Post-NVIDIA#1528 documentation-correctness follow-ups, each verified against
the implementation on current main:

- supply-chain-verification.md, provenance.md/.sh/slides, SECURITY.md:
  gh attestation verify pinned to --repo NVIDIA/aicr + --signer-workflow
  (on-tag.yaml) instead of --owner alone, which trusts any NVIDIA repo.
- ADR-007: correct the verifier Update note — unsigned bundles yield a
  pending (exit 0) result rather than always being signature-verified, and
  a pointer's claimed signer is always cross-checked; only external
  issuer/SAN pinning is opt-in (pkg/evidence/verifier/verify.go).
- artifact-verification.md: 'attested' trust level no longer claims a
  'full chain' when the binary attestation is missing — the verifier
  classifies that as an incomplete chain (pkg/bundler/verifier).
- automation.md: upload-artifact path snapshot-*.yaml -> snapshot.yaml
  (the file the snapshot step actually writes).
- maintaining.md: signer-identity (item 3) and OCI-ref (item 4) checks are
  maintainer judgement calls, not automatic recipe-evidence checks.
- evidence-ingest.md: discovery walks the per-source nested layout, not the
  flat pointer (pkg/evidence/verifier/discover.go).
- ADR-014: CR-template snippet matches the real flat field-by-field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600 (RecipeCacheTTL).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Written to current specs; left for end-to-end cluster verification.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno example still pending cluster validation.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 6 (doc accuracy + 2 regressions, verified against source):
- Fix regressions: coverage floor is 75% (.settings.yaml), not 70%; restore the
  real PORT + SHUTDOWN_TIMEOUT_SECONDS env overrides in pkg/server/doc.go.
- Trust tables: attested = bundle attestation verified, binary missing/failed or
  external data; unknown also covers a bundle attestation that fails verification
  (slide, demo, CLI reference).
- bundle JSON pipeline captures the verify exit code separately (a failed binary
  attestation reports attested but exits nonzero; the jq pipe would mask it).
- slide CIP subjectRegExp uses a single-quoted scalar (double-quoted \. is invalid
  YAML); Kyverno labeled tested-and-not-working, not 'being validated'.
- Offline guidance reconciled everywhere: trusted root falls back to the embedded
  copy on cache miss; no verify-path fetch; trust update not required offline
  (artifact guide PEM section + CLI reference).
- Propagate NVIDIA#1549 (recipe.yaml excluded) to the demo script + data-flow deployer
  output; NVIDIA#1535 resolved ingest lifecycle to the evidence demo + maintainer guide.
- data-flow deployer box: single DefaultBundler (not 'Run bundlers').
- SLSA L3 qualified in installation + demos README; slide binary SBOM not 'signed';
  diagram 'hardened runner' -> 'GitHub-hosted runner'.
- evidence/known-failure + evidence/exempt marked future-state at the exit-1 and
  recipe-development references too.
- provenance demo script: GitHub auth preflight + attestation comes from the
  GitHub API (not GHCR).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 6 (doc accuracy + 2 regressions, verified against source):
- Fix regressions: coverage floor is 75% (.settings.yaml), not 70%; restore the
  real PORT + SHUTDOWN_TIMEOUT_SECONDS env overrides in pkg/server/doc.go.
- Trust tables: attested = bundle attestation verified, binary missing/failed or
  external data; unknown also covers a bundle attestation that fails verification
  (slide, demo, CLI reference).
- bundle JSON pipeline captures the verify exit code separately (a failed binary
  attestation reports attested but exits nonzero; the jq pipe would mask it).
- slide CIP subjectRegExp uses a single-quoted scalar (double-quoted \. is invalid
  YAML); Kyverno labeled tested-and-not-working, not 'being validated'.
- Offline guidance reconciled everywhere: trusted root falls back to the embedded
  copy on cache miss; no verify-path fetch; trust update not required offline
  (artifact guide PEM section + CLI reference).
- Propagate NVIDIA#1549 (recipe.yaml excluded) to the demo script + data-flow deployer
  output; NVIDIA#1535 resolved ingest lifecycle to the evidence demo + maintainer guide.
- data-flow deployer box: single DefaultBundler (not 'Run bundlers').
- SLSA L3 qualified in installation + demos README; slide binary SBOM not 'signed';
  diagram 'hardened runner' -> 'GitHub-hosted runner'.
- evidence/known-failure + evidence/exempt marked future-state at the exit-1 and
  recipe-development references too.
- provenance demo script: GitHub auth preflight + attestation comes from the
  GitHub API (not GHCR).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 7 (doc accuracy, verified against source):
- NVIDIA#1550: pipefail in the JSON demo script + slide so a failed verify is not
  masked by the jq pipe; attested/unknown tables note a failed binary
  attestation reports attested but exits nonzero, and a failed bundle
  attestation yields unknown (artifact guide + SECURITY).
- evidence slide deck: nested pointer path <recipe>/<src>/<digest>.yaml (not
  flat); pointer verification pulls the OCI bundle (registry access; 'offline'
  reserved for a local bundle dir); evidence.md intro corrected.
- trust setup: removed from the gh/cosign provenance demo (those tools manage
  their own roots); made optional stale-root remediation in the bundle demo.
- NVIDIA#1549: caveat the bundle-attestation intro ('signs checksums.txt, recipe.yaml
  excluded'), OpenShift layout, and data-flow checksum line.
- data-flow Stage-5 diagram rewritten to one flow listing all five deployers
  (helm, argocd, argocd-helm, flux, helmfile); dropped the nonexistent scripts/.
- SLSA/SBOM: README qualified to provenance v1 (NVIDIA#1536); provenance clarifies the
  image and binary SBOMs share SPDX format but are distinct artifacts; bundle
  slide stops calling the binary SBOM signed.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 6 (doc accuracy + 2 regressions, verified against source):
- Fix regressions: coverage floor is 75% (.settings.yaml), not 70%; restore the
  real PORT + SHUTDOWN_TIMEOUT_SECONDS env overrides in pkg/server/doc.go.
- Trust tables: attested = bundle attestation verified, binary missing/failed or
  external data; unknown also covers a bundle attestation that fails verification
  (slide, demo, CLI reference).
- bundle JSON pipeline captures the verify exit code separately (a failed binary
  attestation reports attested but exits nonzero; the jq pipe would mask it).
- slide CIP subjectRegExp uses a single-quoted scalar (double-quoted \. is invalid
  YAML); Kyverno labeled tested-and-not-working, not 'being validated'.
- Offline guidance reconciled everywhere: trusted root falls back to the embedded
  copy on cache miss; no verify-path fetch; trust update not required offline
  (artifact guide PEM section + CLI reference).
- Propagate NVIDIA#1549 (recipe.yaml excluded) to the demo script + data-flow deployer
  output; NVIDIA#1535 resolved ingest lifecycle to the evidence demo + maintainer guide.
- data-flow deployer box: single DefaultBundler (not 'Run bundlers').
- SLSA L3 qualified in installation + demos README; slide binary SBOM not 'signed';
  diagram 'hardened runner' -> 'GitHub-hosted runner'.
- evidence/known-failure + evidence/exempt marked future-state at the exit-1 and
  recipe-development references too.
- provenance demo script: GitHub auth preflight + attestation comes from the
  GitHub API (not GHCR).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 7 (doc accuracy, verified against source):
- NVIDIA#1550: pipefail in the JSON demo script + slide so a failed verify is not
  masked by the jq pipe; attested/unknown tables note a failed binary
  attestation reports attested but exits nonzero, and a failed bundle
  attestation yields unknown (artifact guide + SECURITY).
- evidence slide deck: nested pointer path <recipe>/<src>/<digest>.yaml (not
  flat); pointer verification pulls the OCI bundle (registry access; 'offline'
  reserved for a local bundle dir); evidence.md intro corrected.
- trust setup: removed from the gh/cosign provenance demo (those tools manage
  their own roots); made optional stale-root remediation in the bundle demo.
- NVIDIA#1549: caveat the bundle-attestation intro ('signs checksums.txt, recipe.yaml
  excluded'), OpenShift layout, and data-flow checksum line.
- data-flow Stage-5 diagram rewritten to one flow listing all five deployers
  (helm, argocd, argocd-helm, flux, helmfile); dropped the nonexistent scripts/.
- SLSA/SBOM: README qualified to provenance v1 (NVIDIA#1536); provenance clarifies the
  image and binary SBOMs share SPDX format but are distinct artifacts; bundle
  slide stops calling the binary SBOM signed.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 6 (doc accuracy + 2 regressions, verified against source):
- Fix regressions: coverage floor is 75% (.settings.yaml), not 70%; restore the
  real PORT + SHUTDOWN_TIMEOUT_SECONDS env overrides in pkg/server/doc.go.
- Trust tables: attested = bundle attestation verified, binary missing/failed or
  external data; unknown also covers a bundle attestation that fails verification
  (slide, demo, CLI reference).
- bundle JSON pipeline captures the verify exit code separately (a failed binary
  attestation reports attested but exits nonzero; the jq pipe would mask it).
- slide CIP subjectRegExp uses a single-quoted scalar (double-quoted \. is invalid
  YAML); Kyverno labeled tested-and-not-working, not 'being validated'.
- Offline guidance reconciled everywhere: trusted root falls back to the embedded
  copy on cache miss; no verify-path fetch; trust update not required offline
  (artifact guide PEM section + CLI reference).
- Propagate NVIDIA#1549 (recipe.yaml excluded) to the demo script + data-flow deployer
  output; NVIDIA#1535 resolved ingest lifecycle to the evidence demo + maintainer guide.
- data-flow deployer box: single DefaultBundler (not 'Run bundlers').
- SLSA L3 qualified in installation + demos README; slide binary SBOM not 'signed';
  diagram 'hardened runner' -> 'GitHub-hosted runner'.
- evidence/known-failure + evidence/exempt marked future-state at the exit-1 and
  recipe-development references too.
- provenance demo script: GitHub auth preflight + attestation comes from the
  GitHub API (not GHCR).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 7 (doc accuracy, verified against source):
- NVIDIA#1550: pipefail in the JSON demo script + slide so a failed verify is not
  masked by the jq pipe; attested/unknown tables note a failed binary
  attestation reports attested but exits nonzero, and a failed bundle
  attestation yields unknown (artifact guide + SECURITY).
- evidence slide deck: nested pointer path <recipe>/<src>/<digest>.yaml (not
  flat); pointer verification pulls the OCI bundle (registry access; 'offline'
  reserved for a local bundle dir); evidence.md intro corrected.
- trust setup: removed from the gh/cosign provenance demo (those tools manage
  their own roots); made optional stale-root remediation in the bundle demo.
- NVIDIA#1549: caveat the bundle-attestation intro ('signs checksums.txt, recipe.yaml
  excluded'), OpenShift layout, and data-flow checksum line.
- data-flow Stage-5 diagram rewritten to one flow listing all five deployers
  (helm, argocd, argocd-helm, flux, helmfile); dropped the nonexistent scripts/.
- SLSA/SBOM: README qualified to provenance v1 (NVIDIA#1536); provenance clarifies the
  image and binary SBOMs share SPDX format but are distinct artifacts; bundle
  slide stops calling the binary SBOM signed.

