Merge pull request 'chore(release): re-pin siax-templates G17 hook pin 7725498 -> a401880' (#80) from fix/templates-pin-bump-2026-09-22 into main

.gitea/workflows/release.yml

@@ -51,7 +51,7 @@ env:
   # logic -- not used by 0pt yet, but the pin picks up main's current tip
   # rather than an older commit, matching what a fresh migration reviews).
   SIAX_TEMPLATES_REF: main
-  SIAX_TEMPLATES_PINNED_SHA: 772549841ea75527cf84b669f2edec616e983cb0
+  SIAX_TEMPLATES_PINNED_SHA: a401880aa19a9bf99fbd796c0be481db2705fcaa
   SIAX_TEMPLATES_DIR: /tmp/siax-templates-g17-ref
 
 jobs:

.siax/hook-pins.json

@@ -10,11 +10,11 @@
     }
   },
   "templateRepo": "sax3l/siax-templates",
-  "templateRef": "384e35060b91ea78ec045e14af114abf5d5eb23b",
+  "templateRef": "a401880aa19a9bf99fbd796c0be481db2705fcaa",
   "templateBranch": "main",
-  "templatePr": "sax3l/siax-templates#51",
-  "prStatus": "MERGED to main, plus follow-up fixes #56/#57/#59 already included at this pin",
-  "pinnedAt": "2026-09-15T17:00:00Z",
+  "templatePr": "sax3l/siax-templates#51 + follow-ups (PAY-35, ui-consumer lockfile, recovery wave, X-708 profiles, deps)",
+  "prStatus": "MERGED to main; re-pinned 2026-09-22: diff 7725498..a401880 contains ZERO changes under ci/v2/reference-hooks (verified via git diff --name-only) -- pin bump is behaviour-neutral for the G17 gate",
+  "pinnedAt": "2026-09-22T02:00:00Z",
   "reSyncInstructions": "If siax-templates main moves past this commit: review the diff (`git -C <clone> log 384e35060b91ea78ec045e14af114abf5d5eb23b..main -- ci/v2/reference-hooks`), re-run this migration's local verification (real local registry + docker build from this repo's own Dockerfile + G17.sh end-to-end + tamper-rejection checks -- see the PR description for the exact commands used), then bump SIAX_TEMPLATES_PINNED_SHA in .gitea/workflows/release.yml and this file's templateRef together in one reviewed commit.",
   "notes": "Supersedes 0pt's own ad hoc 'P007 pattern' release.yml (added 2026-09-14, audited 2026-09-15 and found to fail most of ADR-W16-003's bar: syft/cosign installed via unpinned-digest curl+checksums-refetch, no vulnerability scan of the built digest, cosign signed only the bare digest -- not a full in-toto predicate -- evidence committed back into this mutable repo at siax/production-evidence/*.json + siax/source-bundles/*.json instead of AUD0/ST0RE, no live-digest-equality proof). This pin replaces that ad hoc logic with sax3l/siax-templates' real, reviewed reference implementation; 0pt keeps only its own adapter values (image repo, license policy, key identity -- see G17.sh's own header) plus the pre-existing 0pt-specific signed-artifact wait/verify gate in cd.yml (kept, updated to cosign verify-attestation). G20 (live-digest-equality) deliberately NOT wired in this pass -- see .siax/hooks/README.md."
 }