Agent task: add AppleSiliconAdapterEvidence normalization design and fixtures

[mdheller]

Target repo

SourceOS-Linux/sourceos-boot

Context

M2 SourceOS normal boot and Recovery/Installer packaging docs/fixtures are merged. SourceOS spec now has AppleSiliconAdapterEvidence, BootProofRecord, ReleaseSet, Fingerprint, ConfigSource, TokenDoor, and GitRefBuild schemas. The next safe M2 platform-proof slice is normalization design and dry-run fixtures for Apple Silicon adapter evidence into SourceOS boot evidence, without host mutation.

Scope

Implement the smallest bounded change that does the following:

1. Add a design doc for AppleSiliconAdapterEvidence normalization into SourceOS boot evidence / BootProofRecord.
2. Add dry-run fixture(s) showing raw Apple Silicon adapter evidence and normalized evidence output.
3. Add Makefile validation for new fixture JSON.
4. Update repo.maturity.yaml next actions/evidence.
5. Keep this as docs/fixtures/validation only.

Acceptance criteria

• make validate passes.
• PR body includes validation evidence.
• M2 is first-class but not the only platform target.
• No Secure Enclave calls, boot-entry changes, disk writes, installer execution, rollback execution, kexec, or host-changing behavior is implemented.

Validation commands

make validate

Boundaries / non-goals

• Do not implement real Apple Silicon host mutation.
• Do not duplicate canonical schemas from SourceOS-Linux/sourceos-spec; reference them.
• Do not change runtime adapter behavior.
• One PR only.

[mdheller]

@codex Please take this in the SourceOS boot Codex environment. One PR for issue #15. Keep scope to docs, fixtures, validation, and maturity metadata. Include validation evidence.

[chatgpt-codex-connector]

Summary

• Added a new bounded design document for Apple Silicon evidence normalization that maps AppleSiliconAdapterEvidence to normalized boot evidence fields for BootProofRecord, and explicitly documents non-goals (no host mutation, no Secure Enclave calls, no runtime behavior changes). docs/APPLE_SILICON_EVIDENCE_NORMALIZATION.mdL1-L104
• Added dry-run JSON fixtures for both raw Apple Silicon adapter evidence and normalized boot evidence output (BootProofRecord) under examples/apple-silicon-evidence/. examples/apple-silicon-evidence/raw.apple-silicon-adapter-evidence.example.jsonL1-L28 examples/apple-silicon-evidence/normalized.boot-evidence.example.jsonL1-L26
• Updated make validate to include JSON validation checks for the two new evidence fixtures (via python -m json.tool), while preserving existing schema and CLI validation steps. MakefileL3-L17
• Updated maturity metadata to include the new normalization design + fixtures as evidence, and refined the Apple Silicon next action to runtime collection/attestation after explicit host-change review. repo.maturity.yamlL11-L24 repo.maturity.yamlL47-L55
• Committed changes on the current branch: fc905f1 with message Add Apple Silicon evidence normalization docs and fixtures.

Testing

• ✅ make validate
  (BootReleaseSet schema checks passed, M2 recovery/installer fixtures passed, new Apple Silicon evidence fixtures parsed successfully, nlboot adapter CLI dry-run completed.)

View task →