Harden release integrity, licensing, and provenance

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,80 @@
+name: Bug report
+description: Report a reproducible runtime, protocol, UI, replay, documentation, security-adjacent, or packaging defect.
+title: "[Bug]: "
+labels: [bug, triage]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you. Remove customer, employer, station, device, credential, MAC/IP, capture, screenshot, SCL, and project-sensitive information before submitting public evidence. Security vulnerabilities belong in a private security advisory.
+  - type: input
+    id: version
+    attributes:
+      label: Process Bus Insight version
+      description: Use the About dialog version and build commit, or provide the exact source commit.
+      placeholder: 1.4.0-beta.2; commit abcdef123456
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - SV analyzer / waveform / phasor
+        - PCAP replay / runtime snapshot
+        - GOOSE inspector
+        - PTP / timing context
+        - SCL validation
+        - Capture / Npcap / adapter
+        - About / licensing / legal notices
+        - Packaging / source offer / SBOM / checksum
+        - Documentation / website
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Windows version, Npcap version, adapter type, and authorized capture/replay path.
+      placeholder: Windows 11 x64; Npcap 1.x; Intel NIC via TAP or sanitized PCAP replay
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps
+      placeholder: |
+        1. Start capture or replay...
+        2. Select stream...
+        3. Change publisher setting or replay the sanitized file...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Sanitized evidence
+      description: Minimal screenshots, logs, SCL excerpt, package manifest, or PCAP. State whether evidence is synthetic, contributor-owned, or documented as authorized and sanitized.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Required checks
+      options:
+        - label: I removed customer, employer, station, credential, private address inventory, device, and project-sensitive information.
+          required: true
+        - label: I have the legal right to share every attached artifact.
+          required: true
+        - label: I searched existing issues first.
+          required: true

.github/pull_request_template.md

@@ -1,6 +1,6 @@
 ## Engineering intent
 
-Describe the FAT/SAT, commissioning, interoperability, troubleshooting, or repository-quality problem addressed by this change.
+Describe the FAT/SAT, commissioning, interoperability, troubleshooting, legal, documentation, or repository-quality problem addressed by this change.
 
 ## What changed
 
@@ -12,9 +12,10 @@ Describe the FAT/SAT, commissioning, interoperability, troubleshooting, or repos
 - [ ] `dotnet build .\ProcessBusSuite.sln -c Release --no-restore`
 - [ ] `dotnet test .\ProcessBusSuite.sln -c Release --no-build`
 - [ ] `pwsh .\scripts\repository-health.ps1`
+- [ ] `python .\scripts\generate-release-pdfs.py --check`
 - [ ] Runtime smoke test on Windows, when runtime behavior changed
 - [ ] Documentation/screenshots updated when user-visible behavior or claims changed
-- [ ] Portable package verification completed when packaging or legal content changed
+- [ ] Portable package, SOURCE.md, SBOM, checksum, and binary wording verification completed when packaging or legal content changed
 
 ## Product, claim, and evidence boundary
 
@@ -23,17 +24,17 @@ Describe the FAT/SAT, commissioning, interoperability, troubleshooting, or repos
 - [ ] Expected configuration, observed traffic, software interpretation, and external-device behavior remain distinct
 - [ ] No claim implies formal conformance, calibration, deterministic timing, functional safety, cybersecurity approval, universal interoperability, switching authority, or IED acceptance proof
 - [ ] No customer, employer, station, device, credential, MAC/IP, capture, SCL, or project-sensitive data is included
-- [ ] Any fixture or screenshot is synthetic, contributor-owned, or documented as authorized and sanitized
+- [ ] Any fixture, screenshot, logo, icon, font, or image is synthetic, contributor-owned, or documented as authorized and sanitized
 - [ ] No unrelated proprietary code, tests, wording, screenshot, report, asset, or UI design was copied or mechanically translated
 - [ ] No `bin`, `obj`, `artifacts`, logs, captures, or local settings are committed
 
 ## Contribution licensing
 
-- [ ] I have read and affirmatively accept `CONTRIBUTOR-LICENSE-AGREEMENT.md`
+- [ ] I have read and affirmatively accept CONTRIBUTOR-LICENSE-AGREEMENT.md (CLA Version 1.0, effective 2026-07-17)
 - [ ] I have the legal right and any required employer or organizational authorization to submit this contribution
 - [ ] Every commit includes `Signed-off-by: Name <email>` under the DCO
 - [ ] Any third-party material is identified with its license and provenance
 
 ## Compatibility / migration notes
 
-None, or describe them here.
+None, or describe them here.

