fix(tenants): track signed release streams

k8s/bases/apps/ascoachingogvaner/oci-repository.yaml

@@ -9,7 +9,7 @@ metadata:
 spec:
   interval: 1m
   ref:
-    tag: 1.13.4
+    semver: ">=1.0.0"
   url: oci://ghcr.io/devantler-tech/ascoachingogvaner/manifests
   secretRef:
     name: ghcr-auth

k8s/bases/apps/wedding-app/oci-repository.yaml

@@ -9,7 +9,7 @@ metadata:
 spec:
   interval: 1m
   ref:
-    tag: 1.15.10
+    semver: ">=1.0.0"
   url: oci://ghcr.io/devantler-tech/wedding-app/manifests
   secretRef:
     name: ghcr-auth

scripts/tests/test-publish-workflow-signing-revisions.sh

@@ -978,8 +978,10 @@ cat >"$origin_stub" <<STUB
 #!/usr/bin/env bash
 set -euo pipefail
 # \$1=repo \$2=workflow \$3=version. Emit the THIRD origin field, which the two-field
-# stubs above never exercise.
-if [ -n "\${3:-}" ]; then
+# stubs above never exercise. First-party tenant manifests deliberately use unbounded
+# release streams now, so choose one consumer explicitly to retain coverage of the
+# resolver's pinned-origin disclaimer without coupling this test to live ref policy.
+if [ "\$1" = '.github' ]; then
   printf '%s\t%s\t%s\n' '$SHA_A' '$SHA_A' 'pinned'
 else
   printf '%s\t%s\t%s\n' '$SHA_A' '$SHA_A' 'inferred'

scripts/validate-eks-ci-role-policy/main.go

@@ -1895,25 +1895,23 @@ const (
 // surface. Restoring either predecessor value makes the same focused test fail,
 // so both checks remain live.
 //
-// Moved again by the Kubescape 1.40.4 reliability repair (#3730). Exactly one
-// existing document changes: the kubescape/kubescape HelmRelease advances to
-// chart 1.40.4, which selects conflict-safe kubevuln v0.3.430, and its Helm
-// post-renderer restores the node-agent profile-reader rule that 1.40.4 removed.
-// The restored rule is byte-for-byte equivalent in authority to chart 1.40.3:
-// get/list/watch on ApplicationProfiles and NetworkNeighborhoods only.
+// Moved again by the trusted tenant semantic-version rollout (#3677). Exactly
+// two existing source objects change: the ascoachingogvaner and wedding-app
+// OCIRepositories replace one fixed ref.tag with ref.semver >=1.0.0. Their
+// Cosign verification provider, issuer and platform-bounded workflow subjects
+// remain unchanged, and the rendered guard rejects restoring a tag or digest.
 //
 // CONSERVATION, read from this validator under the SHA256-verified kubectl
 // v1.36.2 renderer: exactly this aggregate changed. It reported ZERO
 // `unapproved rendered <identity>`, ZERO `missing rendered authorization
 // resource` and ZERO `duplicate rendered`; every pinned per-resource identity
-// still passes. No identity, binding, ServiceAccount, write verb, wildcard,
-// AWS identity or net permission expansion is introduced. The post-renderer
-// preserves the pre-upgrade read boundary required by node-agent startup. The
-// kubescape HelmRelease's unresolved-substitution fingerprint changes with the
-// reviewed chart and patch; other substitutions are unchanged diagnostics.
-//
-// Previous aggregate: 2a3498e2fdcd83a48433d7821c382fef70115fc3b87e36ac508afcac5cbdc0ef.
-const expectedRenderedSurfaceSHA = "bc95f7ee1b1d9a29819844f5dfac84f256aa4caadac8eb39b43fed59992b85ea"
+// still passes. No Role, ClusterRole, binding, ServiceAccount, subject, verb,
+// wildcard, AWS identity or permission changes. The unresolved Flux
+// substitutions are the normal diagnostics emitted alongside an aggregate
+// mismatch.
+//
+// Previous aggregate: bc95f7ee1b1d9a29819844f5dfac84f256aa4caadac8eb39b43fed59992b85ea.
+const expectedRenderedSurfaceSHA = "bc7dd19c5fc9747aacb2f493d6bdd926a1a1b8d6ebc5279d2363cad2d76c92ef"
 
 // authorizationOverlayPaths lists every independently reconciled production
 // layer where an object can grant privileges to the aws/aws service account.