Signed-off-by: Yuan Chen <[email protected]>

Round 8 (self-review): replace the Stage-4 Bundler Framework box with a concise
accurate flow (one DefaultBundler pass; values.yaml is the marshaled map and
checksums.txt is computed, not go:embed-templated; recipe.yaml excluded NVIDIA#1549).
Kept the real per-component manifests (ClusterPolicy/CR) rather than deleting
them as a prior review suggested.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 6 (doc accuracy + 2 regressions, verified against source):
- Fix regressions: coverage floor is 75% (.settings.yaml), not 70%; restore the
  real PORT + SHUTDOWN_TIMEOUT_SECONDS env overrides in pkg/server/doc.go.
- Trust tables: attested = bundle attestation verified, binary missing/failed or
  external data; unknown also covers a bundle attestation that fails verification
  (slide, demo, CLI reference).
- bundle JSON pipeline captures the verify exit code separately (a failed binary
  attestation reports attested but exits nonzero; the jq pipe would mask it).
- slide CIP subjectRegExp uses a single-quoted scalar (double-quoted \. is invalid
  YAML); Kyverno labeled tested-and-not-working, not 'being validated'.
- Offline guidance reconciled everywhere: trusted root falls back to the embedded
  copy on cache miss; no verify-path fetch; trust update not required offline
  (artifact guide PEM section + CLI reference).
- Propagate NVIDIA#1549 (recipe.yaml excluded) to the demo script + data-flow deployer
  output; NVIDIA#1535 resolved ingest lifecycle to the evidence demo + maintainer guide.
- data-flow deployer box: single DefaultBundler (not 'Run bundlers').
- SLSA L3 qualified in installation + demos README; slide binary SBOM not 'signed';
  diagram 'hardened runner' -> 'GitHub-hosted runner'.
- evidence/known-failure + evidence/exempt marked future-state at the exit-1 and
  recipe-development references too.
- provenance demo script: GitHub auth preflight + attestation comes from the
  GitHub API (not GHCR).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 7 (doc accuracy, verified against source):
- NVIDIA#1550: pipefail in the JSON demo script + slide so a failed verify is not
  masked by the jq pipe; attested/unknown tables note a failed binary
  attestation reports attested but exits nonzero, and a failed bundle
  attestation yields unknown (artifact guide + SECURITY).
- evidence slide deck: nested pointer path <recipe>/<src>/<digest>.yaml (not
  flat); pointer verification pulls the OCI bundle (registry access; 'offline'
  reserved for a local bundle dir); evidence.md intro corrected.
- trust setup: removed from the gh/cosign provenance demo (those tools manage
  their own roots); made optional stale-root remediation in the bundle demo.
- NVIDIA#1549: caveat the bundle-attestation intro ('signs checksums.txt, recipe.yaml
  excluded'), OpenShift layout, and data-flow checksum line.
- data-flow Stage-5 diagram rewritten to one flow listing all five deployers
  (helm, argocd, argocd-helm, flux, helmfile); dropped the nonexistent scripts/.
- SLSA/SBOM: README qualified to provenance v1 (NVIDIA#1536); provenance clarifies the
  image and binary SBOMs share SPDX format but are distinct artifacts; bundle
  slide stops calling the binary SBOM signed.