.github/workflows/candidate-package.yml

@@ -12,11 +12,17 @@ on:
       - "TRADEMARK.md"
       - "THIRD_PARTY_NOTICES.md"
       - "docs/LICENSING.md"
+      - "docs/ASSET_PROVENANCE.md"
+      - "docs/QUICK_START.pdf"
+      - "docs/USER_MANUAL.pdf"
       - "src/**"
       - "tests/**"
       - "scripts/publish-windows-portable.ps1"
       - "scripts/verify-release-package.ps1"
+      - "scripts/generate-release-pdfs.py"
+      - "scripts/generate-sbom.ps1"
       - "scripts/repository-health.ps1"
+      - "scripts/validate-public-content.py"
       - "docs/RELEASE_NOTES_v*.md"
       - ".github/workflows/candidate-package.yml"
       - ".github/workflows/release-package.yml"
@@ -36,83 +42,102 @@ env:
 jobs:
   candidate:
     name: Build verified Windows x64 candidate
-    if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'stabilization/') || startsWith(github.head_ref, 'architecture/') || startsWith(github.head_ref, 'legal/')
-    runs-on: windows-latest
-    timeout-minutes: 35
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'stabilization/') || startsWith(github.head_ref, 'architecture/') || startsWith(github.head_ref, 'legal/') || startsWith(github.head_ref, 'hardening/')
+    runs-on: windows-2025
+    timeout-minutes: 40
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Checkout tested ref
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 8.0.4xx
 
-      - name: Resolve repository version
-        id: version
+      - name: Install document validation dependencies
+        run: python -m pip install --disable-pip-version-check reportlab==4.4.9 pypdf==6.4.1
+
+      - name: Resolve build identity
+        id: identity
         shell: pwsh
         run: |
           [xml]$props = Get-Content .\Directory.Build.props -Raw
-          $prefixNode = $props.SelectSingleNode('/Project/PropertyGroup/VersionPrefix')
+          $prefix = $props.SelectSingleNode('/Project/PropertyGroup/VersionPrefix').InnerText.Trim()
           $suffixNode = $props.SelectSingleNode('/Project/PropertyGroup/VersionSuffix')
-          if ($null -eq $prefixNode) { throw 'VersionPrefix is missing.' }
-          $prefix = $prefixNode.InnerText.Trim()
           $suffix = if ($null -eq $suffixNode) { '' } else { $suffixNode.InnerText.Trim() }
           $version = if ([string]::IsNullOrWhiteSpace($suffix)) { $prefix } else { "$prefix-$suffix" }
-          if ([string]::IsNullOrWhiteSpace($version)) { throw 'Unable to resolve repository version.' }
-          "value=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
-          Write-Host "Candidate version: $version"
+          $builtCommit = (git rev-parse HEAD).Trim()
+          $sourceHead = if ('${{ github.event_name }}' -eq 'pull_request') { '${{ github.event.pull_request.head.sha }}' } else { $builtCommit }
+          $testedMerge = $builtCommit
+          $sourceRef = if ('${{ github.event_name }}' -eq 'pull_request') { '${{ github.head_ref }}' } else { '${{ github.ref_name }}' }
+          "version=$version" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+          "built_commit=$builtCommit" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+          "source_head=$sourceHead" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+          "tested_merge=$testedMerge" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+          "source_ref=$sourceRef" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+
+      - name: Verify generated PDFs and public wording
+        run: |
+          python .\scripts\generate-release-pdfs.py --check
+          python .\scripts\validate-public-content.py
 
       - name: Repository health gate
         shell: pwsh
-        run: .\scripts\repository-health.ps1 -ExpectedVersion '${{ steps.version.outputs.value }}'
-
-      - name: Restore
-        run: dotnet restore .\ProcessBusSuite.sln
+        run: .\scripts\repository-health.ps1 -ExpectedVersion '${{ steps.identity.outputs.version }}'
 
-      - name: Build
-        run: dotnet build .\ProcessBusSuite.sln -c Release --no-restore /p:ContinuousIntegrationBuild=true
-
-      - name: Test
-        run: dotnet test .\ProcessBusSuite.sln -c Release --no-build --logger "trx;LogFileName=candidate-tests.trx" --results-directory .\TestResults
+      - name: Restore, build, and test
+        shell: pwsh
+        run: |
+          dotnet restore .\ProcessBusSuite.sln
+          dotnet build .\ProcessBusSuite.sln -c Release --no-restore /p:ContinuousIntegrationBuild=true
+          dotnet test .\ProcessBusSuite.sln -c Release --no-build --logger "trx;LogFileName=candidate-tests.trx" --results-directory .\TestResults
 
