# ADR 0222: A release candidate pays for evidence once

> Source: https://github.com/max-listov/stitchkit/blob/master/docs/decisions/0222-release-evidence-is-paid-once.md

---

# ADR 0222 — A release candidate pays for evidence once

## Decision

The candidate is pushed to `release/X.Y.Z` after the metadata preflight and the
fast gate. The full set of selected CI lanes checks the exact SHA before the
fast-forward of master and the tag. The full portable local gate stays a diagnostic
tool and protects an unverified direct release push to master.

A green full or selected release gate stores a separate fast attestation, but only
if it ran every fast step, including the frozen-lockfile install. The fast key
contains tree/runtime; the heavy-evidence key also contains the PostgreSQL/browser
environment. A change of environment does not cancel the lint/types/tests evidence,
but never allows heavy evidence from another environment to be reused.

The core publication artifact is built once through the existing `prepack`.
All build checks and the real Darwin qualification stay. The tag workflow publishes
the immutable artifact of the successful exact-SHA push CI.

## Why

A sequential full local run before the same full CI repeats the portable evidence.
The release branch allows a red candidate to be fixed before publication; a
separate local heavy run does not change the publication authority. An incomplete
fast subset and mismatched fingerprints are not evidence for skipping the fast gate.

## Limits

The privacy scan runs on every push. A red CI, a different SHA, a missing artifact
and mismatched published bytes forbid confirming the release. The full local gate
is available explicitly; CI coverage, OIDC and the protected publication
environment are not weakened. The time of upload acceptance and of real npm
availability is measured separately; shorter polling does not speed up the
registry's processing.

Serves P.