Document adoption-surface RC status and CI hooks.

Update roadmap, schema index, and root docs for v1.3.0-rc.1, and extend CI so conformance and RC gates run with the rest of the suite.

Author: fraware

.github/workflows/ci.yml

@@ -49,6 +49,20 @@ jobs:
         run: python scripts/validate_templates.py
       - name: Validate adapter capabilities
         run: python scripts/validate_capabilities.py
+      - name: Validate adapter conformance
+        run: python scripts/validate_adapter_conformance.py
+      - name: Check capability tables are fresh
+        run: python scripts/render_capability_tables.py --check
+      - name: Check TCB document is fresh
+        run: python scripts/render_tcb_doc.py --check
+      - name: Verify RC DoD (in-repo)
+        run: python scripts/verify_rc_dod.py
+      - name: Verify RC install surface (Action SHA pins + metadata)
+        run: python scripts/verify_rc_install.py
+      - name: Check template claim registry is fresh
+        run: python scripts/build_template_registry.py --check
+      - name: Require SHA-pinned third-party actions in Action/release paths
+        run: python scripts/pin_action_shas.py
       - name: Score all benchmark cases
         run: python benchmarks/formal_pr_bench/score_all_lanes.py
       - name: Score expanded benchmark and publish leaderboard

README.md

@@ -7,7 +7,7 @@
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 [![Python](https://img.shields.io/badge/python-3.10%2B-blue.svg)](pyproject.toml)
 [![FormalPR-Bench](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/fraware/open-verification-kernel/main/docs/benchmarks/leaderboard-badge.json)](docs/benchmarks/latest-leaderboard-summary.json)
-[![Docs](https://img.shields.io/badge/docs-v1.2.1-green.svg)](docs/README.md)
+[![Docs](https://img.shields.io/badge/docs-v1.3.0--rc.1-green.svg)](docs/README.md)
 
 [Quick start](#quick-start) · [Add to CI](#github-actions) · [Contribute](#contribute) · [Documentation](docs/README.md)
 
@@ -30,6 +30,34 @@ flowchart LR
 
 ---
 
+## Public checkers
+
+<!-- BEGIN OVK_CAPABILITY_TABLE -->
+Public checkers from the normative capability registry (`adapters/*/capability.json`). Tables are generated by `scripts/render_capability_tables.py`.
+
+| Checker | release_status | claim_class | Native execution |
+|---|---|---|---|
+| `opa` | preview | policy_evaluation | yes |
+| `z3` | preview | smt_satisfiability | yes |
+| `cbmc` | preview | bounded_model_check | yes |
+| `cedar` | experimental | policy_evaluation | no |
+| `tla+` | experimental | bounded_model_check | no |
+| `kani` | experimental | bounded_model_check | no |
+| `dafny` | experimental | proof_obligation | no |
+| `verus` | experimental | proof_obligation | no |
+| `lean` | experimental | proof_obligation | no |
+| `alloy` | experimental | bounded_model_check | no |
+| `lane-authorization` | experimental | smt_refutation_search | no |
+| `lane-ci-secrets` | experimental | deterministic_witness | no |
+| `lane-deployment` | experimental | deterministic_witness | no |
+| `lane-infrastructure` | experimental | deterministic_witness | no |
+| `lane-self-protection` | experimental | policy_evaluation | no |
+
+Details and fallback rules: [docs/BACKENDS.md](docs/BACKENDS.md).
+<!-- END OVK_CAPABILITY_TABLE -->
+
+---
+
 ## Why this exists
 
