Align interface package artifact manifest and integrity metadata

[Copilot]

The Vendor-A NPU interface example already included verification vectors and an explicit example signature state, but its artifact metadata had drifted: the manifest did not fully declare the packaged artifacts, and the recorded digests no longer matched the current files.

• Manifest artifact coverage

  • Added the package README.md and collector config to spec.artifacts so the manifest matches the artifacts already treated as part of the package.

• Integrity metadata refresh

  • Updated signatures/content-digests.yaml with current SHA-256 values for all tracked package artifacts.
  • This restores consistency between declared artifact paths and their integrity metadata.

• No behavioral changes to verification vectors

  • Kept the existing normalization vectors and explicit example-unsigned signature state unchanged; the issue was in package metadata consistency rather than normalization content.

spec:
  artifacts:
    - {path: README.md, role: documentation}
    - {path: collectors/npu-runtime-collector.yaml, role: collector-config}

• Fixes [FEATURE] Verify Interface Package Artifacts #9

[daeyoung-jeong-lge]

@copilot Explain where was the mismatch in detail.

[Copilot]

@copilot Explain where was the mismatch in detail.

There were two mismatches:

1. interfaces/vendor-a-npu-evidence-layer-package/manifest.yaml

   • spec.artifacts declared only 5 packaged artifacts:
     • schemas/vendor-a-npu-status-v1.2.0.yaml
     • mappings/vendor-a-npu-to-evidence-v3.1.0.yaml
     • schemas/score-normalized-evidence-v1.0.0.yaml
     • tests/normalization-vectors.yaml
     • signatures/content-digests.yaml
   • But interfaces/vendor-a-npu-evidence-layer-package/signatures/content-digests.yaml was already treating 7 files as integrity-tracked artifacts, including:
     • README.md
     • collectors/npu-runtime-collector.yaml
   • So the manifest’s declared artifact set and the digest manifest’s tracked artifact set did not match.

2. interfaces/vendor-a-npu-evidence-layer-package/signatures/content-digests.yaml

   • The recorded SHA-256 values no longer matched the current file contents.
   • This affected every listed entry in that file:
     • README.md
     • collectors/npu-runtime-collector.yaml
     • manifest.yaml
     • mappings/vendor-a-npu-to-evidence-v3.1.0.yaml
     • schemas/score-normalized-evidence-v1.0.0.yaml
     • schemas/vendor-a-npu-status-v1.2.0.yaml
     • tests/normalization-vectors.yaml

So the mismatch was both in the declared artifact inventory and in the stored digests for the tracked files.

[daeyoung-jeong-lge]

Looks good

[Copilot]

🟢 Approval recommended

The changes are limited to manifest/integrity metadata alignment and appear internally consistent with the updated artifact declarations.

Pull request overview

This PR updates the Vendor-A NPU evidence interface example package metadata to restore consistency between the package manifest’s declared artifacts and the recorded SHA-256 integrity digests, aligning with the artifact verification expectations described in Issue #9.

Changes:

• Expanded manifest.yaml spec.artifacts to explicitly include README.md and the collector config as packaged artifacts.
• Refreshed signatures/content-digests.yaml SHA-256 values to match the current contents of the tracked artifact files.

File summaries

File	Description
interfaces/vendor-a-npu-evidence-layer-package/manifest.yaml	Adds missing artifact entries so the manifest’s artifact list reflects what’s packaged.
interfaces/vendor-a-npu-evidence-layer-package/signatures/content-digests.yaml	Updates recorded SHA-256 digests to reflect current artifact contents.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[daeyoung-jeong-lge]

@copilot Looks good. Approving

[daeyoung-jeong-lge]

@basheerFZ
I have no authority to merge this because I have collaborated with the coding agent. Could you review and merge this?

[daeyoung-jeong-lge]

Looks OK

[basheerFZ]

ok