modeled-information-format · zircote · Jul 5, 2026 · Jul 5, 2026 · Jul 5, 2026 · Jul 5, 2026
diff --git a/.github/workflows/plugin-catalog-update-hub.yml b/.github/workflows/plugin-catalog-update-hub.yml
@@ -3,7 +3,7 @@ name: plugin-catalog-update-hub
 
 # Central, verify-first catalog-updater hub.
 #
-# For every marketplace repo the modeled-information-format-ci App can access that holds a
+# For every marketplace repo the org catalog App can access that holds a
 # .claude-plugin/marketplace.json (minus catalog-update/deny-list.yaml), re-pin
 # each EXTERNAL plugin entry to its latest ATTESTED release and open a zero-touch
 # auto-merge PR whose body carries the full attestation evidence. Discovery is

diff --git a/catalog-update/README.md b/catalog-update/README.md
@@ -22,8 +22,8 @@ you verified is the thing that runs.*
 
 ## How a marketplace opts in
 
-**Opt-in = install the `modeled-information-format-ci` App on the repo** (with
-`contents: write` + `pull-requests: write`). Discovery is App-install-scoped: the
+**Opt-in = install the org `catalog` App on the repo** (ADR-011; with
+`contents: write` + `pull-requests: write` + `actions: write`, per `auth/apps.json`). Discovery is App-install-scoped: the
 hub updates exactly the repos the App can access that contain a
 `.claude-plugin/marketplace.json`, minus anything in `deny-list.yaml`. There is no
 registry file to maintain — the App-installation set *is* the opt-in, so the hub

diff --git a/docs/adr/ADR-005-signing-attestation-verification.md b/docs/adr/ADR-005-signing-attestation-verification.md
@@ -14,7 +14,7 @@ tags:
   - release
 status: accepted
 created: 2026-06-29
-updated: 2026-06-29
+updated: 2026-07-05
 author: MIF Maintainers
 project: modeled-information-format
 technologies:
@@ -33,6 +33,7 @@ related:
   - ADR-003-sast-gate-suite.md
   - ADR-004-supply-chain-scanning.md
   - ADR-007-scorecard-posture.md
+  - ADR-013-marketplace-release-automation.md
 ---
 
 # ADR-005: Artifact Signing, SLSA Attestation & Fail-Closed Verification
@@ -310,6 +311,19 @@ SHA-pinned to a full 40-character commit (the org enforces this via `pin-check`)
    workflow, verifying predicates from multiple signers requires multiple
    `reusable-verify-gates.yml` invocations; a single mixed call fails closed on
    a valid artifact.
+3. **A verified attestation proves the gates ran clean, not that the artifact
+   is free of vulnerabilities**: "verifies fail-closed" means every required
+   predicate is present, correctly signed, and its scan reported no finding
+   at or above the configured threshold. The scans behind those predicates
+   (SAST per ADR-003; SCA, secrets, container, and IaC scanning per ADR-004;
+   DAST per ADR-006; VEX) are each bounded by their own rule sets, signature
+   databases, and coverage. A clean verdict is best-effort assurance against
+   the classes of defect those tools check for, not a proof of absence for
+   defects outside that coverage (an unknown vulnerability class, a logic
+   bug no scanner models, a zero-day not yet in any signature database).
+   Any decision that treats "attestations verify fail-closed" as sufficient
+   grounds to skip a human review step (for example ADR-013's automated
+   release trigger) inherits this limit and does not exceed it.
 
 ### Neutral
 
@@ -403,6 +417,7 @@ cosign verify-blob .claude-plugin/marketplace.json \
 - [ADR-002: Reusable Quality-Gate Architecture](ADR-002-reusable-quality-gate-architecture.md) -- the gates whose evidence the attestation seam turns into signed, digest-bound predicates.
 - [ADR-004: Supply-Chain Scanning](ADR-004-supply-chain-scanning.md) -- the SCA/SBOM/vulnerability scans whose verdicts are attested and verified fail-closed here.
 - [ADR-007: Scorecard Posture](ADR-007-scorecard-posture.md) -- posture assessment; this ADR's keyless-signing and SHA-pinning posture aligns with the Scorecard checks.
+- [ADR-013: Automated Attested Marketplace Release on Catalog Admission](ADR-013-marketplace-release-automation.md) -- under ADR-013 (accepted 2026-07-05, implementation pending), marketplace catalog changes admitted on `main` auto-trigger this attested release pipeline via a version tag; the fail-closed verify-before-publish model recorded here is unchanged, and the marketplace release workflow's own tag-gated publish is preserved because the tag is pushed first.
 
