test(provenance): verify landed-main identity reference

PROVENANCE.md

@@ -39,28 +39,21 @@ permission applies only to the exact selected destination material recorded by
 the review.
 
 `provenance/identity-reference.synthetic.json` demonstrates the canonical
-privacy-preserving identity reference workflow for issue #84. It is
+privacy-preserving identity reference workflow for issue #386. It is newly
 reviewer-signed synthetic evidence only: it grants no permission for real
-material and copies neither the coordinator registry nor identity aliases.
+material and copies neither the coordinator registry nor identity aliases. Its
+immutable evidence reference pins coordinator commit
+`6f6040212f0fa0cb6b8e4e695d1488a403d966be`, the squash merge of coordinator
+PR #381 already reachable from canonical `origin/main`.
 `tools/check-foundations.sh` always validates the local record shape. With an
 explicit coordinator checkout it also performs bounded offline verification:
 
 ```sh
 ATRINIK_COORDINATOR=/path/to/atrinik tools/check-foundations.sh
 ```
 
-Before coordinator PR #381 merges, audit its pushed branch without treating
-the result as approval:
-
-```sh
-ATRINIK_COORDINATOR=/path/to/atrinik \
-ATRINIK_COORDINATOR_TRUSTED_REF=origin/feat/privacy-preserving-provenance-registry \
-tools/check-provenance-identity-reference.sh
-```
-
 The record's `evidence_reference.url` is the immutable online permalink.
-This permanently synthetic demonstration remains a non-authorizing audit of
-the exact pushed feature commit. Production evidence must instead pin a
-revision already reachable from `origin/main` (or a future implemented and
-verified signed release); squash-merging PR #381 does not promote its internal
-commits to production authority.
+The default validation path loads current revocation state and reviewer
+authority from trusted `origin/main`, then reads the pinned registry, schema,
+and reviewer blobs without network access. The demonstration remains synthetic
+and therefore cannot authorize real material.

provenance/identity-reference.synthetic.json

@@ -13,16 +13,16 @@
   "transformation": "Synthetic port used only to verify the reference contract.",
   "scope_binding": "psb-22222222222222222222222222222222",
   "scope_approval": {
-    "key_id": "synthetic-reviewer-2026",
-    "signature": "-----BEGIN SSH SIGNATURE-----\nU1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgBruVWBv4FEuaHvyX1z13qRO9BU\nTXED0DGAjTaWDx1NAAAAAVYXRyaW5pay1wcm92ZW5hbmNlLXYxAAAAAAAAAAZzaGE1MTIA\nAABTAAAAC3NzaC1lZDI1NTE5AAAAQIIntFyZwxlBb8JrL5UGvsL55gDCSPrsD63OUhQdDz\n1u0Aiv3EtOOR5D79Ort0aOsVmoADkKb3IVmxYRM7vt3wI=\n-----END SSH SIGNATURE-----"
+    "key_id": "synthetic-component-reviewer-2026",
+    "signature": "-----BEGIN SSH SIGNATURE-----\nU1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgkjGqMmv/M++0NFFTLIFK3kuJ84\nd5ZFkWQvXyK+QehDoAAAAVYXRyaW5pay1wcm92ZW5hbmNlLXYxAAAAAAAAAAZzaGE1MTIA\nAABTAAAAC3NzaC1lZDI1NTE5AAAAQNRLaQRiwLHs8L7csYA7tI5RLLZNWARYbHp8VASw+C\nAmjNuEKeafM9Xlv3er28KlBF3qXpxTB2C/WQLNZ6CsfgY=\n-----END SSH SIGNATURE-----"
   },
   "evidence_reference": {
     "repository": "atrinik/atrinik",
-    "revision": "51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0",
+    "revision": "6f6040212f0fa0cb6b8e4e695d1488a403d966be",
     "record_id": "pir-c-22222222222222222222222222222222",
     "registry_sha256": "0a04fcadccb37e64f6c1209bc0b7e8d5762639ce4c5521c3bba028d9eba037bd",
     "schema_sha256": "9c726627c8679b4b437db2b54b2480fe0c45eef788de7cd76de1dec5c3ce3409",
     "reviewers_sha256": "b7a44ad27cec663a9092b924a0f6a9c95bf95a2ce74cf75ba8873e7938782240",
-    "url": "https://github.com/atrinik/atrinik/blob/51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222"
+    "url": "https://github.com/atrinik/atrinik/blob/6f6040212f0fa0cb6b8e4e695d1488a403d966be/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222"
   }
 }

tools/check-provenance-identity-reference.sh

@@ -15,14 +15,14 @@ jq -e '
     .repository == "atrinik/server" and .path == "internal/kernel/kernel.go") and
   (.transformation | type == "string" and length > 0) and
   (.scope_approval | type == "object" and (keys | sort) == ["key_id", "signature"] and
-    .key_id == "synthetic-reviewer-2026" and
+    .key_id == "synthetic-component-reviewer-2026" and
     (.signature | test("^-----BEGIN SSH SIGNATURE-----\\n[A-Za-z0-9+/=\\n]+\\n-----END SSH SIGNATURE-----$"))) and
   (.evidence_reference | type == "object" and
     (keys | sort) == ["record_id", "registry_sha256", "repository", "reviewers_sha256", "revision", "schema_sha256", "url"] and
     .repository == "atrinik/atrinik" and
     .record_id == "pir-c-22222222222222222222222222222222" and
     ([.registry_sha256, .reviewers_sha256, .schema_sha256] | all(test("^[0-9a-f]{64}$"))) and
-    (.revision | test("^[0-9a-f]{40}$")) and
+    .revision == "6f6040212f0fa0cb6b8e4e695d1488a403d966be" and
     (. as $e | $e.url == ("https://github.com/atrinik/atrinik/blob/" + $e.revision +
       "/governance/provenance-identities/registry.json#" + $e.record_id))) and
   (.scope_binding | test("^psb-[0-9a-f]{32}$")) and

tools/test-provenance-identity-reference.sh

@@ -11,6 +11,7 @@ for mutation in \
   '.source = null' \
   '.destination.contact = "forbidden"' \
   '.evidence_reference.registry_sha256 = "invalid"' \
+  '.evidence_reference.revision = "51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0" | .evidence_reference.url = "https://github.com/atrinik/atrinik/blob/51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222"' \
   '.evidence_reference.url = "https://example.invalid/movable"' \
   '.scope_approval.signature = "placeholder"'; do
   jq "${mutation}" "${source_record}" >"${temporary}"