Two different replay jobs

Do not collapse these jobs. A declared input pin is not a baseline-promotion workflow, and a previously observed output is not automatically a current-run input.

Input identity

Use replay_inputs[] and optional expected_identity when selected execution must consume exact repo-owned files or profiles.

Generated baseline authority

Use artifact replay authority when a producer intentionally regenerates outputs that require review and explicit promotion before consumers trust them.

Replay inputs are evaluated before execution

kinds such as static_file, presentation_profile, and comparator_profile are closed semantic categories, not arbitrary strings
expected SHA-256 identity blocks a missing, unreadable, or mismatched selected input before execution
policy can accumulate per-task and per-workflow requirements over each selected closure with deny > review > allow precedence
review remains refusal; it is not authorization
receipts reuse the command-scoped pre-execution observation instead of rereading mutable files afterward
generic readiness receipts do not reconstruct an admission decision they did not make

Trusted generated baseline flow

recording binds the producer run, successful producer receipt, contract/source identity, and complete output manifest
promotion selects one exact attestation; latest-record selection is never implicit authority
the committed portable authority embeds enough immutable provenance for a fresh clone to re-derive selection
SCM review remains an external trust assumption; Ota does not claim to verify the human reviewer
a replay consumer cannot reach its regeneration producer through the selected closure

Record and promotebash

ota baseline record --artifact recorded-baseline --jsonota baseline promote --artifact recorded-baseline   --attestation .ota/replay-baselines/recorded-baseline/attestation-<sha>.json   --json

Consumption posture

read_only

Claims prevention only when Ota mounts the promoted snapshot read-only for the full selected closure inside a runner-owned ephemeral container boundary.

verify_unchanged

Rechecks the promoted output manifest after execution. It detects mutation but does not claim prevention.

path containment and symlink checks prevent a replay artifact from resolving into mutable worktree state
receipt and archive evidence preserve declared posture rather than upgrading detection into prevention
revoked, missing, changed, or unbound authority refuses

What replay does not prove

Record, explicit promotion, portable authority, and detached read-only consumption.

Open on GitHub

Expected identities and selected-closure replay policy.