docs(plans): add the S11 npm provenance attestations plan

Why

docs(specs): amend S11 with npm provenance atte... (!2469 - merged) • Hayley Swimelar • 19.4 amended S11 with the provenance attestation surface, and no step MR can open before a plan lands. This is that plan: twenty steps, eighteen forecast under 500 lines with tests and two over it, each justified in the plan. Three roots (a registry landing every new code, label, and pin move at once, a per-blob publish charge, bundle parsing) feed four chains: walker, datastore, route, and serving.

What the spec does not say, settled here:

• The walker cannot skip the .sigstore value. jsontext materializes any string it reads or skips, so the bounded escape-aware reader is its own step, and the admission lands behind a zero cap before the configuration key turns it on.
• The configuration key lands with the step that wires the cap. The configuration reference documents as-is behavior, and a cap nothing enforces would be a false row. An explicit zero fails load like the other size keys, and a cap above the envelope cap fails load because the 422 it promises could never be produced.
• One registry step owns every pin move, so no later step edits cardinality.go and the pin-ordering conflicts between parallel steps disappear.
• Two spec figures are already stale on main: the code pin is 41, not 40, so the target is 46. Two of the five causes the attestations route's 404 row lists never reach the handler: the authorization middleware answers an unauthorized private read not_found, and the npm middleware answers a missing repository repository_not_found. attestation_not_found covers the three in-handler causes.
• The bundle's storage fault keeps the spec's 502. A 201 that dropped the bundle would be permanent, because a republish answers 409, while npm and yarn retry a 5xx on their own.
• One docs(specs) follow-up outside this plan carries the spec edits the plan's Corrections list: the 404 row and its Error Cases twin, the OpenBlob and stored-bytes faults in the 500 row, HEAD on the attestations route with no last_downloaded_at bump, the storage_upload_failed clause for the sessionless bundle write, and the cap's cross-key invariant.

Two edges are deliberately absent, and the plan says why: store does not wait on the render arm (a stated preference with a 168-hour cached-document window), and serve does not wait on store (the later lander flips the e2e row and carries Closes).

Test plan

Docs only. markdownlint-cli2 passes, Vale reports only warnings (domain-word spellings and the substitutions the spec itself carries), every relative link and heading anchor resolves, and a script cross-checked the Mermaid edges, the dependency table, every step's Depends on: line, and the Status titles against each other.

Related to npm hosted: publish with --provenance is refuse... (#1273) • Unassigned

🤖 Generated with Claude Code