SemVer-Trust

SemVer-Trust Release Attestation Predicate — v0.2

https://semver-trust.dev/release/v0.2 is the successor predicate type for SemVer-Trust release attestations that claim draft v0.10/v0.9/v0.8/v0.7/v0.6/v0.5/v0.4 trust-chain conformance. It supersedes release/v0.1 for new conformance claims; v0.1 remains historical and verifiable under its legacy semantics only.

JSON Schema: schemas/release-v0.2.json.

The v0.2 release predicate binds:

• the explicit specification, predicate, evaluator, graph, repository identity, policy, and verification-time profiles used for evaluation;
• stable repository identity and the component chain being evaluated;
• the release interval mode, resolved TO, adoption boundary when applicable, and predecessor attestation identity when recurring;
• active and candidate policy state, role-separated trust-material digests, and authority-pinned workflow paths, including the bootstrap descriptor or predecessor identity that selected the active authority;
• authenticated version state, including genesis/predecessor state, action, prior/resulting state identities, emitted tag or no-emission marker, raw and peeled tag object IDs, target lineage, iteration, and corrective floor;
• the preserved per-commit provenance vector, evidence vector, trust result, release decision including threshold, and supersession identity.
• any source evidence profile and evidence identities consumed for draft v0.10 claims through the declared extension map.

The predicate is intentionally closed except for declared extension maps. Any change that alters validation or interpretation requires a new predicate URI and schema.

Version-state identities carry a digest and canonicalization profile. That profile is semver-trust-version-state-json (ADR-036): the accepted, carried-forward version state serialized with RFC 8785 (JSON Canonicalization Scheme) and hashed with SHA-256, each state binding its predecessor’s digest as a hash-chain link. The emitting tool MUST produce, and verifiers MUST independently reproduce, this digest from the authenticated version state; a mismatch aborts.

This site is open source. Improve this page.