Signed-off-by: Yuan Chen <[email protected]>

Round 8 (self-review): replace the Stage-4 Bundler Framework box with a concise
accurate flow (one DefaultBundler pass; values.yaml is the marshaled map and
checksums.txt is computed, not go:embed-templated; recipe.yaml excluded NVIDIA#1549).
Kept the real per-component manifests (ClusterPolicy/CR) rather than deleting
them as a prior review suggested.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 8 (doc accuracy, verified against source):
- Privacy: only the allowlist is slug-only; committed pointers + Rekor publish
  signer.identity, so sign with a non-personal identity (artifact guide).
- Stop overstating recipe evidence as physical/'real hardware' proof — it is a
  signer-bound, tamper-evident validation record (README, evidence.md, slides).
- run_expect_fail returns 0 on expected failure / 1 on unexpected success, so a
  tamper demo that unexpectedly passes now fails the script (both demo scripts).
- Manual install keeps aicr-attestation.sigstore.json beside the binary so
  --attest works; CLI reference corrected (archive includes it).
- SECURITY pinning mirrors ADR-006: gate is bom-pinning-check -strict (with an
  exemption map), admission digest-verification is roadmap, CycloneDX BOM is
  locally generated (not a published release asset).
- evidence.md pointer examples use a full <bundle-digest> placeholder (the
  truncated sha256-33d4cf36 was contract-invalid).
- NVIDIA#1549: caveat the overview tamper bullet (checksums.txt list; recipe.yaml excluded).
- NVIDIA#1550: attested rows note a failed binary attestation exits nonzero (SECURITY,
  CLI reference, demo).
- trust update made optional (embedded-root fallback) in the bundle script + evidence.
- rekor-cli search --sha (not an OCI ref); crane required for digest (docker
  inspect needs a prior pull); docs/README SLSA level qualified (NVIDIA#1536).
- evidence deck: CLI binary SBOM is a separate unsigned asset, not signed.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 6 (doc accuracy + 2 regressions, verified against source):
- Fix regressions: coverage floor is 75% (.settings.yaml), not 70%; restore the
  real PORT + SHUTDOWN_TIMEOUT_SECONDS env overrides in pkg/server/doc.go.
- Trust tables: attested = bundle attestation verified, binary missing/failed or
  external data; unknown also covers a bundle attestation that fails verification
  (slide, demo, CLI reference).
- bundle JSON pipeline captures the verify exit code separately (a failed binary
  attestation reports attested but exits nonzero; the jq pipe would mask it).
- slide CIP subjectRegExp uses a single-quoted scalar (double-quoted \. is invalid
  YAML); Kyverno labeled tested-and-not-working, not 'being validated'.
- Offline guidance reconciled everywhere: trusted root falls back to the embedded
  copy on cache miss; no verify-path fetch; trust update not required offline
  (artifact guide PEM section + CLI reference).
- Propagate NVIDIA#1549 (recipe.yaml excluded) to the demo script + data-flow deployer
  output; NVIDIA#1535 resolved ingest lifecycle to the evidence demo + maintainer guide.
- data-flow deployer box: single DefaultBundler (not 'Run bundlers').
- SLSA L3 qualified in installation + demos README; slide binary SBOM not 'signed';
  diagram 'hardened runner' -> 'GitHub-hosted runner'.
- evidence/known-failure + evidence/exempt marked future-state at the exit-1 and
  recipe-development references too.
- provenance demo script: GitHub auth preflight + attestation comes from the
  GitHub API (not GHCR).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 7 (doc accuracy, verified against source):
- NVIDIA#1550: pipefail in the JSON demo script + slide so a failed verify is not
  masked by the jq pipe; attested/unknown tables note a failed binary
  attestation reports attested but exits nonzero, and a failed bundle
  attestation yields unknown (artifact guide + SECURITY).
- evidence slide deck: nested pointer path <recipe>/<src>/<digest>.yaml (not
  flat); pointer verification pulls the OCI bundle (registry access; 'offline'
  reserved for a local bundle dir); evidence.md intro corrected.
- trust setup: removed from the gh/cosign provenance demo (those tools manage
  their own roots); made optional stale-root remediation in the bundle demo.
- NVIDIA#1549: caveat the bundle-attestation intro ('signs checksums.txt, recipe.yaml
  excluded'), OpenShift layout, and data-flow checksum line.
- data-flow Stage-5 diagram rewritten to one flow listing all five deployers
  (helm, argocd, argocd-helm, flux, helmfile); dropped the nonexistent scripts/.
- SLSA/SBOM: README qualified to provenance v1 (NVIDIA#1536); provenance clarifies the
  image and binary SBOMs share SPDX format but are distinct artifacts; bundle
  slide stops calling the binary SBOM signed.

Signed-off-by: Yuan Chen <[email protected]>

Round 8 (self-review): replace the Stage-4 Bundler Framework box with a concise
accurate flow (one DefaultBundler pass; values.yaml is the marshaled map and
checksums.txt is computed, not go:embed-templated; recipe.yaml excluded NVIDIA#1549).
Kept the real per-component manifests (ClusterPolicy/CR) rather than deleting
them as a prior review suggested.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 8 (doc accuracy, verified against source):
- Privacy: only the allowlist is slug-only; committed pointers + Rekor publish
  signer.identity, so sign with a non-personal identity (artifact guide).
- Stop overstating recipe evidence as physical/'real hardware' proof — it is a
  signer-bound, tamper-evident validation record (README, evidence.md, slides).
- run_expect_fail returns 0 on expected failure / 1 on unexpected success, so a
  tamper demo that unexpectedly passes now fails the script (both demo scripts).
- Manual install keeps aicr-attestation.sigstore.json beside the binary so
  --attest works; CLI reference corrected (archive includes it).
- SECURITY pinning mirrors ADR-006: gate is bom-pinning-check -strict (with an
  exemption map), admission digest-verification is roadmap, CycloneDX BOM is
  locally generated (not a published release asset).
- evidence.md pointer examples use a full <bundle-digest> placeholder (the
  truncated sha256-33d4cf36 was contract-invalid).
- NVIDIA#1549: caveat the overview tamper bullet (checksums.txt list; recipe.yaml excluded).
- NVIDIA#1550: attested rows note a failed binary attestation exits nonzero (SECURITY,
  CLI reference, demo).
- trust update made optional (embedded-root fallback) in the bundle script + evidence.
- rekor-cli search --sha (not an OCI ref); crane required for digest (docker
  inspect needs a prior pull); docs/README SLSA level qualified (NVIDIA#1536).
- evidence deck: CLI binary SBOM is a separate unsigned asset, not signed.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 9 (doc accuracy, verified against source):
- evidence pointer examples use a full 64-hex digest (the <bundle-digest>
  placeholder was shell-redirection-broken); manifest check says 'manifest-listed
  payload file'.
- Privacy reconciled: 'slug-only / never-committed' scoped to the allowlist;
  committed pointers + Rekor publish signer.identity (artifact guide + ADR-007);
  dropped the 'pseudonymous' claim.
- Evidence no longer overstated: README ties it to recipes with published
  evidence; slide says validated against an env NVIDIA can't reach (was reversed).
- SECURITY pinning matches ADR-006: chart-version pin has no exceptions; the
  exemption map + 'not yet universal' belong to explicit image-digest pinning.
- 'Specific signer' examples fully anchored to repo/workflow/ref (artifact guide,
  CLI reference) instead of an org-wide regex.
- NVIDIA#1549: cli-reference + supply-chain bind to files listed in checksums.txt
  (recipe.yaml excluded). NVIDIA#1550 CI example is set -e safe (if/else rc capture);
  slide attested row notes the nonzero exit.
- data-flow: 'single DefaultBundler invocation'; per-component layout labeled
  Helm-specific (other deployers differ).
- trust-root: bundle demo no longer implies it's required; provenance
  troubleshooting points at cosign initialize (cosign's own TUF), not aicr.
- api-reference: bundlers param ignored (not selectable); verify checksums from
  the bundle root. CONTRIBUTING SLSA level qualified (NVIDIA#1536).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 6 (doc accuracy + 2 regressions, verified against source):
- Fix regressions: coverage floor is 75% (.settings.yaml), not 70%; restore the
  real PORT + SHUTDOWN_TIMEOUT_SECONDS env overrides in pkg/server/doc.go.
- Trust tables: attested = bundle attestation verified, binary missing/failed or
  external data; unknown also covers a bundle attestation that fails verification
  (slide, demo, CLI reference).
- bundle JSON pipeline captures the verify exit code separately (a failed binary
  attestation reports attested but exits nonzero; the jq pipe would mask it).
- slide CIP subjectRegExp uses a single-quoted scalar (double-quoted \. is invalid
  YAML); Kyverno labeled tested-and-not-working, not 'being validated'.
- Offline guidance reconciled everywhere: trusted root falls back to the embedded
  copy on cache miss; no verify-path fetch; trust update not required offline
  (artifact guide PEM section + CLI reference).
- Propagate NVIDIA#1549 (recipe.yaml excluded) to the demo script + data-flow deployer
  output; NVIDIA#1535 resolved ingest lifecycle to the evidence demo + maintainer guide.
- data-flow deployer box: single DefaultBundler (not 'Run bundlers').
- SLSA L3 qualified in installation + demos README; slide binary SBOM not 'signed';
  diagram 'hardened runner' -> 'GitHub-hosted runner'.
- evidence/known-failure + evidence/exempt marked future-state at the exit-1 and
  recipe-development references too.
- provenance demo script: GitHub auth preflight + attestation comes from the
  GitHub API (not GHCR).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 7 (doc accuracy, verified against source):
- NVIDIA#1550: pipefail in the JSON demo script + slide so a failed verify is not
  masked by the jq pipe; attested/unknown tables note a failed binary
  attestation reports attested but exits nonzero, and a failed bundle
  attestation yields unknown (artifact guide + SECURITY).
- evidence slide deck: nested pointer path <recipe>/<src>/<digest>.yaml (not
  flat); pointer verification pulls the OCI bundle (registry access; 'offline'
  reserved for a local bundle dir); evidence.md intro corrected.
- trust setup: removed from the gh/cosign provenance demo (those tools manage
  their own roots); made optional stale-root remediation in the bundle demo.
- NVIDIA#1549: caveat the bundle-attestation intro ('signs checksums.txt, recipe.yaml
  excluded'), OpenShift layout, and data-flow checksum line.
- data-flow Stage-5 diagram rewritten to one flow listing all five deployers
  (helm, argocd, argocd-helm, flux, helmfile); dropped the nonexistent scripts/.
- SLSA/SBOM: README qualified to provenance v1 (NVIDIA#1536); provenance clarifies the
  image and binary SBOMs share SPDX format but are distinct artifacts; bundle
  slide stops calling the binary SBOM signed.

