{
  "schemaVersion": 1,
  "name": "AIUpdateWatch signed release verification policy",
  "status": "controls-ready-no-production-release-attested",
  "digestAlgorithm": "sha256",
  "archiveFormat": "deterministic-ustar",
  "signatureMode": "sigstore-keyless-github-oidc",
  "oidcIssuer": "https://token.actions.githubusercontent.com",
  "provenanceType": "https://slsa.dev/provenance/v1",
  "protectedEnvironment": "signed-release",
  "requirements": [
    "A protected GitHub Environment authorizes the signing job.",
    "The exact source commit is recorded.",
    "The production build is hashed file by file.",
    "Two independently generated archives must be byte-identical.",
    "The release envelope and provenance are signed with Sigstore keyless signing.",
    "Deployment files must match the approved build manifest.",
    "Rollback uses a previously verified signed release and never changes the live site automatically."
  ],
  "remoteDeploymentAuthorized": false,
  "currentStatement": "Stage 31 adds and validates the release controls. It does not claim that a production release has been signed or deployed."
}