docs: fix SPDX attestation verification

docs/RELEASE.md

@@ -71,7 +71,7 @@ Verify that the platform SBOM is cryptographically tied to the same archive:
 gh attestation verify "$archive" \
   --repo ArdurAI/sith \
   --signer-workflow ArdurAI/sith/.github/workflows/release.yml \
-  --predicate-type https://spdx.dev/Document \
+  --predicate-type https://spdx.dev/Document/v2.3 \
   --bundle "sith_${version}_${platform}.sbom.sigstore.json"
 ```
 

internal/tui/model_test.go

@@ -152,6 +152,9 @@ func TestWarmViewP95UnderOneHundredMilliseconds(t *testing.T) {
 	if testing.Short() {
 		t.Skip("performance acceptance test")
 	}
+	if raceDetectorEnabled {
+		t.Skip("race instrumentation invalidates the latency budget; make perf runs this test without race")
+	}
 	store := populatedStore(t, 3000)
 	model, err := NewModel(context.Background(), store, &countingSyncer{})
 	if err != nil {
@@ -167,9 +170,6 @@ func TestWarmViewP95UnderOneHundredMilliseconds(t *testing.T) {
 	slices.Sort(durations)
 	p95 := durations[37]
 	budget := 100 * time.Millisecond
-	if raceDetectorEnabled {
-		budget = 250 * time.Millisecond
-	}
 	if p95 >= budget {
 		t.Fatalf("warm View() p95 = %s, want <%s (samples=%v)", p95, budget, durations)
 	}

sessions/2026-07-11-slice-p-release-supply-chain.md

@@ -17,6 +17,12 @@
 [T] Test: Full `make ci` is green with zero lint findings and no govulncheck vulnerabilities. The digest-pinned real two-cluster kind gate passed under `-race` in 90.660s; Docker cleanup reclaimed 913.1 MB. Homebrew tap CI run 29167709347 and no-release sync smoke run 29167717172 both passed. GitHub Dependabot, code-scanning, and secret-scanning queues are each zero open.
 [C] Checkpoint #1: signed Homebrew tap bootstrap `f7084518e9c6268f7266206ea17020754cb4fc67` — next: publish the Sith release pipeline.
 [C] Checkpoint #2: reproducible signed release and verification pipeline — next: PR, green remote gates, dev/main release integration, first signed tag, and real Homebrew install proof.
+[A] Action: Consumer verification of the public v0.1.0 SBOM bundle identified that GitHub emits predicate URI `https://spdx.dev/Document/v2.3`; the runbook used the unversioned URI. Corrected the command and added a regression assertion for the exact vetted predicate.
+[T] Test: The corrected offline command verifies the darwin/arm64 archive against its attached SPDX attestation bundle. Direct Cosign checks for archive, SBOM, checksums, and formula; online/offline SLSA checks; archive extraction; embedded release metadata; Ruby syntax; and formula/checksum binding all pass.
+[C] Checkpoint #3: consumer-verification documentation correction — next: merge through dev/main and complete tap install proof.
+[A] Action: Two hosted unit/race runs exceeded the TUI microbenchmark's race-only allowance while repeated local runs and the dedicated non-race performance gate passed. Removed the invalid race-instrumented wall-clock assertion; the same test still enforces the unchanged 100 ms p95 budget through `make perf`.
+[T] Test: Race-targeted invocation skips only the latency microbenchmark; non-race `make perf` runs and passes the 100 ms acceptance test. All functional race coverage remains in the unit gate.
+[C] Checkpoint #4: isolate performance acceptance from race instrumentation — next: green remote gates and documentation promotion.
 
 ---
 

tools/internal/releasepack/policy_test.go

@@ -77,6 +77,17 @@ func TestWorkflowActionsUseImmutableRefs(t *testing.T) {
 	}
 }
 
+func TestReleaseGuidePinsSPDXPredicateVersion(t *testing.T) {
+	t.Parallel()
+	guide := readRepositoryFile(t, repositoryRoot(t), "docs/RELEASE.md")
+	if !strings.Contains(guide, "--predicate-type https://spdx.dev/Document/v2.3") {
+		t.Fatal("release guide does not pin the SPDX 2.3 attestation predicate URI")
+	}
+	if strings.Contains(guide, "--predicate-type https://spdx.dev/Document \\") {
+		t.Fatal("release guide contains the unversioned SPDX predicate URI")
+	}
+}
+
 func repositoryRoot(t *testing.T) string {
 	t.Helper()
 	_, filename, _, ok := runtime.Caller(0)