Signed-off-by: Yuan Chen <[email protected]>

Round 8 (self-review): replace the Stage-4 Bundler Framework box with a concise
accurate flow (one DefaultBundler pass; values.yaml is the marshaled map and
checksums.txt is computed, not go:embed-templated; recipe.yaml excluded NVIDIA#1549).
Kept the real per-component manifests (ClusterPolicy/CR) rather than deleting
them as a prior review suggested.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 8 (doc accuracy, verified against source):
- Privacy: only the allowlist is slug-only; committed pointers + Rekor publish
  signer.identity, so sign with a non-personal identity (artifact guide).
- Stop overstating recipe evidence as physical/'real hardware' proof — it is a
  signer-bound, tamper-evident validation record (README, evidence.md, slides).
- run_expect_fail returns 0 on expected failure / 1 on unexpected success, so a
  tamper demo that unexpectedly passes now fails the script (both demo scripts).
- Manual install keeps aicr-attestation.sigstore.json beside the binary so
  --attest works; CLI reference corrected (archive includes it).
- SECURITY pinning mirrors ADR-006: gate is bom-pinning-check -strict (with an
  exemption map), admission digest-verification is roadmap, CycloneDX BOM is
  locally generated (not a published release asset).
- evidence.md pointer examples use a full <bundle-digest> placeholder (the
  truncated sha256-33d4cf36 was contract-invalid).
- NVIDIA#1549: caveat the overview tamper bullet (checksums.txt list; recipe.yaml excluded).
- NVIDIA#1550: attested rows note a failed binary attestation exits nonzero (SECURITY,
  CLI reference, demo).
- trust update made optional (embedded-root fallback) in the bundle script + evidence.
- rekor-cli search --sha (not an OCI ref); crane required for digest (docker
  inspect needs a prior pull); docs/README SLSA level qualified (NVIDIA#1536).
- evidence deck: CLI binary SBOM is a separate unsigned asset, not signed.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 9 (doc accuracy, verified against source):
- evidence pointer examples use a full 64-hex digest (the <bundle-digest>
  placeholder was shell-redirection-broken); manifest check says 'manifest-listed
  payload file'.
- Privacy reconciled: 'slug-only / never-committed' scoped to the allowlist;
  committed pointers + Rekor publish signer.identity (artifact guide + ADR-007);
  dropped the 'pseudonymous' claim.
- Evidence no longer overstated: README ties it to recipes with published
  evidence; slide says validated against an env NVIDIA can't reach (was reversed).
- SECURITY pinning matches ADR-006: chart-version pin has no exceptions; the
  exemption map + 'not yet universal' belong to explicit image-digest pinning.
- 'Specific signer' examples fully anchored to repo/workflow/ref (artifact guide,
  CLI reference) instead of an org-wide regex.
- NVIDIA#1549: cli-reference + supply-chain bind to files listed in checksums.txt
  (recipe.yaml excluded). NVIDIA#1550 CI example is set -e safe (if/else rc capture);
  slide attested row notes the nonzero exit.
- data-flow: 'single DefaultBundler invocation'; per-component layout labeled
  Helm-specific (other deployers differ).
- trust-root: bundle demo no longer implies it's required; provenance
  troubleshooting points at cosign initialize (cosign's own TUF), not aicr.
- api-reference: bundlers param ignored (not selectable); verify checksums from
  the bundle root. CONTRIBUTING SLSA level qualified (NVIDIA#1536).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 10 (propagation closure, verified against source):
- Evidence semantics: README 'that it works' -> 'what their validation recorded';
  evidence.md/evidence-publishing bind a signer identity to a recorded result
  (not 'signer ran validation' / 'proved hardware').
- Last owner-wide signer regex (evidence.md) anchored to repo/workflow/ref.
- NVIDIA#1549: cli-reference Attestation Scope + bundle slide bind 'files listed in
  checksums.txt' (recipe.yaml excluded; attestation files verified separately).
- 'every file' -> 'every manifest-listed payload file' (artifact guide + evidence slide).
- data-flow box: 'one invocation' + Helm-deployer layout labeled.
- bundle demo trust-update gated behind AICR_TRUST_UPDATE (set -e safe offline).
- provenance slide reuses the captured digest for the Rekor lookup (no mutable
  re-resolve).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 6 (doc accuracy + 2 regressions, verified against source):
- Fix regressions: coverage floor is 75% (.settings.yaml), not 70%; restore the
  real PORT + SHUTDOWN_TIMEOUT_SECONDS env overrides in pkg/server/doc.go.
- Trust tables: attested = bundle attestation verified, binary missing/failed or
  external data; unknown also covers a bundle attestation that fails verification
  (slide, demo, CLI reference).
- bundle JSON pipeline captures the verify exit code separately (a failed binary
  attestation reports attested but exits nonzero; the jq pipe would mask it).
- slide CIP subjectRegExp uses a single-quoted scalar (double-quoted \. is invalid
  YAML); Kyverno labeled tested-and-not-working, not 'being validated'.
- Offline guidance reconciled everywhere: trusted root falls back to the embedded
  copy on cache miss; no verify-path fetch; trust update not required offline
  (artifact guide PEM section + CLI reference).
- Propagate NVIDIA#1549 (recipe.yaml excluded) to the demo script + data-flow deployer
  output; NVIDIA#1535 resolved ingest lifecycle to the evidence demo + maintainer guide.
- data-flow deployer box: single DefaultBundler (not 'Run bundlers').
- SLSA L3 qualified in installation + demos README; slide binary SBOM not 'signed';
  diagram 'hardened runner' -> 'GitHub-hosted runner'.
- evidence/known-failure + evidence/exempt marked future-state at the exit-1 and
  recipe-development references too.
- provenance demo script: GitHub auth preflight + attestation comes from the
  GitHub API (not GHCR).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 7 (doc accuracy, verified against source):
- NVIDIA#1550: pipefail in the JSON demo script + slide so a failed verify is not
  masked by the jq pipe; attested/unknown tables note a failed binary
  attestation reports attested but exits nonzero, and a failed bundle
  attestation yields unknown (artifact guide + SECURITY).
- evidence slide deck: nested pointer path <recipe>/<src>/<digest>.yaml (not
  flat); pointer verification pulls the OCI bundle (registry access; 'offline'
  reserved for a local bundle dir); evidence.md intro corrected.
- trust setup: removed from the gh/cosign provenance demo (those tools manage
  their own roots); made optional stale-root remediation in the bundle demo.
- NVIDIA#1549: caveat the bundle-attestation intro ('signs checksums.txt, recipe.yaml
  excluded'), OpenShift layout, and data-flow checksum line.
- data-flow Stage-5 diagram rewritten to one flow listing all five deployers
  (helm, argocd, argocd-helm, flux, helmfile); dropped the nonexistent scripts/.
- SLSA/SBOM: README qualified to provenance v1 (NVIDIA#1536); provenance clarifies the
  image and binary SBOMs share SPDX format but are distinct artifacts; bundle
  slide stops calling the binary SBOM signed.

