Measured live 2026-09-22: release.yml's G17 attest finished 03:37:18, but
cd.yml's poll loop hit the digest at 03:37:02 (image pushed before the
attestation upload completed) and cosign 3.1.3 failed with 'Error: no
matching attestations: ' — the gate's retry regex required the trailing
'found', so a transient not-ready state was misread as a hard verify
failure. Broaden the regex to accept both message forms; the fail-closed
behaviour for REAL attest failures is unchanged.
admin