Track: v1 engineering and supply-chain hardening (v1_engineering_hardening_20260714)

[edithatogo]

Parent programme: #38

Objective

Qualify untrusted-artifact handling, compatibility, performance, dependencies, CI, reproducibility, SBOM/provenance, rollback, and vulnerability response for v1.

Acceptance

• Threat model covers every externally controlled input and release boundary.
• Property, fuzz, hostile-input, mutation, and resource-limit tests meet frozen thresholds.
• Supported-platform, compatibility, performance, and reproducibility matrices pass.
• SBOMs, checksums, provenance, rollback, and residual-risk evidence are release-ready.

Local spec and plan are authoritative.

Dependencies

• Requires Track: v1 foundation and governance (v1_foundation_20260714) #39 and stable process-profile schemas from Track: platform-neutral PIC process profile (pic_process_profile_20260714) #40. May run alongside Track: adverse-incident management and open disclosure (adverse_incident_open_disclosure_20260714) #41-Track: Camunda 8 process portability demonstrator (camunda_portability_20260714) #43 after those boundaries stabilize.