stabilize tests

offline/notifier/artifact-hashes.json

@@ -1,21 +1,87 @@
 {
-  "version": "1.0.0",
-  "generated": "2026-01-25T12:00:00Z",
-  "artifacts": [
-    {
-      "name": "notifier-linux-amd64",
-      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-      "size": 52428800
-    },
-    {
-      "name": "notifier-linux-arm64",
-      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-      "size": 52428800
-    },
-    {
-      "name": "notifier-windows-amd64.exe",
-      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-      "size": 52428800
-    }
-  ]
+    "version":  "1.0.0",
+    "generatedAt":  "2026-01-30T00:00:00Z",
+    "hashAlgorithm":  "sha256",
+    "entries":  [
+                    {
+                        "path":  "offline\\notifier\\templates\\deprecation\\api-deprecation.email.template.json",
+                        "digest":  "sha256:3703fc9198f782f5d89eff2297ff1c581197f7f37929ed4c782f58f6bae5016e"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\deprecation\\api-deprecation.slack.template.json",
+                        "digest":  "sha256:aeb736a777272e457d746b891b53699072687f0da249d3a6f38cd30d10a67521"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\verify-fail.webhook.template.json",
+                        "digest":  "sha256:99061ce4e580519d863c19bce5b95d2d0f5007ac2462417047e5cf668532fb98"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\verify-fail.email.template.json",
+                        "digest":  "sha256:66c353f4b012dacfda878c77181bd8dbe01e3cf8669233d0aad79672c0859d72"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\verify-fail.slack.template.json",
+                        "digest":  "sha256:1395c5357562290dc77550c72ff0c5e1f3554be4ebb63fe66b21c55ab95b2ec0"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\risk\\risk-severity-change.slack.template.json",
+                        "digest":  "sha256:10f13a2375b9dccf52dcb56293d219352ca326bf993b6f6e6b2f26f05fd4be48"
+                    },
+                    {
+                        "path":  "offline\\notifier\\verify_notify_kit.sh",
+                        "digest":  "sha256:ce2beef32e3384644806b7f0e27515e10a243e83b33bbb6e4cf364df40916b16"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\risk\\risk-severity-change.email.template.json",
+                        "digest":  "sha256:20f72ee3279462054f9eab159bc61549fe6211e206c08157516aa04221cc9e5f"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\risk\\risk-profile-state.email.template.json",
+                        "digest":  "sha256:dcd4afb8409c1fc0cff27d6de725c91d1885f321c208833e17ac828e55a70d00"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\risk\\risk-profile-state.slack.template.json",
+                        "digest":  "sha256:37d73aa5218497ba09271e4dcd17b0826454f7ac32703794a591bfb14885346f"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\identity-matched.slack.template.json",
+                        "digest":  "sha256:b99f59441c7579c0d57a23d5b330356a06ac9134d977f80f5dd3ff2c6889c407"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\identity-matched.teams.template.json",
+                        "digest":  "sha256:baec3a5e96b803894d4a1128d82e5aa0163b5545c15fe7fbbe367838e2f8f4dc"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\identity-matched.email.template.json",
+                        "digest":  "sha256:f6c9b45da23ca0fe654ffd6cd4c1f5b7bad03cf48fe022022f11c16a7553829e"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\expiry-warning.email.template.json",
+                        "digest":  "sha256:69cdc9c2c7864412bb7e04be673617fb03c6261575124365af9b77189dee5cb2"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\expiry-warning.slack.template.json",
+                        "digest":  "sha256:fc5806316619c770cf50e6d40c04d6b543eef8d602bb82766e1c2c3ef58a2a1f"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\transparency-anomaly.slack.template.json",
+                        "digest":  "sha256:eb48d60f2b9a1dfe2f76abbf26a68e2607be99404f05bf2f4e41f79f7e24319d"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\transparency-anomaly.webhook.template.json",
+                        "digest":  "sha256:327196fcaf1441c4191bf6ad68dbb0ccefdc05aa08663c6298aabe91cdc3340a"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\key-rotation.webhook.template.json",
+                        "digest":  "sha256:cc4931d38bda79767295432bc10881af390913ab92dc7d236be304b1a375a443"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\identity-matched.webhook.template.json",
+                        "digest":  "sha256:3c77b91b3c50a34fb00dfd373693daa7ecce262c9754f9fe66f14d9c64d4a920"
+                    },
+                    {
+                        "path":  "offline\\notifier\\templates\\attestation\\key-rotation.email.template.json",
+                        "digest":  "sha256:d94a2a8aae181b6c3d02838b2a63ed549f3279e6f57f4ca61f35c5dd793921fa"
+                    }
+                ]
 }