 | Without OVK | With OVK |
@@ -119,14 +147,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: fraware/open-verification-kernel@v1.2.1
+      - uses: fraware/open-verification-kernel@v1.3.0-rc.1
         with:
           mode: advisory          # switch to strict when ready
           use-check: "true"       # analyze the PR diff automatically
           emit-check: "true"      # optional; requires checks: write
           post-comment: "true"    # requires pull-requests: write
 ```
 
+Pin target is `v1.3.0-rc.1` after the attributable tag exists. Until then, signed `@v1.2.1` remains the live production pin; see [docs/CURRENT_RELEASE_STATUS.md](docs/CURRENT_RELEASE_STATUS.md).
+
 Copy a full consumer example: [`examples/github_workflows/external_consumer.yml`](examples/github_workflows/external_consumer.yml)
 
 ---

docs/README.md

@@ -1,6 +1,6 @@
 # OVK Documentation
 
-Documentation for Open Verification Kernel (**v1.3.0-rc.1 candidate**; signed tag remains `v1.2.1`).
+Documentation for Open Verification Kernel (**v1.3.0-rc.1** in-repo RC; signed tag remains `v1.2.1` until attributable publication).
 
 Use this index as the canonical entry point. Each guide covers one topic; cross-links replace duplicated content across files.
 
@@ -40,8 +40,10 @@ Use this index as the canonical entry point. Each guide covers one topic; cross-
 | [HOLDOUT_LABEL_SEPARATION.md](HOLDOUT_LABEL_SEPARATION.md) | Sprint 8 label-separated prediction/eval checklist |
 | [SOURCE_PROFILE_HARDENING.md](SOURCE_PROFILE_HARDENING.md) | Sprint 6 source-profile hardening scaffolding |
 | [ATTRIBUTABLE_PUBLICATION.md](ATTRIBUTABLE_PUBLICATION.md) | Sprint 10 rc.1 / v1.3.0 publication gate |
+| [TRUSTED_COMPUTING_BASE.md](TRUSTED_COMPUTING_BASE.md) | Reviewer TCB inventory (registry + Action/App) |
 | [EXTERNAL_PILOT_PLAYBOOK.md](EXTERNAL_PILOT_PLAYBOOK.md) | Advisory→strict rollout on external OSS repos |
 | [PILOT_CASE_STUDIES.md](PILOT_CASE_STUDIES.md) | In-repo pilot metrics and external pilot reporting |
+| [pilots/README.md](pilots/README.md) | Published advisory pilot reports (Python, JS/TS, infra) |
 | [AGENT_REPAIR_LOOP.md](AGENT_REPAIR_LOOP.md) | Counterexample-to-repair workflow for MCP agents |
 | [benchmarks/adoption-summary.json](benchmarks/adoption-summary.json) | Machine-readable adoption metrics (see [BENCHMARK.md](BENCHMARK.md) for field-name notes) |
 
@@ -69,6 +71,7 @@ Use this index as the canonical entry point. Each guide covers one topic; cross-
 
 | Document | Purpose |
 |---|---|
+| [RELEASE_NOTES_v1.3.0-rc.1.md](RELEASE_NOTES_v1.3.0-rc.1.md) | v1.3.0-rc.1 candidate changelog |
 | [RELEASE_NOTES_v1.2.0.md](RELEASE_NOTES_v1.2.0.md) | v1.2.0 changelog |
 | [RELEASE_NOTES_v1.1.0.md](RELEASE_NOTES_v1.1.0.md) | v1.1.0 changelog |
 | [RELEASE_NOTES_v1.0.0.md](RELEASE_NOTES_v1.0.0.md) | v1.0.0 changelog |
@@ -79,12 +82,14 @@ Use this index as the canonical entry point. Each guide covers one topic; cross-
 docs/
   README.md                 # this index
   CURRENT_RELEASE_STATUS.md # living adoption dashboard
+  TRUSTED_COMPUTING_BASE.md # reviewer TCB inventory (OVK-PR9)
   STATUS.md                 # stable capability inventory
   RELEASE.md                # maintainer guide + known limitations
   RELEASE_NOTES_v*.md       # immutable per-version changelogs
   INTEGRATION.md            # install and GitHub Actions
   LANES.md, BACKENDS.md, …  # reference and operations guides
   ARCHITECTURE.md, …        # design and specification
+  pilots/                   # published advisory pilot reports (OVK-PR8)
   benchmarks/               # committed leaderboard and adoption JSON
   templates/                # external pilot manifest template
 ```

docs/ROADMAP.md

@@ -1,23 +1,34 @@
 # OVK Roadmap
 
-Current product positioning: **`v1.3.0-rc.1` candidate** (typed control plane post-dates signed `v1.2.1`). What OVK can do today: [STATUS.md](STATUS.md). Adoption status: [CURRENT_RELEASE_STATUS.md](CURRENT_RELEASE_STATUS.md). Authoritative program: [ENGINEERING_PROGRAM_2026-07-23_R2.md](ENGINEERING_PROGRAM_2026-07-23_R2.md).
+Current product positioning: **`v1.3.0-rc.1` in-repo release candidate** (package `1.3.0-rc.1`; typed control plane + adoption-surface program post-date signed `v1.2.1`). What OVK can do today: [STATUS.md](STATUS.md). Adoption status: [CURRENT_RELEASE_STATUS.md](CURRENT_RELEASE_STATUS.md). TCB: [TRUSTED_COMPUTING_BASE.md](TRUSTED_COMPUTING_BASE.md). Authoritative program: [ENGINEERING_PROGRAM_2026-07-23_R2.md](ENGINEERING_PROGRAM_2026-07-23_R2.md).
 