 ## Links
 
@@ -416,7 +431,7 @@ cosign verify-blob .claude-plugin/marketplace.json \
 
 - **Date:** 2026-06-29
 - **Source:** `.github/workflows/sign-and-attest.yml`, `.github/workflows/attest-release.yml`, `.github/workflows/reusable-attest-scan.yml`, `.github/workflows/reusable-cosign-sign.yml`, `.github/workflows/verify-attestation.yml`, `.github/workflows/reusable-verify-gates.yml`.
-- **Related ADRs:** ADR-002, ADR-004, ADR-007
+- **Related ADRs:** ADR-002, ADR-004, ADR-007, ADR-013
 
 ## Audit
 

diff --git a/docs/adr/ADR-010-plugin-catalog-hub.md b/docs/adr/ADR-010-plugin-catalog-hub.md
@@ -11,7 +11,7 @@ tags:
   - governance
 status: accepted
 created: 2026-06-29
-updated: 2026-06-29
+updated: 2026-07-05
 author: MIF Maintainers
 project: modeled-information-format
 technologies:
@@ -27,6 +27,7 @@ audience:
 related:
   - ADR-002-reusable-quality-gate-architecture.md
   - ADR-011-least-privilege-app-fleet.md
+  - ADR-013-marketplace-release-automation.md
 ---
 
