A payload and its manifest pass from an identified producer to a verifying consumer within a finite retention window. Matching bytes and a familiar filename alone do not establish provenance or indefinite availability.

CI artifacts need an explicit handoff contract

A CI job can finish successfully while the next job receives the wrong files. An artifact is a stored output handed to another step, job, person, or release process. Its name alone rarely identifies everything the consumer needs to know. Treat the handoff as a contract covering the producing run, source revision, payload, integrity evidence, access policy, and availability window. Those details turn “download the build” into a checkable operation. ...

September 3, 2027 · 5 min · XB Field Notes