 ## Release history
 
 | Version | Summary | Changelog |
 |---|---|---|
-| v1.3.0-rc.1 (candidate) | Typed backend control plane; P0 trust PRs 1–9 in working tree; publication gates open | [DEEP_AUDIT_2026-07-23_R2.md](DEEP_AUDIT_2026-07-23_R2.md) |
+| v1.3.0-rc.1 (in-repo RC) | Adoption surface PR1–PR9: registry, lattice, evidence integrity, conformance, bench provenance, Action SHA pins, App alpha, pilots, TCB; live attributable tag pending | [RELEASE_NOTES_v1.3.0-rc.1.md](RELEASE_NOTES_v1.3.0-rc.1.md) |
 | v1.2.1 | Signed release on pre-control-plane commit; consumer pin baseline | [RELEASE_NOTES_v1.2.1.md](RELEASE_NOTES_v1.2.1.md) |
 | v1.2.0 | All five check types validated end-to-end; clearer GitHub Action outputs; example rollout workflows | [RELEASE_NOTES_v1.2.0.md](RELEASE_NOTES_v1.2.0.md) |
 | v1.1.0 | Realistic PR diff benchmark set; required native checker CI for OPA, Z3, CBMC, Cedar; external rollout guide | [RELEASE_NOTES_v1.1.0.md](RELEASE_NOTES_v1.1.0.md) |
 | v1.0.0 | Unified `ovk check`, five check types, ten backends, GitHub Action, benchmark suite | [RELEASE_NOTES_v1.0.0.md](RELEASE_NOTES_v1.0.0.md) |
 
+## Completed in this working tree (OVK-PR1–PR9)
+
+1. Normative capability registry + multi-OS repro baseline harness.
+2. DecisionState lattice with strict fail-closed truth tables.
+3. Evidence integrity envelope (digests / controlling findings).
+4. Seven-item adapter conformance; stable ⊆ conformant.
+5. FormalPR-Bench provenance, partitions, contamination guards, version manifest.
+6. Action hardening suite + immutable SHA pins for release-path third parties.
+7. GitHub App private alpha with required security controls.
+8. Three advisory pilot reports under `docs/pilots/`.
+9. RC metadata (`1.3.0-rc.1`), TCB doc, DoD + install verification scripts.
+
 ## What we are working on next
 
-1. **Sprint 0 / attributable gates** — live CI, wheel smoke, Action dogfood, and workflow IDs on a non-`[skip ci]` SHA (P0 code PRs 1–9 already in working tree; see [ENGINEERING_PROGRAM_2026-07-23_R2.md](ENGINEERING_PROGRAM_2026-07-23_R2.md)).
-2. **Semantic template conformance v2** and source-profile hardening (Sprints 6–7).
-3. **Consumer validation on rc.1** and label-separated holdout (Sprints 8–9).
-4. **Attributable publication** of `v1.3.0-rc.1` then `v1.3.0` after the 18-condition gate (Sprint 10).
+1. **Attributable publication of `v1.3.0-rc.1`** — non-`[skip ci]` workflow IDs, signed tag, Publish/Sigstore, consumer remotes on the immutable pin ([ATTRIBUTABLE_PUBLICATION.md](ATTRIBUTABLE_PUBLICATION.md)).
+2. **Promotion path to `v1.3.0`** — after the 18-condition gate, consumer validation, and attributable holdout aggregates.
+3. Ongoing calibration of strict lanes on real diffs (advisory remains the default recommendation until attributable RC evidence exists).
 
 ## Not planned as product promises
 

docs/SCHEMA_INDEX.md

@@ -32,7 +32,8 @@ JSON schemas for OVK objects. See also [ARTIFACTS.md](ARTIFACTS.md).
 | [infrastructure.policy.schema.json](../schemas/infrastructure.policy.schema.json) | ovk.infrastructure.policy.v1 | policy configuration files |
 | [verification.config.schema.json](../schemas/verification.config.schema.json) | ovk.config.v1 | `.verification/config.yml` policy routing config |
 | [formal_pr_bench.leaderboard.schema.json](../schemas/formal_pr_bench.leaderboard.schema.json) | formal_pr_bench.leaderboard.v1 | `ovk bench --leaderboard` |
-| [pilot.report.schema.json](../schemas/pilot.report.schema.json) | ovk.pilot_report.v1 | `ovk pilot --output report.json` |
+| [formal_pr_bench.manifest.schema.json](../schemas/formal_pr_bench.manifest.schema.json) | formal_pr_bench.manifest.v1 | `benchmarks/formal_pr_bench/manifest.v1.json` |
+| [pilot.report.schema.json](../schemas/pilot.report.schema.json) | ovk.pilot_report.v1 | `ovk pilot --output report.json`; published under `docs/pilots/*/pilot-report.json` |
 | [pilot.metrics.schema.json](../schemas/pilot.metrics.schema.json) | ovk.pilot_metrics.v1 | `scripts/collect_pilot_metrics.py --output pilot-metrics.json` |
 | [holdout.aggregate_metrics.schema.json](../schemas/holdout.aggregate_metrics.schema.json) | ovk.holdout_aggregate_metrics.v1 | FormalPR holdout aggregate metrics (labels never committed) |
 | [pilot.ledger.schema.json](../schemas/pilot.ledger.schema.json) | ovk.pilot_ledger.v1 | `docs/templates/pilot_ledger.example.json` (scaffolding) |