Operationalization Release P0: release integrity and trust hardening

.github/CODEOWNERS

@@ -1,7 +1,4 @@
-/specs/                         @program-governance @scientific-review
-/schemas/                       @data-architecture
-/src/weather_platform/scientific/ @probabilistic-modeling @independent-verification
-/deploy/                        @platform-sre @security-architecture
-/apps/operator-console/         @platform-sre @product-security
-/.github/workflows/             @platform-sre @product-security
-/docs/NETWORK_BOUNDARY.md       @security-architecture
+# The repository is currently owned by a personal account, so organization
+# team handles cannot enforce reviews here. Replace this fallback with real
+# organization teams after repository migration.
+* @Protonmatter

.github/workflows/build-image.yml

@@ -16,19 +16,45 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-      - name: Require internal registry configuration
+      - name: Require internal release configuration
         run: |
           test -n "${{ vars.INTERNAL_REGISTRY }}"
           test -n "${{ vars.PYTHON_BASE_IMAGE }}"
+          test -n "${{ vars.PYPI_MIRROR_URL }}"
+          test -n "${INTERNAL_RELEASE_ATTEST_COMMAND:-}"
+          test -f requirements/production.lock
+          test -f requirements/ci.lock
       - name: Build wheelhouse from the internal mirror
         env:
           PIP_INDEX_URL: ${{ vars.PYPI_MIRROR_URL }}
           IMAGE: ${{ vars.INTERNAL_REGISTRY }}/weather/platform:${{ github.sha }}
           BASE_IMAGE: ${{ vars.PYTHON_BASE_IMAGE }}
         run: ./scripts/build_image.sh
-      - name: Run internal artifact policy and signing
+      - name: Push, scan, sign, and attest internally
         env:
           IMAGE: ${{ vars.INTERNAL_REGISTRY }}/weather/platform:${{ github.sha }}
+          RELEASE_IMAGE_REF_FILE: release/image-ref.txt
         run: |
-          test -n "${INTERNAL_RELEASE_ATTEST_COMMAND:-}"
+          mkdir -p release
           bash -lc "$INTERNAL_RELEASE_ATTEST_COMMAND"
+          test -s "$RELEASE_IMAGE_REF_FILE"
+      - name: Render immutable release evidence
+        run: |
+          PYTHONPATH=src python -m scripts.render_release_manifest \
+            --source deploy/k8s/weather-acquisition.yaml \
+            --output release/weather-acquisition.yaml \
+            --image-reference-file release/image-ref.txt \
+            --expected-repository "${{ vars.INTERNAL_REGISTRY }}/weather/platform" \
+            --metadata release/release-metadata.json \
+            --git-sha "${GITHUB_SHA}" \
+            --production-lock requirements/production.lock \
+            --ci-lock requirements/ci.lock
+          ! grep -q 'sha256:0000000000000000000000000000000000000000000000000000000000000000' \
+            release/weather-acquisition.yaml
+      - name: Upload release evidence
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: weather-release-${{ github.sha }}
+          path: release/
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/ci-bootstrap.yml

@@ -23,10 +23,20 @@ jobs:
         with:
           python-version: '3.12'
           cache: pip
+          cache-dependency-path: requirements/ci.lock
       - name: Create isolated environment
         run: python -m venv .venv
-      - name: Install (with the ecCodes decode extra)
-        run: .venv/bin/python -m pip install -e '.[dev,eccodes]'
+      - name: Install hash-pinned dependencies
+        run: |
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --require-hashes \
+            --requirement requirements/ci.lock
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --no-build-isolation \
+            --no-deps \
+            --editable .
       - name: Lint
         run: PATH="$PWD/.venv/bin:$PATH" make lint
       - name: Type check

.github/workflows/pr-fast.yml

@@ -20,10 +20,20 @@ jobs:
         with:
           python-version: '3.12'
           cache: pip
+          cache-dependency-path: requirements/ci.lock
       - name: Create isolated environment
         run: python -m venv .venv
-      - name: Install
-        run: .venv/bin/python -m pip install -e '.[dev,eccodes]'
+      - name: Install hash-pinned dependencies
+        run: |
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --require-hashes \
+            --requirement requirements/ci.lock
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --no-build-isolation \
+            --no-deps \
+            --editable .
       - name: Lint
         run: PATH="$PWD/.venv/bin:$PATH" make lint
       - name: Type check

