feat: verify frontend supply chain

docs/security/supply-chain.md

@@ -1,18 +1,47 @@
 # Build and supply-chain gate
 
-Merge and release controls:
+## Local blocking controls
 
-- frozen `pnpm-lock.yaml` installation; drift is blocking
-- clean production build with hashed assets and build manifest
-- machine-readable bundle sizes and checksums
-- source plus built-asset credential-pattern scan
-- direct dependency inventory and lockfile digest
-- base/head dependency diff review record
+- `pnpm install --frozen-lockfile` and a real manifest/lock mismatch fixture
+- all direct and transitive lockfile rows with package SHA-512 integrity
+- production/development, direct/transitive and platform-optional classification
+- package-manifest license allow/deny policy
+- approved inventory baseline digest and actual add/remove/change/upgrade diff
+- independent review for new direct production dependencies
+- CycloneDX 1.6 SBOM and inventory component/edge coherence
+- source/lock/SBOM/dist-linked local provenance statement
+- source, scripts, tests, tracked config/schema, public, built asset and generated
+  release metadata secret scan
+- two-build `SOURCE_DATE_EPOCH` reproducibility check
 
-Organization-specific vulnerability severity, denied-license list, SBOM format,
-and scanner selection remain policy inputs. An approved suppression must record
-reason, owner, expiry, affected package, and compensating control. Expired
-suppressions are blocking.
+The canonical commands are:
 
-`artifacts/security/dependency-diff.json` is a local baseline. CI replaces it
-with the actual base/head direct and transitive lockfile diff before release.
+```bash
+corepack pnpm verify:lockfile
+corepack pnpm verify:reproducible-build
+corepack pnpm build:release
+corepack pnpm verify:supply-chain
+corepack pnpm check:supply-chain:fixtures
+```
+
+`config/security/dependency-baseline.json` is the approved local baseline.
+Changing it requires `DEPENDENCY_BASELINE_OWNER` and
+`DEPENDENCY_BASELINE_REASON`; editing the digest or hardcoding an empty diff is
+rejected.
+
+## External promotion controls
+
+The vulnerability adapter reads the file named by
+`VULNERABILITY_REPORT_PATH`. It requires a provider, the exact lockfile digest,
+severity findings and valid independent, unexpired exception evidence.
+`PROVENANCE_ATTESTATION_PATH` must name a provider, signer and the exact built
+dist subject digest.
+
+If either provider input is absent, local verification remains meaningful but
+`artifacts/security/supply-chain-verification.json` records
+`promotionStatus: FAIL_UNVERIFIED`. `verify:supply-chain:promotion` then exits
+non-zero. Scanner or signing outages are not converted to an empty PASS.
+
+Approved vulnerability exceptions require vulnerability/package identity,
+owner, a different reviewer, reason and expiry. Expired or self-approved
+exceptions are blocking.