Stability checkpoint v0.5.1 — broker CI image + smoke:full-stack - feat(ci): broker image build + cosign sign + smoke:full-stack CI job (c8ec6ba) v0.5.0 containerised the broker (ADR-0033) for CI smoke tests but the broker image was only built locally via `docker compose build`. v0.5.1 ships it through the same supply-chain pipeline as the other 3 images : Kaniko build (multi-arch amd64 + arm64) → manifest combiner → cosign-sign keyless OIDC. And the full-stack smoke (bin/test-full-stack.sh) now runs as a CI job on every tag pipeline, not just locally. Closes the v0.5.1 ticket. CI : - ✅ Main pipeline #N green — pending v0.5.1 tag run - ✅ MR #18 merged Local test pass : - ✅ uv run pytest -q — 152 passed - ✅ uv run ruff check + format src tests — clean - ✅ uv run mypy src — Success: no issues found in 12 source files - ✅ shellcheck bin/*.sh — clean - ✅ glab ci lint — valid YAML across 8 included files Regression check vs v0.5.0 : - ✅ All 5 v0.5 features preserved (auto-smoke, principal validate, anchor cron, broker container, IdP foundation) - ✅ Multi-arch images (ADR-0028) — extended to 4 images now - ✅ Hash chain + external anchor — unchanged - 4 images now go through Kaniko + cosign-sign : claude-code, dns-filter, egress-proxy, broker (was 3 in v0.5.0) - Tag pipeline expected jobs : 32 (was 28) - smoke:full-stack runs bin/test-full-stack.sh end-to-end on every tag - Broker image now cosign-signed keyless OIDC (was unsigned in v0.5.0) - Multi-arch manifest covers broker too (Apple Silicon + Graviton native) - 34 ADRs (no new ADR in v0.5.1 — pure CI work, ADR-0033 already covered the design) - JWT validation in /check - OIDC discovery - TTL cache for HTTPPrincipalProvider - smoke:full-stack on dev pipelines (currently tag-only because the broker registry-tag is amd64-only on dev) - v0.6.0 — JWT validation + OIDC discovery + bearer auth on IdP URL - v0.6.x — extend smoke:full-stack to dev pipelines (broker dev tags)