.github/workflows/python-lock.yml

@@ -0,0 +1,56 @@
+name: python-lock
+
+on:
+  pull_request:
+    paths:
+      - 'pyproject.toml'
+      - 'requirements/**'
+      - 'scripts/compile_requirements.sh'
+      - '.github/workflows/python-lock.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'pyproject.toml'
+      - 'requirements/**'
+      - 'scripts/compile_requirements.sh'
+      - '.github/workflows/python-lock.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: python-lock-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - name: Install Python 3.12
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version: '3.12'
+          cache: pip
+      - name: Install locked compiler
+        run: python -m pip install --disable-pip-version-check 'pip==26.1.2' 'pip-tools==7.6.0'
+      - name: Generate lock evidence
+        run: bash scripts/compile_requirements.sh generated-locks
+      - name: Verify checked lock files are current
+        run: |
+          if [[ -f requirements/production.lock || -f requirements/ci.lock ]]; then
+            test -f requirements/production.lock
+            test -f requirements/ci.lock
+            diff -u requirements/production.lock generated-locks/production.lock
+            diff -u requirements/ci.lock generated-locks/ci.lock
+          fi
+      - name: Upload generated locks
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: python-locks-${{ github.sha }}
+          path: generated-locks/*.lock
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/schema-contract.yml

@@ -5,7 +5,10 @@ on:
     paths:
       - 'schemas/**'
       - 'src/weather_platform/domain/**'
+      - 'src/scripts/**'
       - 'deploy/k8s/weather-*.yaml'
+      - 'requirements/ci.lock'
+      - 'tests/unit/test_release_manifest.py'
       - 'tests/contract/test_weather_schemas.py'
       - 'tests/contract/test_weather_deployment_policy.py'
       - 'scripts/validate_schemas.py'
@@ -32,17 +35,28 @@ jobs:
         with:
           python-version: '3.12'
           cache: pip
+          cache-dependency-path: requirements/ci.lock
       - name: Create isolated environment
         run: python -m venv .venv
-      - name: Install
-        run: .venv/bin/python -m pip install -e '.[dev]'
+      - name: Install hash-pinned dependencies
+        run: |
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --require-hashes \
+            --requirement requirements/ci.lock
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --no-build-isolation \
+            --no-deps \
+            --editable .
       - name: Validate JSON Schemas
         run: .venv/bin/python scripts/validate_schemas.py
       - name: Run schema and deployment contracts
         run: |
           mkdir -p artifacts
           .venv/bin/python -m pytest -q --no-cov \
             --junitxml=artifacts/schema-contract-junit.xml \
+            tests/unit/test_release_manifest.py \
             tests/contract/test_weather_schemas.py \
             tests/contract/test_weather_deployment_policy.py
       - name: Upload schema evidence

.github/workflows/scientific-validation.yml

@@ -9,6 +9,7 @@ on:
       - 'src/weather_platform/ingestion/eccodes_backend.py'
       - 'src/weather_platform/scientific/**'
       - 'src/weather_platform/serving/vector_tiles.py'
+      - 'requirements/ci.lock'
       - 'tests/unit/test_probability.py'
       - 'tests/unit/test_verification.py'
       - 'tests/unit/test_grid_assets.py'
@@ -42,10 +43,13 @@ jobs:
         with:
           python-version: '3.12'
           cache: pip
+          cache-dependency-path: requirements/ci.lock
       - name: Create isolated environment
         run: python -m venv .venv
-      - name: Install with ecCodes
-        run: .venv/bin/python -m pip install -e '.[dev,eccodes]'
+      - name: Install reproducible dependencies
+        run: |
+          .venv/bin/python -m pip install --require-hashes -r requirements/ci.lock
+          .venv/bin/python -m pip install --no-build-isolation --no-deps -e .
       - name: Run physical and temporal invariants
         run: |
           mkdir -p artifacts

.github/workflows/spec-validation.yml

@@ -4,9 +4,11 @@ on:
   pull_request:
     paths:
       - 'specs/**'
+      - 'requirements/ci.lock'
       - 'scripts/validate_specs.py'
       - 'scripts/generate_traceability.py'
       - 'artifacts/traceability.json'
+      - '.github/workflows/spec-validation.yml'
   push:
     branches: [main]
 
@@ -25,12 +27,12 @@ jobs:
         with:
           python-version: '3.12'
           cache: pip
+          cache-dependency-path: requirements/ci.lock
       - name: Create isolated environment
-        shell: bash
         run: python -m venv .venv
-      - name: Install validation dependencies
-        shell: bash
-        run: .venv/bin/python -m pip install -e '.[dev]'
+      - name: Install reproducible dependencies
+        run: |
+          .venv/bin/python -m pip install --require-hashes -r requirements/ci.lock
+          .venv/bin/python -m pip install --no-build-isolation --no-deps -e .
       - name: Validate specifications and traceability
-        shell: bash
         run: PATH="$PWD/.venv/bin:$PATH" make validate