Signed-off-by: Yuan Chen <[email protected]>

Round 8 (self-review): replace the Stage-4 Bundler Framework box with a concise
accurate flow (one DefaultBundler pass; values.yaml is the marshaled map and
checksums.txt is computed, not go:embed-templated; recipe.yaml excluded NVIDIA#1549).
Kept the real per-component manifests (ClusterPolicy/CR) rather than deleting
them as a prior review suggested.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 8 (doc accuracy, verified against source):
- Privacy: only the allowlist is slug-only; committed pointers + Rekor publish
  signer.identity, so sign with a non-personal identity (artifact guide).
- Stop overstating recipe evidence as physical/'real hardware' proof — it is a
  signer-bound, tamper-evident validation record (README, evidence.md, slides).
- run_expect_fail returns 0 on expected failure / 1 on unexpected success, so a
  tamper demo that unexpectedly passes now fails the script (both demo scripts).
- Manual install keeps aicr-attestation.sigstore.json beside the binary so
  --attest works; CLI reference corrected (archive includes it).
- SECURITY pinning mirrors ADR-006: gate is bom-pinning-check -strict (with an
  exemption map), admission digest-verification is roadmap, CycloneDX BOM is
  locally generated (not a published release asset).
- evidence.md pointer examples use a full <bundle-digest> placeholder (the
  truncated sha256-33d4cf36 was contract-invalid).
- NVIDIA#1549: caveat the overview tamper bullet (checksums.txt list; recipe.yaml excluded).
- NVIDIA#1550: attested rows note a failed binary attestation exits nonzero (SECURITY,
  CLI reference, demo).
- trust update made optional (embedded-root fallback) in the bundle script + evidence.
- rekor-cli search --sha (not an OCI ref); crane required for digest (docker
  inspect needs a prior pull); docs/README SLSA level qualified (NVIDIA#1536).
- evidence deck: CLI binary SBOM is a separate unsigned asset, not signed.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 9 (doc accuracy, verified against source):
- evidence pointer examples use a full 64-hex digest (the <bundle-digest>
  placeholder was shell-redirection-broken); manifest check says 'manifest-listed
  payload file'.
- Privacy reconciled: 'slug-only / never-committed' scoped to the allowlist;
  committed pointers + Rekor publish signer.identity (artifact guide + ADR-007);
  dropped the 'pseudonymous' claim.
- Evidence no longer overstated: README ties it to recipes with published
  evidence; slide says validated against an env NVIDIA can't reach (was reversed).
- SECURITY pinning matches ADR-006: chart-version pin has no exceptions; the
  exemption map + 'not yet universal' belong to explicit image-digest pinning.
- 'Specific signer' examples fully anchored to repo/workflow/ref (artifact guide,
  CLI reference) instead of an org-wide regex.
- NVIDIA#1549: cli-reference + supply-chain bind to files listed in checksums.txt
  (recipe.yaml excluded). NVIDIA#1550 CI example is set -e safe (if/else rc capture);
  slide attested row notes the nonzero exit.
- data-flow: 'single DefaultBundler invocation'; per-component layout labeled
  Helm-specific (other deployers differ).
- trust-root: bundle demo no longer implies it's required; provenance
  troubleshooting points at cosign initialize (cosign's own TUF), not aicr.
- api-reference: bundlers param ignored (not selectable); verify checksums from
  the bundle root. CONTRIBUTING SLSA level qualified (NVIDIA#1536).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 10 (propagation closure, verified against source):
- Evidence semantics: README 'that it works' -> 'what their validation recorded';
  evidence.md/evidence-publishing bind a signer identity to a recorded result
  (not 'signer ran validation' / 'proved hardware').
- Last owner-wide signer regex (evidence.md) anchored to repo/workflow/ref.
- NVIDIA#1549: cli-reference Attestation Scope + bundle slide bind 'files listed in
  checksums.txt' (recipe.yaml excluded; attestation files verified separately).
- 'every file' -> 'every manifest-listed payload file' (artifact guide + evidence slide).
- data-flow box: 'one invocation' + Helm-deployer layout labeled.
- bundle demo trust-update gated behind AICR_TRUST_UPDATE (set -e safe offline).
- provenance slide reuses the captured digest for the Rekor lookup (no mutable
  re-resolve).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 11 (final propagation, verified against source):
- Evidence slide binds an identity to an aicr validate result (not 'ran'); the
  bundle + provenance decks drop 'real hardware' (signer-bound, not physicality).
- NVIDIA#1549: CLI abbreviated attestation scope binds files listed in checksums.txt.
- 'every file' -> 'every manifest-listed payload file' (CLI evidence verify,
  evidence demo).
- data-flow Stage-4 box: DefaultBundler extracts values, the selected deployer
  writes its own layout (Helm shown) — no longer attributes file generation to
  DefaultBundler.

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Cross-review correctness fixes (verified against current main):
- supply-chain/provenance/SECURITY: gh attestation verify pinned to
  --repo NVIDIA/aicr + --signer-workflow (on-tag.yaml), not --owner alone.
- ADR-007: verifier Update note — unsigned -> pending(exit 0); claimed signer
  always cross-checked; only external issuer/SAN pinning is opt-in.
- artifact-verification: 'attested' no longer claims a full chain when the
  binary attestation is missing (verifier calls it an incomplete chain).
- automation: upload-artifact path snapshot-*.yaml -> snapshot.yaml.
- maintaining: signer-identity + OCI-ref checks are maintainer judgement, not
  automatic recipe-evidence checks.
- ADR-014: CR-template snippet matches the real flat field mapping.
- pkg/server/doc.go: Cache-Control max-age comment 300 -> 600.