offline/notifier/notify-kit.manifest.json

@@ -0,0 +1,87 @@
+{
+    "schemaVersion":  "1.0.0",
+    "generatedAt":  "2026-01-30T00:00:00Z",
+    "hashAlgorithm":  "sha256",
+    "artifacts":  [
+                      {
+                          "path":  "offline\\notifier\\templates\\deprecation\\api-deprecation.email.template.json",
+                          "digest":  "sha256:3703fc9198f782f5d89eff2297ff1c581197f7f37929ed4c782f58f6bae5016e"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\deprecation\\api-deprecation.slack.template.json",
+                          "digest":  "sha256:aeb736a777272e457d746b891b53699072687f0da249d3a6f38cd30d10a67521"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\verify-fail.webhook.template.json",
+                          "digest":  "sha256:99061ce4e580519d863c19bce5b95d2d0f5007ac2462417047e5cf668532fb98"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\verify-fail.email.template.json",
+                          "digest":  "sha256:66c353f4b012dacfda878c77181bd8dbe01e3cf8669233d0aad79672c0859d72"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\verify-fail.slack.template.json",
+                          "digest":  "sha256:1395c5357562290dc77550c72ff0c5e1f3554be4ebb63fe66b21c55ab95b2ec0"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\risk\\risk-severity-change.slack.template.json",
+                          "digest":  "sha256:10f13a2375b9dccf52dcb56293d219352ca326bf993b6f6e6b2f26f05fd4be48"
+                      },
+                      {
+                          "path":  "offline\\notifier\\verify_notify_kit.sh",
+                          "digest":  "sha256:ce2beef32e3384644806b7f0e27515e10a243e83b33bbb6e4cf364df40916b16"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\risk\\risk-severity-change.email.template.json",
+                          "digest":  "sha256:20f72ee3279462054f9eab159bc61549fe6211e206c08157516aa04221cc9e5f"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\risk\\risk-profile-state.email.template.json",
+                          "digest":  "sha256:dcd4afb8409c1fc0cff27d6de725c91d1885f321c208833e17ac828e55a70d00"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\risk\\risk-profile-state.slack.template.json",
+                          "digest":  "sha256:37d73aa5218497ba09271e4dcd17b0826454f7ac32703794a591bfb14885346f"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\identity-matched.slack.template.json",
+                          "digest":  "sha256:b99f59441c7579c0d57a23d5b330356a06ac9134d977f80f5dd3ff2c6889c407"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\identity-matched.teams.template.json",
+                          "digest":  "sha256:baec3a5e96b803894d4a1128d82e5aa0163b5545c15fe7fbbe367838e2f8f4dc"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\identity-matched.email.template.json",
+                          "digest":  "sha256:f6c9b45da23ca0fe654ffd6cd4c1f5b7bad03cf48fe022022f11c16a7553829e"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\expiry-warning.email.template.json",
+                          "digest":  "sha256:69cdc9c2c7864412bb7e04be673617fb03c6261575124365af9b77189dee5cb2"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\expiry-warning.slack.template.json",
+                          "digest":  "sha256:fc5806316619c770cf50e6d40c04d6b543eef8d602bb82766e1c2c3ef58a2a1f"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\transparency-anomaly.slack.template.json",
+                          "digest":  "sha256:eb48d60f2b9a1dfe2f76abbf26a68e2607be99404f05bf2f4e41f79f7e24319d"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\transparency-anomaly.webhook.template.json",
+                          "digest":  "sha256:327196fcaf1441c4191bf6ad68dbb0ccefdc05aa08663c6298aabe91cdc3340a"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\key-rotation.webhook.template.json",
+                          "digest":  "sha256:cc4931d38bda79767295432bc10881af390913ab92dc7d236be304b1a375a443"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\identity-matched.webhook.template.json",
+                          "digest":  "sha256:3c77b91b3c50a34fb00dfd373693daa7ecce262c9754f9fe66f14d9c64d4a920"
+                      },
+                      {
+                          "path":  "offline\\notifier\\templates\\attestation\\key-rotation.email.template.json",
+                          "digest":  "sha256:d94a2a8aae181b6c3d02838b2a63ed549f3279e6f57f4ca61f35c5dd793921fa"
+                      }
+                  ]
+}

offline/notifier/templates/risk/risk-profile-state.email.template.json

@@ -0,0 +1,17 @@
+{
+  "templateId": "tmpl-risk-profile-state-email",
+  "tenantId": "bootstrap",
+  "channelType": "Email",
+  "key": "tmpl-risk-profile-state",
+  "locale": "en-US",
+  "schemaVersion": "1.0.0",
+  "renderMode": "Html",
+  "format": "Html",
+  "description": "Email notification for risk profile state changes",
+  "metadata": {
+    "eventKind": "risk.profile.published",
+    "category": "risk",
+    "subject": "[Notify] Risk profile update: {{ event.profileName }}"
+  },
+  "body": "<!DOCTYPE html>\n<html>\n<head><style>body{font-family:sans-serif;line-height:1.5;}.section{margin:1em 0;padding:1em;background:#f8f9fa;border-radius:4px;}.label{font-weight:bold;color:#666;}.mono{font-family:monospace;background:#e9ecef;padding:2px 6px;border-radius:3px;}</style></head>\n<body>\n<h2>Risk Profile Update</h2>\n<div class=\"section\">\n<p><span class=\"label\">Profile:</span> <span class=\"mono\">{{ event.profileName }}</span></p>\n<p><span class=\"label\">State:</span> {{ event.state }}</p>\n<p><span class=\"label\">Owner:</span> {{ event.owner }}</p>\n<p><span class=\"label\">Summary:</span> {{ event.summary }}</p>\n{{ #if event.policyId }}<p><span class=\"label\">Policy:</span> {{ event.policyId }} (v{{ event.policyVersion }})</p>{{ /if }}\n</div>\n<hr>\n<p style=\"font-size:0.85em;color:#666;\">Event ID: {{ event.eventId }} | Occurred: {{ event.occurredAtUtc }}</p>\n</body>\n</html>"
+}

