ci: split PR and release certification gates (#161)

.aiwg/bt6-maintainer.yaml

@@ -19,9 +19,15 @@ delivery:
   allowedMergeMethods: ["squash"]
 validation:
   quick:
-    - "npm run typecheck"
+    - "npm run test:pr"
+    - "COVERAGE_BASE=upstream/main PR_CHANGED_LINE_COVERAGE=50 npm run test:pr-coverage"
   full:
-    - "npm test"
+    - "npm run test:release"
+    - "npm audit --audit-level=high"
+  qualityPolicy:
+    pullRequestChangedLineCoverageFloor: 50
+    requireBehaviorTests: true
+    fullSuiteTrigger: "release-tag-certification"
   documentation:
     - "npm run docs:check"
   researchIntegrity:
@@ -107,6 +113,13 @@ research:
     - "notes/**"
   provenanceRequired: true
   citationVerificationRequired: true
+releaseEvidence:
+  artifactType: "source-zip"
+  hashAlgorithm: "sha256"
+  provenanceFormat: "slsa-v1"
+  attestationFormat: "sigstore-bundle"
+  snapshotOnce: true
+  verifyBeforePromotion: true
 security:
   disclosureUrl: "https://forms.gle/QvKoijJMtEhLG7nf8"
   sensitiveDataPaths:

.aiwg/deployment/ci-cd-scaffold.md

@@ -66,14 +66,20 @@ N/A for a transactional application database. Local configuration migrations are
 
 ## 10. Verification and Validation
 
-The current pipeline runs dependency installation, lint, typecheck, tests, coverage, doctor, claim verification, anti-fitting, provenance, prompt audit, and smoke checks. Release verification additionally confirms the actual packaged artifact starts, the local health route responds, interface documentation matches behavior, and sensitive/ignored corpora are absent.
+The pipeline intentionally has two gates. Pull requests run dependency
+installation, lint, typecheck, the deterministic test suite, doctor, and a 50%
+changed-executable-line coverage floor. Release tags rerun the complete
+per-file coverage contract plus claim verification, anti-fitting, provenance,
+prompt, smoke, build, dependency-audit, and package-manifest checks. The tested
+tag is archived once as a ZIP, checksum-verified, and bound to a retained
+Sigstore provenance bundle.
 
 Proposed additions:
 
 1. SDLC artifact/citation/traceability conformance.
 2. Cross-document maturity consistency.
 3. Network-adapter scope/approval/credential/timeout inventory completeness.
-4. Release artifact checksums/signatures and SBOM according to an approved supply-chain threat model.
+4. CycloneDX SBOM generation bound to the source ZIP.
 
 ## 11. Rollback and Contingency