security inventory: distinguish mutable sibling clone workflow from pinned verification

[Riverbraid]

Status

SECURITY / REPRODUCIBILITY / CLAIM BOUNDARY INVENTORY ITEM

Finding

The Core verification workflow clones sibling repositories from GitHub using the current branch state:

git clone --depth 1 "https://github.com/Riverbraid/${repo}.git" "$repo"

Risk boundary

This does not prove compromise. It means this workflow should be treated as a live compatibility check, not a pinned verification surface.

Recommended future review

• Decide whether this workflow should remain a live compatibility workflow.
• If a pinned verification claim is desired, clone exact commits from an explicit registry or lock file.
• Document the difference between mutable compatibility checks and pinned verification.

Boundary

This issue records inventory only.
It does not claim a patch was applied.
It does not claim the repository is secure, hardened, audited, or defect free.
It does not change registry, verifier behavior, workflow, protocol, hash, seal, manifest, tag, or release state.

Evidence surface

Repository file: Riverbraid-Core/.github/workflows/verify.yml
Claim boundary: reproducibility and verification surface distinction, not external security audit

[Riverbraid]

Draft PR #7 addresses the tool-manageable claim-boundary portion of this issue by renaming the workflow as a live compatibility check, explicitly stating that it clones mutable default branches, and separating it from the pinned Evaluation Kit reproduction surface.

The issue should remain open after that documentation/workflow classification change until execution evidence exists for the final PR state and a separate decision is made on whether a pinned Core compatibility profile is required.

No pinned-verification, security-hardening, or runtime-success claim is made by PR #7.

[Riverbraid]

Exact-head execution evidence is now available for PR #7.

GitHub Actions run 30280666028 completed successfully for head 861098ef48bf4d0e692c30a1eee9548dd2fe9cc3. The updated workflow explicitly identifies itself as Riverbraid Core Live Compatibility Check, clones current sibling default branches as a mutable compatibility surface, and states that it is not the pinned Evaluation Kit reproduction path.

This satisfies the issue's classification and documentation objective on the draft branch. Keep the issue open until PR #7 is merged or otherwise dispositioned; no pinned Core profile is being claimed.