Fold NVIDIA#1533 (docs drift tail):
- Bundle-layout examples (api-reference, bundle-attestation) -> numbered
  NNN-<component>/ dirs, root checksums, install.sh, cluster-values.yaml.
- data-flow: drop false snapshot->criteria version/kernel mappings; remove
  the nonexistent ScriptData type and 'parallel' bundler-registry wording.
- contributor: tests.md cmd.SetOut -> cmd.Writer (urfave/cli v3); drop the
  bogus 'make qualify checks BOM' claim; api-server '/' runs the middleware
  chain (not a system bypass).
- demos: end-to-end-cli uses explicit criteria flags (removed --criteria);
  bundle-attestation tamper path uses 002-gpu-operator/; cuj2 404 link removed.
- supply-chain: binary SBOMs are separate GoReleaser artifacts, not embedded;
  kubernetes-deployment metrics check uses port-forward+curl (aicrd distroless
  has no wget).

Fold NVIDIA#1537 (admission-policy examples), pending cluster validation:
- Kyverno ClusterPolicy (type: SigstoreBundle, v1.18+) and Sigstore Policy
  Controller ClusterImagePolicy (signatureFormat: bundle, v0.13+) pinned to
  AICR's release identity (on-tag.yaml), with a namespace-label + positive
  test. Policy Controller example cluster-validated on GKE 1.35 (v0.13.1): fixed
  per-authority signatureFormat + ctlog placement; positive admit + wrong-identity
  reject both confirmed. Kyverno SigstoreBundle (v1.18.1) cluster-tested as NOT verifying AICR's
  bundle attestation (no matching signatures) while cosign + Policy Controller
  verify the same referrer; Kyverno block demoted to a pointer (tracked in NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 2 (verified against source):
- bundle-attestation tamper targets first numbered component dir (was a wrong
  hardcoded 002-gpu-operator with no replicas:1 to substitute).
- end-to-end-cli: drop contradictory/unverifiable component-count annotations.
- provenance-demo.sh: resolve aicrd digest once (display the captured value).
- api-server: '/' is registered by configureRootHandler, not WithHandler.
- ADR-007: pending-signature is exit-0 only when validation otherwise passes.
- data-flow: real snapshot->criteria projection (service from K8s.node.provider;
  intent/platform always 'any'); drop remaining 'Parallel' box label; template
  example uses real readmeTemplateData fields (no .Values/.Script).
- kubernetes-deployment: wait for port-forward listener before curl.
- supply-chain: narrow cosign --certificate-identity-regexp to on-tag.yaml
  release tags (Method 1 + duplicated demo/script/slide); initialize $NAMESPACE
  in the Policy Controller walkthrough; reconcile Kyverno status (cluster-tested
  as failing, not 'pending').
- provenance slide: ClusterImagePolicy gains signatureFormat: bundle + ctlog,
  correct GitHub OIDC issuer, narrowed subject; fix the bogus nginx negative.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 3 (verified against source):
- RELEASING.md: replace 6 --owner nvidia with --repo + --signer-workflow and
  narrow the cosign identity regex (the earlier sweep missed this file).
- gh attestation verify no longer claimed to show the SPDX SBOM (provenance
  only) in SECURITY.md and supply-chain Method 2.
- Bundle CI JSON examples use real fields trustLevel/bundleCreator/toolVersion
  (no trust_level/verdict/creator/cli_version) in demo, shell demo, and slide.
- maintaining.md: sticky comment renders only Recipe/Source/Pointer/Verify/
  Digest-match; signer + OCI ref reviewed from the pointer file; recipe-evidence
  exit 0 can be pending and the blocking gate is structural (NVIDIA#1535).
- Admission walkthrough now applies the policy + waits for the webhook, and
  uses the real /ko-app/aicr entrypoint.
- Port-forward snippet: real $! (was a literal $\!), cleanup trap, bounded loop.
- data-flow: drop 'Run bundlers (parallel)' and per-component checksums; topology
  gpu.product label is the primary accelerator source (PCI is fallback).
- SECURITY: binary SBOM is a separate GoReleaser asset (not embedded); attested
  means an incomplete chain (binary attestation missing/unverified or external data).
- provenance.md: note Kyverno is unverified for AICR images (NVIDIA#1537).
- provenance-demo.sh: resolve the tag and primary digest once.
- bundle-attestation troubleshooting: drop nonexistent --no-pin-identity and
  unused COSIGN_EXPERIMENTAL; --oidc-device-flow is the headless option.
- api-reference: checksums.txt is always set for /v1/bundle.

Code findings routed to issues (not fixed here): recipe.yaml absent from
checksums (NVIDIA#1549); verify degrades to attested on binary-attestation
verification failure (NVIDIA#1550).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 4 (verified against source):
- Propagate the NVIDIA#1549 caveat consistently (demo, demo script, slides, artifact
  guide, CLI reference): 'every file listed in checksums.txt', recipe.yaml excluded.
- Propagate NVIDIA#1550: attested means binary attestation missing OR failed/unverified
  (demo, CLI reference, artifact guide).
- SECURITY: unknown = missing/invalid checksums (missing attestation files ->
  unverified, not unknown).
- maintaining: the pointer-contract gate is a structural claim check, not a
  cryptographic signature (NVIDIA#1535).
- Anchor + escape all cosign --certificate-identity-regexp values; ref-pin the
  canonical SECURITY command with --source-ref refs/tags/${TAG}.
- provenance: image SBOM is signed, binary SBOM is a separate asset; gh fetches
  from the GitHub attestations API and needs gh auth/GH_TOKEN.
- supply-chain: crane recommended (docker inspect needs a prior pull).
- slides: numbered tamper path + non-zero exit; Kyverno flagged unvalidated (NVIDIA#1537).
- kubernetes-deployment: port-forward cleanup + clear trap after curl.
- data-flow: drop per-component README (README is generated once at root).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 5 (doc accuracy, verified against source):
- Propagate NVIDIA#1549/NVIDIA#1550 caveats to the slide deck (recipe.yaml excluded;
  attested = missing OR failed/unverified binary attestation).
- Ref-pin release verification everywhere (--source-ref refs/tags/${TAG}) and
  anchor the two remaining cosign regexes (supply-chain binary cmd + slide CIP).
- Qualify categorical SLSA L3 claims pending NVIDIA#1536 (SECURITY, RELEASING, deck).
- Reframe NVIDIA#1535 in the artifact guide: structural merge gate + cryptographic
  post-merge ingest (resolved), not an unresolved weakness.
- Fix the 6-month audit runbook: a deleted-OCI fallback uses rekor-cli search
  (cosign verify-attestation needs the bytes).
- Offline guidance matches WithForceCache + embedded-root fallback; trust update
  not required offline.
- data-flow: production uses one DefaultBundler + one deployer; registry unused.
- bundle JSON: toolVersion is from the bundle attestation (available at attested);
  drop the invented trustReason; align the demo-script note with its jq fields.
- slide tamper uses glob-and-append (runnable); fix wrong OIDC issuer in the deck.
- gh attestation verify no longer shown emitting the SBOM (Method 1).
- coverage: a >0.5% per-package decrease is flagged, not blocking.
- evidence/known-failure + evidence/exempt marked future state (labels + CI bypass
  not yet implemented).
- pkg/server/doc.go: drop the nonexistent loadConfig reference.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 6 (doc accuracy + 2 regressions, verified against source):
- Fix regressions: coverage floor is 75% (.settings.yaml), not 70%; restore the
  real PORT + SHUTDOWN_TIMEOUT_SECONDS env overrides in pkg/server/doc.go.
- Trust tables: attested = bundle attestation verified, binary missing/failed or
  external data; unknown also covers a bundle attestation that fails verification
  (slide, demo, CLI reference).
- bundle JSON pipeline captures the verify exit code separately (a failed binary
  attestation reports attested but exits nonzero; the jq pipe would mask it).
- slide CIP subjectRegExp uses a single-quoted scalar (double-quoted \. is invalid
  YAML); Kyverno labeled tested-and-not-working, not 'being validated'.
- Offline guidance reconciled everywhere: trusted root falls back to the embedded
  copy on cache miss; no verify-path fetch; trust update not required offline
  (artifact guide PEM section + CLI reference).
- Propagate NVIDIA#1549 (recipe.yaml excluded) to the demo script + data-flow deployer
  output; NVIDIA#1535 resolved ingest lifecycle to the evidence demo + maintainer guide.
- data-flow deployer box: single DefaultBundler (not 'Run bundlers').
- SLSA L3 qualified in installation + demos README; slide binary SBOM not 'signed';
  diagram 'hardened runner' -> 'GitHub-hosted runner'.
- evidence/known-failure + evidence/exempt marked future-state at the exit-1 and
  recipe-development references too.
- provenance demo script: GitHub auth preflight + attestation comes from the
  GitHub API (not GHCR).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 7 (doc accuracy, verified against source):
- NVIDIA#1550: pipefail in the JSON demo script + slide so a failed verify is not
  masked by the jq pipe; attested/unknown tables note a failed binary
  attestation reports attested but exits nonzero, and a failed bundle
  attestation yields unknown (artifact guide + SECURITY).
- evidence slide deck: nested pointer path <recipe>/<src>/<digest>.yaml (not
  flat); pointer verification pulls the OCI bundle (registry access; 'offline'
  reserved for a local bundle dir); evidence.md intro corrected.
- trust setup: removed from the gh/cosign provenance demo (those tools manage
  their own roots); made optional stale-root remediation in the bundle demo.
- NVIDIA#1549: caveat the bundle-attestation intro ('signs checksums.txt, recipe.yaml
  excluded'), OpenShift layout, and data-flow checksum line.
- data-flow Stage-5 diagram rewritten to one flow listing all five deployers
  (helm, argocd, argocd-helm, flux, helmfile); dropped the nonexistent scripts/.
- SLSA/SBOM: README qualified to provenance v1 (NVIDIA#1536); provenance clarifies the
  image and binary SBOMs share SPDX format but are distinct artifacts; bundle
  slide stops calling the binary SBOM signed.