.github/workflows/weather-contract.yml

@@ -4,13 +4,18 @@ on:
   pull_request:
     paths:
       - 'src/weather_platform/acquisition/**'
+      - 'src/weather_platform/api/**'
       - 'src/weather_platform/domain/**'
       - 'src/weather_platform/grids/**'
       - 'src/weather_platform/ingestion/eccodes_backend.py'
       - 'src/weather_platform/serving/**'
+      - 'src/weather_platform/storage/audit.py'
+      - 'src/scripts/**'
       - 'schemas/grids/**'
       - 'schemas/manifests/**'
       - 'deploy/k8s/weather-*.yaml'
+      - 'requirements/ci.lock'
+      - 'tests/unit/test_audit_domain.py'
       - 'tests/unit/test_source_manifests.py'
       - 'tests/unit/test_grid_assets.py'
       - 'tests/unit/test_grib_index.py'
@@ -20,6 +25,9 @@ on:
       - 'tests/unit/test_coordinates.py'
       - 'tests/unit/test_wind.py'
       - 'tests/unit/test_vector_tiles.py'
+      - 'tests/unit/test_release_manifest.py'
+      - 'tests/contract/test_operationalization_routes.py'
+      - 'tests/contract/test_request_identity.py'
       - 'tests/contract/test_weather_schemas.py'
       - 'tests/contract/test_weather_deployment_policy.py'
       - 'tests/functional/test_weather_acquisition_cli.py'
@@ -48,15 +56,26 @@ jobs:
         with:
           python-version: '3.12'
           cache: pip
+          cache-dependency-path: requirements/ci.lock
       - name: Create isolated environment
         run: python -m venv .venv
-      - name: Install
-        run: .venv/bin/python -m pip install -e '.[dev,eccodes]'
+      - name: Install hash-pinned dependencies
+        run: |
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --require-hashes \
+            --requirement requirements/ci.lock
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --no-build-isolation \
+            --no-deps \
+            --editable .
       - name: Run weather contract tests
         run: |
           mkdir -p artifacts
           .venv/bin/python -m pytest -q --no-cov \
             --junitxml=artifacts/weather-contract-junit.xml \
+            tests/unit/test_audit_domain.py \
             tests/unit/test_source_manifests.py \
             tests/unit/test_grid_assets.py \
             tests/unit/test_grib_index.py \
@@ -66,6 +85,9 @@ jobs:
             tests/unit/test_coordinates.py \
             tests/unit/test_wind.py \
             tests/unit/test_vector_tiles.py \
+            tests/unit/test_release_manifest.py \
+            tests/contract/test_operationalization_routes.py \
+            tests/contract/test_request_identity.py \
             tests/contract/test_weather_schemas.py \
             tests/contract/test_weather_deployment_policy.py \
             tests/functional/test_weather_acquisition_cli.py \

.github/workflows/weather-integration.yml

@@ -39,7 +39,16 @@ jobs:
       - name: Create isolated environment
         run: python -m venv .venv
       - name: Install with ecCodes
-        run: .venv/bin/python -m pip install -e '.[dev,eccodes]'
+        run: |
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --require-hashes \
+            --requirement requirements/ci.lock
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --no-build-isolation \
+            --no-deps \
+            --editable .
       - name: Run fixture-driven functional and integration paths
         run: |
           mkdir -p artifacts

LICENSE

@@ -1,13 +1,13 @@
 Copyright (c) 2026 Protonmatter. All rights reserved.
 
-This software and its associated specifications, schemas, and documentation
-(the "Software") are proprietary and confidential. The Software is made
-available for internal development and evaluation only.
+This repository is publicly viewable, but the software, specifications,
+schemas, and documentation in it (the "Software") are proprietary. No
+open-source license is granted.
 
-No license or right, express or implied, to use, copy, modify, merge, publish,
-distribute, sublicense, or sell any part of the Software is granted except
-under a separate written agreement with the copyright holder. Unauthorized
-copying or distribution of the Software, in whole or in part, is prohibited.
+Except for rights required to view or interact with this public repository
+through GitHub, no license or right, express or implied, is granted to use,
+copy, modify, merge, publish, distribute, sublicense, or sell any part of the
+Software without a separate written agreement from the copyright holder.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,