 # ADR-010: Plugin Catalog Hub and Manifest Review
@@ -316,6 +317,12 @@ jobs:
 
 **Owner setup for the hub** (org variable + org secret, scoped to `.github`):
 
+> **Superseded (2026-07-05):** the hub now reads `CATALOG_CLIENT_APP_ID` /
+> `CATALOG_CLIENT_APP_PRIVATE_KEY` under ADR-011's `<ROLE>_CLIENT_APP_*`
+> scheme (source of truth: `auth/apps.json`). The commands below are the
+> historical provisioning of the retired `CATALOG_UPDATER_APP_*` credentials
+> and the retired legacy App's key — do not re-run them.
+
 ```bash
 gh variable set CATALOG_UPDATER_APP_CLIENT_ID --org modeled-information-format \
   --visibility selected --repos .github --body "<CLIENT_ID>"
@@ -331,6 +338,7 @@ gh secret set CATALOG_UPDATER_APP_PRIVATE_KEY --org modeled-information-format \
 ## Related Decisions
 
 - [ADR-002: Reusable Quality-Gate Architecture](ADR-002-reusable-quality-gate-architecture.md) -- `reusable-manifest-review.yml` is one of the org's central `workflow_call` reusables; the `catalog-check` gate enforces that every such reusable is documented in the attested-delivery workflow catalog.
+- [ADR-013: Automated Attested Marketplace Release on Catalog Admission](ADR-013-marketplace-release-automation.md) -- extends this pipeline past its terminal step: under ADR-013 (accepted 2026-07-05, implementation pending) the admission-verified merge triggers an automated version tag and the marketplace's attested release, so the decision recorded here still ends at the merge but the flow, once implemented, does not.
 
 ## Links
 
@@ -342,10 +350,35 @@ gh secret set CATALOG_UPDATER_APP_PRIVATE_KEY --org modeled-information-format \
 
 - **Date:** 2026-06-29
 - **Source:** `.github/workflows/catalog-check.yml`, `.github/workflows/plugin-catalog-update-hub.yml`, `.github/workflows/reusable-manifest-review.yml`, `catalog-update/README.md`, `catalog-update/deny-list.yaml`.
-- **Related ADRs:** ADR-002
+- **Related ADRs:** ADR-002, ADR-013
 
 ## Audit
 
+### 2026-07-05
+
+**Status:** Partial
+
+**Findings:**
+
+| Finding | Files | Lines | Assessment |
+|---------|-------|-------|------------|
+| Hub now mints its tokens via `CATALOG_CLIENT_APP_ID` / `CATALOG_CLIENT_APP_PRIVATE_KEY` per ADR-011's `<ROLE>_CLIENT_APP_*` scheme; the `CATALOG_UPDATER_APP_*` names cited in this ADR's Decision and Implementation sections are retired | `.github/workflows/plugin-catalog-update-hub.yml` | L48-L49, L113-L114 | non-compliant (text drift; mechanism unchanged, rename recorded in ADR-011) |
+| Retired-identity references corrected in this change: the opt-in text and the hub's header comment named the retired `modeled-information-format-ci` App; both now name the `catalog` App (ADR-011) | `catalog-update/README.md`, `.github/workflows/plugin-catalog-update-hub.yml` | L25; L6 | compliant (fixed 2026-07-05) |
+| The pipeline's terminal step recorded here (admission-verified auto-merge, nothing after) is extended by ADR-013, under which a catalog change on `main` is to trigger an automated patch-version tag and the marketplace's attested release | `docs/adr/ADR-013-marketplace-release-automation.md` | — | pending (ADR-013 accepted; implementation pending) |
+
+**Summary:** The three mechanisms this ADR records remain in production and
+behave as decided. Two updates since the original audit: the hub's credential
+names moved to the ADR-011 `CATALOG_CLIENT_APP_*` scheme (the decision text
+here retains the historical names; treat ADR-011 as authoritative for
+credentials — the Implementation block below is annotated accordingly, and the
+stale `modeled-information-format-ci` references in `catalog-update/README.md`
+and the hub's header comment were corrected in this change), and ADR-013,
+once implemented, extends the flow so the admission merge is no longer the end
+of the pipeline.
+
+**Action Required:** None here; credential naming is governed by ADR-011 and
+the release extension by ADR-013.
+
 ### 2026-06-29
 
 **Status:** Compliant

diff --git a/docs/adr/ADR-011-least-privilege-app-fleet.md b/docs/adr/ADR-011-least-privilege-app-fleet.md
@@ -17,7 +17,7 @@ tags:
   - security
 status: accepted
 created: 2026-06-30
-updated: 2026-06-30
+updated: 2026-07-05
 author: MIF Maintainers
 project: modeled-information-format
 technologies:
@@ -33,6 +33,7 @@ related:
   - ADR-008-github-app-ci-identity.md
   - ADR-007-scorecard-posture.md
   - ADR-010-plugin-catalog-hub.md
+  - ADR-013-marketplace-release-automation.md
 ---
 
 # ADR-011: Least-Privilege App Fleet and Org-Wide Standard Gate Suite
@@ -309,6 +310,7 @@ on the repos in its `install_on` list.
 - [ADR-007: OpenSSF Scorecard Posture](ADR-007-scorecard-posture.md) -- the scorecard reusable consumes the `ci` App (renamed from `MIF_CI_CLIENT_APP_ID`).
 - [ADR-010: Plugin Catalog Hub](ADR-010-plugin-catalog-hub.md) -- the catalog hub consumes the `catalog` App (renamed from `CATALOG_UPDATER_APP_*`).
 - [ADR-005: Artifact Signing & Attestation](ADR-005-signing-attestation-verification.md) -- release publishing uses the `release` App token, but attestation stays keyless via the run's OIDC, unaffected.
+- [ADR-013: Automated Attested Marketplace Release on Catalog Admission](ADR-013-marketplace-release-automation.md) -- ADR-013 (accepted 2026-07-05, implementation pending) adds a consumer to the `release` App: a reusable auto-tag workflow (`reusable-release-tag.yml`) pushes the marketplace's next version tag with a release-App token so the tag push fires the release pipeline; no new credential or permission, only new `consumers` entries in `auth/apps.json`.
 
 ## Links