SCOPE 2.0 authorization hardening and transactional ledgers

.github/workflows/ci.yml

@@ -14,28 +14,77 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Run CI (install, lint, typecheck, tests, evals)
         run: bash scripts/ci.sh
 
   live-ecosystem:
     runs-on: ubuntu-latest
-    if: vars.PF_CORE_REPO_PATH != '' || vars.PCS_CORE_REPO_PATH != '' || vars.AKTA_REPO_PATH != ''
+    if: vars.PF_CORE_REPO_PATH != '' || vars.PCS_CORE_REPO_PATH != '' || vars.AKTA_REPO_PATH != '' || vars.SCOPE_REQUIRE_LIVE_CONTRACTS == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: "3.12"
       - name: Install SCOPE
         run: pip install -e ".[dev]"
+      - name: Enforce institutional live-contract profile
+        if: vars.SCOPE_REQUIRE_LIVE_CONTRACTS == 'true'
+        env:
+          SCOPE_REQUIRE_LIVE_CONTRACTS: "true"
+          PF_CORE_REPO_PATH: ${{ vars.PF_CORE_REPO_PATH }}
+          PCS_CORE_REPO_PATH: ${{ vars.PCS_CORE_REPO_PATH }}
+          AKTA_REPO_PATH: ${{ vars.AKTA_REPO_PATH }}
+        run: |
+          set -euo pipefail
+          for var in PF_CORE_REPO_PATH PCS_CORE_REPO_PATH AKTA_REPO_PATH; do
+            if [ -z "${!var}" ]; then
+              echo "Institutional profile requires $var" >&2
+              exit 1
+            fi
+          done
       - name: Live contract tests
         env:
           PF_CORE_REPO_PATH: ${{ vars.PF_CORE_REPO_PATH }}
           PCS_CORE_REPO_PATH: ${{ vars.PCS_CORE_REPO_PATH }}
           AKTA_REPO_PATH: ${{ vars.AKTA_REPO_PATH }}
-        run: pytest tests/test_live_contracts.py -m live_contract -v
+          SCOPE_REQUIRE_LIVE_CONTRACTS: ${{ vars.SCOPE_REQUIRE_LIVE_CONTRACTS }}
+        run: pytest tests/test_live_contracts.py -m live_contract -v
+
+  codeql:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@a65a038433a26f4363cf9f029e3b9ceac831ad5d # v3.28.10
+        with:
+          languages: python
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@a65a038433a26f4363cf9f029e3b9ceac831ad5d # v3.28.10
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@a65a038433a26f4363cf9f029e3b9ceac831ad5d # v3.28.10
+
+  sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Generate SBOM
+        uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
+        with:
+          path: .
+          format: spdx-json
+          output-file: sbom.spdx.json
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        with:
+          name: sbom-spdx
+          path: sbom.spdx.json

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## v2.0.0 (2026-07-22)
+
+Breaking authorization redesign and security hardening (release candidate toward institutional DoD):
+
+- **AuthorizationEnvelope**: total-order hierarchy retired for comparisons; capability families with partial-order containment (`envelope_contains`, `envelope_intersection`, `envelope_is_narrower`, `envelope_difference`)
+- **VerifiedDecision**: mandatory `scope/decision_verification.py` 12-step pipeline; grant issuer rejects plain dicts with `decision_signature`
+- **Grant issuer signatures**: grants signed by SCOPE auth / institutional issuer fields; decision signatures referenced, not copied as grant authority
+- **Trust manifest**: `scope_trust_root_hash` digests the complete effective authorization manifest
+- **Identity fail-closed**: no default `domain_scientist`; `policy/minimum_identity_assurance.yaml`; SAML assertions require verifier + attestation (not labeled OIDC)
+- **REST lockdown**: authenticated principals; spoofable `X-Scope-*` path/tenant/caller headers non-authoritative; filesystem path request fields removed
+- **Transactional ledger**: SQLite `BEGIN IMMEDIATE` reference (`SqliteScopeLedger`); `LocalAppendSink` replaces false WORM naming; `S3ObjectLockWormSink` for real object-lock
+- **IDs**: full UUID4 hex artifact IDs (no 6-char fragments)
+- **KMS verify**: local signature verification required (placeholder `verify() -> False` removed)
+- Docs: `docs/migration_2.0.md`, `docs/pilot_sequence.md`, `docs/definition_of_done.md`
+
+Institutional readiness is **not** claimed. See Definition of Done.
+
+## v1.0.0 (release candidate)
+
+Treated as a release-candidate artifact contract, not production-ready infrastructure.
+Superseded for authorization model by 2.0.
+
 ## v0.8.1 (2026-06-29)
 
 Contract hardening and verifiable pilot fixtures: