{
  "schema_version": 1,
  "record_id": "ADR-0002",
  "title": "Require immutable reproducible worker-image evidence",
  "status": "accepted",
  "date": "2026-08-23",
  "decision": "A production worker image is identified only by OCI digest. Every remote artifact, VCS revision, base image, system package repository snapshot, and converter dependency is immutable and declared. Release evidence includes SLSA-style provenance, CycloneDX SBOM, concluded license review, and vulnerability assessment under the repository policy.",
  "verification": [
    "Rebuild twice from the declared inputs and compare image/root-filesystem digests or document deterministic normalization.",
    "Verify provenance subject digest equals the deployed OCI digest.",
    "Verify SBOM and vulnerability assessment identify the same subject digest.",
    "Run the image with non-root, no network, read-only rootfs, all capabilities dropped, no-new-privileges, and externally enforced CPU/memory/PID/temp/output/wall-time ceilings."
  ],
  "failure_rule": "Missing, stale, mismatched, mutable, or inconclusive evidence makes the image ineligible for production.",
  "supersedes": null
}