       - name: Publish portable package
         shell: pwsh
-        run: .\scripts\publish-windows-portable.ps1 -Version '${{ steps.version.outputs.value }}' -Configuration Release -Runtime win-x64
+        env:
+          SOURCE_HEAD_COMMIT: ${{ steps.identity.outputs.source_head }}
+          TESTED_MERGE_COMMIT: ${{ steps.identity.outputs.tested_merge }}
+          SOURCE_REF: ${{ steps.identity.outputs.source_ref }}
+        run: .\scripts\publish-windows-portable.ps1 -Version '${{ steps.identity.outputs.version }}' -Configuration Release -Runtime win-x64
 
       - name: Verify portable package
         shell: pwsh
         run: |
-          $zip = ".\artifacts\release\ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable.zip"
-          .\scripts\verify-release-package.ps1 -PackageZip $zip
+          $zip = ".\artifacts\release\ProcessBusInsight-v${{ steps.identity.outputs.version }}-win-x64-portable.zip"
+          .\scripts\verify-release-package.ps1 -PackageZip $zip -ExpectedVersion '${{ steps.identity.outputs.version }}'
 
       - name: Create candidate manifest
         shell: pwsh
         run: |
           $manifest = [ordered]@{
             product = 'Process Bus Insight'
-            version = '${{ steps.version.outputs.value }}'
+            version = '${{ steps.identity.outputs.version }}'
             candidate = $true
-            commit = '${{ github.event.pull_request.head.sha || github.sha }}'
-            sourceRef = '${{ github.head_ref || github.ref_name }}'
+            builtCommit = '${{ steps.identity.outputs.built_commit }}'
+            sourceHeadCommit = '${{ steps.identity.outputs.source_head }}'
+            testedMergeCommit = '${{ steps.identity.outputs.tested_merge }}'
+            sourceRef = '${{ steps.identity.outputs.source_ref }}'
             runtime = 'win-x64'
             framework = 'net8.0-windows'
             communityLicense = 'GPL-3.0-or-later'
             historicalBoundary = '85d43a0fe58a5888a9e8008c168ab76d2333ea87'
+            signatureRequired = $false
             timestampUtc = (Get-Date).ToUniversalTime().ToString('o')
           }
           $manifest | ConvertTo-Json | Set-Content .\artifacts\release\candidate-manifest.json -Encoding utf8
 
       - name: Upload verified candidate
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-candidate-${{ github.run_number }}
+          name: ProcessBusInsight-v${{ steps.identity.outputs.version }}-win-x64-candidate-${{ github.run_number }}
           path: |
-            artifacts/release/ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable.zip
+            artifacts/release/ProcessBusInsight-v${{ steps.identity.outputs.version }}-win-x64-portable.zip
             artifacts/release/SHA256SUMS.txt
+            artifacts/release/SOURCE.md
+            artifacts/release/ProcessBusInsight-SBOM.cdx.json
             artifacts/release/candidate-manifest.json
             TestResults/**
           if-no-files-found: error

.github/workflows/ci.yml

@@ -20,18 +20,29 @@ env:
 
 jobs:
   build-test:
-    name: Build, test, and repository health
-    runs-on: windows-latest
-    timeout-minutes: 25
+    name: Build, test, documents, and repository health
+    runs-on: windows-2025
+    timeout-minutes: 30
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 8.0.4xx
+
+      - name: Install deterministic document dependencies
+        run: python -m pip install --disable-pip-version-check reportlab==4.4.9 pypdf==6.4.1
+
+      - name: Verify generated release PDFs
+        run: python .\scripts\generate-release-pdfs.py --check
+
+      - name: Validate public licensing and wording
+        run: python .\scripts\validate-public-content.py
 
       - name: Repository health gate
         shell: pwsh
@@ -54,7 +65,7 @@ jobs:
 
       - name: Upload test evidence
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: test-evidence-${{ github.run_id }}
           path: TestResults/**

.github/workflows/codeql.yml

@@ -25,20 +25,20 @@ env:
 jobs:
   analyze:
     name: Analyze C#
-    runs-on: windows-latest
+    runs-on: windows-2025
     timeout-minutes: 35
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 8.0.4xx
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: csharp
           build-mode: manual
@@ -50,4 +50,4 @@ jobs:
         run: dotnet build .\ProcessBusSuite.sln -c Release --no-restore /p:ContinuousIntegrationBuild=true
 
       - name: Analyze
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0

.github/workflows/contribution-governance.yml

@@ -0,0 +1,28 @@
+name: Contribution governance
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: contribution-governance-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  cla-dco:
+    name: CLA affirmation and DCO sign-off
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout trusted default-branch policy
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Verify pull-request governance
+        run: python3 scripts/verify-contribution-governance.py