Tenant release streams require platform signer repins

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

platform#3677 moves the AS Coaching and Wedding tenant OCIRepository sources from a pinned tag to semver: ">=1.0.0". Its merge-group production deploy failed after 30 minutes because the AS Coaching source selected v1.13.5, signed by a newer immutable revision of the platform-owned publish-app.yaml workflow than the platform's exact two-revision matcher allowed.

The same release passed tenant CI and signature creation. The failure arose only because every shared-workflow revision change required a second platform PR before the tenant's already signed release could reconcile.

Problem

The platform was treating ordinary tenant release movement as an authorization change. That couples tenant delivery to platform signer-revision updates and makes an otherwise valid release fail closed until the platform repins it.

The security boundary belongs to the platform: exact GitHub OIDC issuer, organization, shared workflow path, immutable workflow commit shape, package source, namespace, RBAC, network policy, and admission policy. A tenant release that remains within those bounds does not add authority.

Model decision — 2026-09-12

Application release streams (ascoachingogvaner and wedding-app) trust any immutable 40-hex commit of the exact platform-owned devantler-tech/actions/.github/workflows/publish-app.yaml workflow. They do not carry a per-revision allow-list.

Infrastructure and configuration consumers (.github and aws) remain bound to their generated exact revision sets. The approved-revisions report remains evidence for all consumers, but regeneration must not repin trusted application release streams.

A tenant that needs authority outside the existing package, namespace, RBAC, network, or policy boundary still requires a reviewed platform change.

Acceptance criteria

• Enforcement requires the immutable @[0-9a-f]{40} workflow-commit pattern on each declared trusted application release stream.
• Enforcement rejects a concrete revision or revision pair on a trusted release stream because that recreates the platform approval gate.
• Matcher regeneration leaves trusted release streams on the pattern when the generated approved set advances.
• .github and aws continue to require their exact generated revision sets.
• Existing shape guards continue to reject tags, branches, wildcards, short commits, and unanchored identities.
• platform#3677 can reconcile the newest signed AS Coaching and Wedding releases without a signer-revision platform update.
• No merge-group production failure is attributable to tenant signer repinning over the following 60 days.

Blocks platform#3677.