Signed-off-by: Yuan Chen <[email protected]>

Round 8 (self-review): replace the Stage-4 Bundler Framework box with a concise
accurate flow (one DefaultBundler pass; values.yaml is the marshaled map and
checksums.txt is computed, not go:embed-templated; recipe.yaml excluded NVIDIA#1549).
Kept the real per-component manifests (ClusterPolicy/CR) rather than deleting
them as a prior review suggested.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 8 (doc accuracy, verified against source):
- Privacy: only the allowlist is slug-only; committed pointers + Rekor publish
  signer.identity, so sign with a non-personal identity (artifact guide).
- Stop overstating recipe evidence as physical/'real hardware' proof — it is a
  signer-bound, tamper-evident validation record (README, evidence.md, slides).
- run_expect_fail returns 0 on expected failure / 1 on unexpected success, so a
  tamper demo that unexpectedly passes now fails the script (both demo scripts).
- Manual install keeps aicr-attestation.sigstore.json beside the binary so
  --attest works; CLI reference corrected (archive includes it).
- SECURITY pinning mirrors ADR-006: gate is bom-pinning-check -strict (with an
  exemption map), admission digest-verification is roadmap, CycloneDX BOM is
  locally generated (not a published release asset).
- evidence.md pointer examples use a full <bundle-digest> placeholder (the
  truncated sha256-33d4cf36 was contract-invalid).
- NVIDIA#1549: caveat the overview tamper bullet (checksums.txt list; recipe.yaml excluded).
- NVIDIA#1550: attested rows note a failed binary attestation exits nonzero (SECURITY,
  CLI reference, demo).
- trust update made optional (embedded-root fallback) in the bundle script + evidence.
- rekor-cli search --sha (not an OCI ref); crane required for digest (docker
  inspect needs a prior pull); docs/README SLSA level qualified (NVIDIA#1536).
- evidence deck: CLI binary SBOM is a separate unsigned asset, not signed.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 9 (doc accuracy, verified against source):
- evidence pointer examples use a full 64-hex digest (the <bundle-digest>
  placeholder was shell-redirection-broken); manifest check says 'manifest-listed
  payload file'.
- Privacy reconciled: 'slug-only / never-committed' scoped to the allowlist;
  committed pointers + Rekor publish signer.identity (artifact guide + ADR-007);
  dropped the 'pseudonymous' claim.
- Evidence no longer overstated: README ties it to recipes with published
  evidence; slide says validated against an env NVIDIA can't reach (was reversed).
- SECURITY pinning matches ADR-006: chart-version pin has no exceptions; the
  exemption map + 'not yet universal' belong to explicit image-digest pinning.
- 'Specific signer' examples fully anchored to repo/workflow/ref (artifact guide,
  CLI reference) instead of an org-wide regex.
- NVIDIA#1549: cli-reference + supply-chain bind to files listed in checksums.txt
  (recipe.yaml excluded). NVIDIA#1550 CI example is set -e safe (if/else rc capture);
  slide attested row notes the nonzero exit.
- data-flow: 'single DefaultBundler invocation'; per-component layout labeled
  Helm-specific (other deployers differ).
- trust-root: bundle demo no longer implies it's required; provenance
  troubleshooting points at cosign initialize (cosign's own TUF), not aicr.
- api-reference: bundlers param ignored (not selectable); verify checksums from
  the bundle root. CONTRIBUTING SLSA level qualified (NVIDIA#1536).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 10 (propagation closure, verified against source):
- Evidence semantics: README 'that it works' -> 'what their validation recorded';
  evidence.md/evidence-publishing bind a signer identity to a recorded result
  (not 'signer ran validation' / 'proved hardware').
- Last owner-wide signer regex (evidence.md) anchored to repo/workflow/ref.
- NVIDIA#1549: cli-reference Attestation Scope + bundle slide bind 'files listed in
  checksums.txt' (recipe.yaml excluded; attestation files verified separately).
- 'every file' -> 'every manifest-listed payload file' (artifact guide + evidence slide).
- data-flow box: 'one invocation' + Helm-deployer layout labeled.
- bundle demo trust-update gated behind AICR_TRUST_UPDATE (set -e safe offline).
- provenance slide reuses the captured digest for the Rekor lookup (no mutable
  re-resolve).

Signed-off-by: Yuan Chen <[email protected]>

Address review round 11 (final propagation, verified against source):
- Evidence slide binds an identity to an aicr validate result (not 'ran'); the
  bundle + provenance decks drop 'real hardware' (signer-bound, not physicality).
- NVIDIA#1549: CLI abbreviated attestation scope binds files listed in checksums.txt.
- 'every file' -> 'every manifest-listed payload file' (CLI evidence verify,
  evidence demo).
- data-flow Stage-4 box: DefaultBundler extracts values, the selected deployer
  writes its own layout (Helm shown) — no longer attributes file generation to
  DefaultBundler.

