Summary

The "Enforcing with Admission Policies" section of docs/integrator/supply-chain-verification.md shipped admission-policy examples that cannot verify AICR's GitHub Artifact Attestations as written. They were replaced with a pointer to the official current docs (PR #1528); this issue tracks adding validated, cluster-tested copy-paste examples.

What was wrong

• Kyverno used the legacy Cosign attestation format. GitHub Artifact Attestations are Sigstore bundles; Kyverno verifies them with type: SigstoreBundle (see Kyverno's "Verifying Sigstore Bundles" guide).
• Sigstore Policy Controller pinned v0.10.0, but Sigstore-bundle support arrived in v0.13.0 and requires signatureFormat: bundle.
• The negative test could not be made coherent without an in-scope unsigned image under a namespace the author controls; the namespace was also not consistently used for both the enablement label and kubectl run -n.

Ask

Add validated examples (tested against a real cluster):

• Kyverno ClusterPolicy using type: SigstoreBundle + the build-provenance attestation, pinned to a current Kyverno version.
• Sigstore Policy Controller ClusterImagePolicy on v0.13.0+ with signatureFormat: bundle, the namespace policy.sigstore.dev/include=true label, and a coherent positive/negative test using a $NAMESPACE variable and an in-scope image the test owner controls.

Identity values to verify against: issuer https://token.actions.githubusercontent.com, subject https://github.com/NVIDIA/aicr/.github/workflows/*.

Related

• Surfaced in the docs review of docs: full correctness audit — fix drift across docs, demos, ADRs #1528. Sibling supply-chain follow-ups: Evidence pointer-contract gate trusts pointer-supplied signer (no crypto verification) #1535 (signer trust), Reconcile SLSA Build Level claim (docs say L3; build architecture looks like L2) #1536 (SLSA level).