offline/notifier/templates/risk/risk-profile-state.slack.template.json

@@ -0,0 +1,16 @@
+{
+  "templateId": "tmpl-risk-profile-state-slack",
+  "tenantId": "bootstrap",
+  "channelType": "Slack",
+  "key": "tmpl-risk-profile-state",
+  "locale": "en-US",
+  "schemaVersion": "1.0.0",
+  "renderMode": "Markdown",
+  "format": "Json",
+  "description": "Slack notification for risk profile state changes",
+  "metadata": {
+    "eventKind": "risk.profile.published",
+    "category": "risk"
+  },
+  "body": ":information_source: *Risk profile update*\n\n*Profile:* {{ event.profileName }}\n*State:* {{ event.state }}\n*Owner:* {{ event.owner }}\n*Summary:* {{ event.summary }}\n\n{{ #if event.policyId }}*Policy:* {{ event.policyId }} (v{{ event.policyVersion }})\n{{ /if }}---\n_Event ID: {{ event.eventId }} | {{ event.occurredAtUtc }}_"
+}

offline/notifier/templates/risk/risk-severity-change.email.template.json

@@ -0,0 +1,17 @@
+{
+  "templateId": "tmpl-risk-severity-change-email",
+  "tenantId": "bootstrap",
+  "channelType": "Email",
+  "key": "tmpl-risk-severity-change",
+  "locale": "en-US",
+  "schemaVersion": "1.0.0",
+  "renderMode": "Html",
+  "format": "Html",
+  "description": "Email notification for risk severity changes",
+  "metadata": {
+    "eventKind": "risk.profile.severity.changed",
+    "category": "risk",
+    "subject": "[Notify] Risk severity changed: {{ event.profileName }}"
+  },
+  "body": "<!DOCTYPE html>\n<html>\n<head><style>body{font-family:sans-serif;line-height:1.5;}.section{margin:1em 0;padding:1em;background:#f8f9fa;border-radius:4px;}.label{font-weight:bold;color:#666;}.mono{font-family:monospace;background:#e9ecef;padding:2px 6px;border-radius:3px;}</style></head>\n<body>\n<h2>Risk Severity Changed</h2>\n<div class=\"section\">\n<p><span class=\"label\">Profile:</span> <span class=\"mono\">{{ event.profileName }}</span></p>\n<p><span class=\"label\">Previous:</span> {{ event.previousSeverity }}</p>\n<p><span class=\"label\">Current:</span> {{ event.newSeverity }}</p>\n<p><span class=\"label\">Reason:</span> {{ event.reason }}</p>\n{{ #if event.referenceUrl }}<p><span class=\"label\">Reference:</span> <a href=\"{{ event.referenceUrl }}\">{{ event.referenceUrl }}</a></p>{{ /if }}\n</div>\n<hr>\n<p style=\"font-size:0.85em;color:#666;\">Event ID: {{ event.eventId }} | Occurred: {{ event.occurredAtUtc }}</p>\n</body>\n</html>"
+}

offline/notifier/templates/risk/risk-severity-change.slack.template.json

@@ -0,0 +1,16 @@
+{
+  "templateId": "tmpl-risk-severity-change-slack",
+  "tenantId": "bootstrap",
+  "channelType": "Slack",
+  "key": "tmpl-risk-severity-change",
+  "locale": "en-US",
+  "schemaVersion": "1.0.0",
+  "renderMode": "Markdown",
+  "format": "Json",
+  "description": "Slack notification for risk severity changes",
+  "metadata": {
+    "eventKind": "risk.profile.severity.changed",
+    "category": "risk"
+  },
+  "body": ":rotating_light: *Risk severity changed*\n\n*Profile:* {{ event.profileName }}\n*Previous:* {{ event.previousSeverity }}\n*Current:* {{ event.newSeverity }}\n*Reason:* {{ event.reason }}\n\n{{ #if event.referenceUrl }}*Reference:* {{ event.referenceUrl }}\n{{ /if }}---\n_Event ID: {{ event.eventId }} | {{ event.occurredAtUtc }}_"
+}

offline/notifier/verify_notify_kit.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")" && pwd)
+MANIFEST="$ROOT/notify-kit.manifest.json"
+HASHES="$ROOT/artifact-hashes.json"
+
+if [ ! -f "$MANIFEST" ]; then
+  echo "notify-kit.manifest.json missing" >&2
+  exit 1
+fi
+
+if [ ! -f "$HASHES" ]; then
+  echo "artifact-hashes.json missing" >&2
+  exit 1
+fi
+
+echo "Notify kit manifest and hash list present."