Signed-off-by: Yuan Chen <[email protected]>

Address review round 12 (final closure, verified against source):
- Ingest verification qualified as implemented-but-currently-failing-closed
  pending NVIDIA#1505 (the GP2 loader can't parse the canonical allowlist) — was
  documented as fully operational (artifact guide, evidence.md, ADR-007, maintaining).
- expected-signer regex example matches its own pointer (validate.yaml@refs/heads/main).
- Exit 1/2 documented as structured  values (both map to OS exit 2; read
  .exit via --format json).
- community allowlist example includes the required .
- Split signing: only the unsigned subject/predicate + digest are reproducible;
  signature/cert/identity/time differ per host (evidence.md + demo script).
- Rekor audit commands runnable (extract digest, strip sha256: prefix) and the
  pointer enumeration excludes allowlist.yaml.
- Port-forward snippet tracks readiness and preserves the failure exit status.
- Checksum wording: inventories the deployment payload; recipe.yaml excluded,
  attestation files verified separately.
- SECURITY supported-version bumped to 0.16.x (v0.16.0 is GA).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Post-NVIDIA#1528 documentation-correctness sweep of AICR supply-chain, evidence,
provenance, and bundle docs (plus demos, scripts, slide decks), verified
against the implementation. Doc/comment-only; the one Go change is a comment.

Final review-round closure (round 12):
- Ingest verification qualified as implemented-but-currently-failing-closed
  pending NVIDIA#1505 (the GP2 loader cannot parse the canonical allowlist) — it had
  been documented as fully operational (artifact guide, evidence.md, ADR-007,
  maintaining.md).
- expected-signer regex example matches its own pointer (validate.yaml@refs/heads/main).
- Exit 1/2 documented as structured exit values (both map to OS exit 2; read
  the JSON .exit via --format json).
- community allowlist example includes the required issuer field.
- Split signing: only the unsigned subject/predicate + bundle digest are
  reproducible; signature/cert/identity/time differ per signing host.
- Rekor audit commands runnable (extract digest, strip the sha256: prefix);
  pointer enumeration excludes allowlist.yaml.
- Port-forward snippet tracks readiness and preserves the failure exit status.
- Checksum wording: inventories the deployment payload (recipe.yaml excluded,
  attestation files verified separately).
- SECURITY supported-version bumped to 0.16.x (v0.16.0 is GA).

Earlier rounds: pinned gh attestation verify to --repo/--signer-workflow/--source-ref;
anchored cosign identity regexes; qualified SLSA build-level (NVIDIA#1536); reframed
recipe evidence as a signer-bound record (NVIDIA#1535); propagated the NVIDIA#1549 checksums
scope and NVIDIA#1550 attested/exit semantics; rewrote the data-flow bundler/deployer
flow; validated the Policy Controller admission example on demo5 and demoted the
Kyverno example (NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Post-NVIDIA#1528 documentation-correctness sweep of AICR supply-chain, evidence,
provenance, and bundle docs (plus demos, scripts, slide decks), verified
against the implementation. Doc/comment-only; the one Go change is a comment.

Final review-round closure (round 12):
- Ingest verification qualified as implemented-but-currently-failing-closed
  pending NVIDIA#1505 (the GP2 loader cannot parse the canonical allowlist) — it had
  been documented as fully operational (artifact guide, evidence.md, ADR-007,
  maintaining.md).
- expected-signer regex example matches its own pointer (validate.yaml@refs/heads/main).
- Exit 1/2 documented as structured exit values (both map to OS exit 2; read
  the JSON .exit via --format json).
- community allowlist example includes the required issuer field.
- Split signing: only the unsigned subject/predicate + bundle digest are
  reproducible; signature/cert/identity/time differ per signing host.
- Rekor audit commands runnable (extract digest, strip the sha256: prefix);
  pointer enumeration excludes allowlist.yaml.
- Port-forward snippet tracks readiness and preserves the failure exit status.
- Checksum wording: inventories the deployment payload (recipe.yaml excluded,
  attestation files verified separately).
- SECURITY supported-version bumped to 0.16.x (v0.16.0 is GA).

Earlier rounds: pinned gh attestation verify to --repo/--signer-workflow/--source-ref;
anchored cosign identity regexes; qualified SLSA build-level (NVIDIA#1536); reframed
recipe evidence as a signer-bound record (NVIDIA#1535); propagated the NVIDIA#1549 checksums
scope and NVIDIA#1550 attested/exit semantics; rewrote the data-flow bundler/deployer
flow; validated the Policy Controller admission example on demo5 and demoted the
Kyverno example (NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Round 13 (propagation closure):
- artifact-verification heading no longer says "NVIDIA#1535 resolved" (ingest blocked by NVIDIA#1505).
- Split-signing reproducibility corrected in the CLI reference and ADR-007
  (only unsigned subject/predicate + OCI digest are stable; signature material varies).
- Rekor audit runbook made runnable: quoted POINTER, digest extracted from it,
  UUID captured from rekor-cli search and passed to rekor-cli get.
- Port-forward snippet captures the metrics body in the successful probe and
  exits nonzero when unreachable (no maskable second curl).
- Exit-1 Review Process documents the structured exit: 1 value (OS exit code 2).

Signed-off-by: Yuan Chen <[email protected]>

…l and NVIDIA#1537 examples

Post-NVIDIA#1528 documentation-correctness sweep of AICR supply-chain, evidence,
provenance, and bundle docs (plus demos, scripts, slide decks), verified
against the implementation. Doc/comment-only; the one Go change is a comment.

Final review-round closure (round 12):
- Ingest verification qualified as implemented-but-currently-failing-closed
  pending NVIDIA#1505 (the GP2 loader cannot parse the canonical allowlist) — it had
  been documented as fully operational (artifact guide, evidence.md, ADR-007,
  maintaining.md).
- expected-signer regex example matches its own pointer (validate.yaml@refs/heads/main).
- Exit 1/2 documented as structured exit values (both map to OS exit 2; read
  the JSON .exit via --format json).
- community allowlist example includes the required issuer field.
- Split signing: only the unsigned subject/predicate + bundle digest are
  reproducible; signature/cert/identity/time differ per signing host.
- Rekor audit commands runnable (extract digest, strip the sha256: prefix);
  pointer enumeration excludes allowlist.yaml.
- Port-forward snippet tracks readiness and preserves the failure exit status.
- Checksum wording: inventories the deployment payload (recipe.yaml excluded,
  attestation files verified separately).
- SECURITY supported-version bumped to 0.16.x (v0.16.0 is GA).

Earlier rounds: pinned gh attestation verify to --repo/--signer-workflow/--source-ref;
anchored cosign identity regexes; qualified SLSA build-level (NVIDIA#1536); reframed
recipe evidence as a signer-bound record (NVIDIA#1535); propagated the NVIDIA#1549 checksums
scope and NVIDIA#1550 attested/exit semantics; rewrote the data-flow bundler/deployer
flow; validated the Policy Controller admission example on demo5 and demoted the
Kyverno example (NVIDIA#1537).

Signed-off-by: Yuan Chen <[email protected]>

Round 13 (propagation closure):
- artifact-verification heading no longer says "NVIDIA#1535 resolved" (ingest blocked by NVIDIA#1505).
- Split-signing reproducibility corrected in the CLI reference and ADR-007
  (only unsigned subject/predicate + OCI digest are stable; signature material varies).
- Rekor audit runbook made runnable: quoted POINTER, digest extracted from it,
  UUID captured from rekor-cli search and passed to rekor-cli get.
- Port-forward snippet captures the metrics body in the successful probe and
  exits nonzero when unreachable (no maskable second curl).
- Exit-1 Review Process documents the structured exit: 1 value (OS exit code 2).

Signed-off-by: Yuan Chen <[email protected]>

Round 14: rekor-cli search --format json returns {"UUIDs":[...]}, so use
jq -er .UUIDs[0] (not .[0]) when capturing the entry UUID.

Signed-off-by: Yuan Chen <[email protected]>