Wave-7 item 5. Closes the wave-6 honest narrowing
"No SLSA Source/Deps/Verification tracks (drafts)" on
`jouleclaw-slsa`. The crate shipped SLSA v1.1 Build-track
Provenance only; this commit adds the three sibling tracks
honestly as DRAFT typed shapes so consumers can adopt now and
flip to v1 when SLSA ratifies.
Surface added:
- Predicate-type URI constants tagged `-draft`:
- `DRAFT_SLSA_SOURCE_V1 = "https://slsa.dev/source/v1-draft"`
- `DRAFT_SLSA_DEPENDENCIES_V1 = "https://slsa.dev/dependencies/v1-draft"`
- `DRAFT_SLSA_VERIFICATION_V1 = "https://slsa.dev/verification/v1-draft"`
- `SlsaSourceDraftV1 { repository, revision: ResourceDescriptor,
branch_protection?: BranchProtection, reviewers: Vec<Reviewer>,
signed_commits? }` — the Source-track claim shape, mirroring
the SLSA Source Track requirements.
- `BranchProtection { required_reviewers, no_force_push,
linear_history }` — camelCase wire form via `#[serde(rename)]`
so it lines up with the SLSA schema.
- `Reviewer { id, approved_at_unix_secs? }` with
`#[serde(rename = "approvedAt")]`.
- `SlsaDependenciesDraftV1 { build_platform?, dependencies: Vec<DependencyEntry> }`
with `DependencyEntry { resource: ResourceDescriptor,
slsa_level: u8, provenance_uri? }`.
- `SlsaVerificationDraftV1 { verifier, policy, results }` with
`VerificationResult { check, status: VerificationStatus, reason? }`
and `VerificationStatus { Passed | Failed | NotApplicable }`.
- Builder helpers — `draft_slsa_source_statement(...)`,
`draft_slsa_dependencies_statement(...)`,
`draft_slsa_verification_statement(...)` — each builds the
in-toto Statement envelope with the right `predicateType`.
Honest scope kept:
- All three tracks are tagged `-draft` in their predicate-type
URIs; consumers see the draft status on the wire.
- Field shapes mirror the published SLSA documents but are NOT
schema-validated against an upstream JSON Schema (none is
published).
- VerificationStatus is the conservative three-state; we don't
shoehorn into a boolean.
Tests: 18 (+7 new) — predicate-type round-trip, Source/Deps/
Verification serde round-trip, in-toto Statement composition,
camelCase wire form, builder defaults.
c35f86b14e