gates (wheel build, metadata validity, twine check, cross-platform dependency resolution) is kept.

Units

Blocked by

#889 — the standard this step is reviewed against; write it first.

Decisions this step executes

• C-12 — wheel testing: keep the source suite and add a wheel-contract step.
• C-13 — the release-record check exempts PEP 440 pre-releases; tag ↔ version and ancestry are still enforced for every tag.
• C-14 — publishing is gated on a supply-chain scan.

Plan

• Add a wheel-contract step run from outside the checkout, mirroring the nightly's wheel-install-smoke.
• Add a supply-chain-gate job that runs the nightly's two helpers against the tagged SHA.
• Local verification is impossible for four criteria: use a scratch branch and throwaway v0.0.0-test-* tags per rejection case plus a deliberately broken wheel; then restore, re-tag green, delete every throwaway tag from the remote and confirm no [X.Y.Z] heading was left in CHANGELOG.md.

Exit criteria

• Omitting a package-data glob turns the matrix red at the wheel-contract step while pytest tests/ stays green.
• A mismatched, off-main or record-less tag cannot reach build.
• A tagged SHA with an unsuppressed pip-audit finding cannot reach publish; a clean one leaves a retained artefact referencing that SHA.
• Every referable BOM object has a globally unique bom-ref, validated against the official CycloneDX schema plus the semantic checks the schema cannot express.
• The exact documented command downloads all SBOMs for a real released tag.
• A policy guard rejects any non-local uses: that is not a full 40-character SHA.
• A meta-test compares documentation claims against the workflow trigger inventory, so no document can claim enforcement CI does not perform.

How to deliver

• One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
• A reproducer that is red before the fix and green after; the full gauntlet from CLAUDE.md passes under ./.venv/bin/python.
• Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
• A step that grows a deferred module carries its budget_history justification in the same diff; a widened guard rolls out non-strict first, then flips.
• Commit bodies cite Absorbs F-W20260729-…; the CHANGELOG [Unreleased] section gets an entry only for a change a user or library consumer can observe (decision C-20).

_{Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.}