Release record polish, builds vs releases, honest supply chain, Release flows filter

docs/architecture.md

@@ -47,7 +47,7 @@ useReleaseRecords.ts, releaseFlow.ts (draft, mode, sign-off, planned), useReleas
   ↓
 ReleaseRecordPanel: mode bar, Next release card + draft editor, record list, Compare, Changelog
   ↓
-ReleaseRecordDetail: masthead, sign-off, outcome, evidence, human context (saved as a PR)
+ReleaseRecordDetail: masthead, sign-off, outcome, evidence, after-release notes (saved as a PR)
 ```
 
 The backend owns every write and two scheduled tasks (sign-off poll every 2 minutes, record poll hourly) that open

docs/components.md

@@ -24,7 +24,7 @@ release being put together; see [Release records](release-records/index.md):
 - **Record list** (`ReleaseRecordList.tsx`): one row per record, with its tree name (`releaseNames.ts`), Flight ladder,
   readiness score and outcome chip; Compare; **Changelog** (`ReleaseChangelog.tsx`).
 - **Record detail** (`ReleaseRecordDetail.tsx`): masthead, **Release notes and sign-off** (`ReleaseSignoffPanel.tsx`),
-  **Outcome** (`ReleaseOutcome.tsx`), what changed, what was built, what happened, human context, export.
+  **Outcome** (`ReleaseOutcome.tsx`), what changed, what was built, what happened, After release, export.
 
 **Key components:** `ReleasesTab`, `ReleaseRecordPanel`, `ReleaseRecordDetail`
 
@@ -92,7 +92,7 @@ One environment at a time (the same tiered picker as Deployments): the Kubernete
 how they relate.
 
 ### Images
-The artifact catalog: the app's images and versions from the registry, with supply-chain chips.
+The artifact catalog: the app's images and versions from the registry, with supply-chain chips. What the steps and colours mean: [Supply chain](supply-chain.md).
 
 ### SLOs
 Sloth-backed SLO burn rate, queried from Prometheus, for every environment of an app (Ground and Flight).
@@ -153,7 +153,7 @@ DAG rendering for Tekton pipelines and task dependency visualization.
 
 ### ReleaseRecordDetail
 
-One release record: masthead, sign-off, outcome, evidence, human context, export.
+One release record: masthead, sign-off, outcome, evidence, after-release notes, export.
 
 **Props:**
 ```typescript

docs/credentials/diagrams/02-write-sequence.html

@@ -74,7 +74,7 @@ <h1>A Tower write, end to end</h1>
 <div class="fig">
 <svg viewBox="0 16 1000 620" xmlns="http://www.w3.org/2000/svg" role="img" aria-labelledby="02-write-sequence-title 02-write-sequence-desc"><title id="02-write-sequence-title">A Tower write, end to end</title><desc id="02-write-sequence-desc">Tower posts a Re-run to the Backstage backend, which checks the user owns the app, asks kind-prod for a ten-minute tower-actor token for kiac-dev, reads the source run and creates the copy on kiac-dev, where the token is verified, RBAC applied and the PipelineRun shape policy admits it, then answers the browser and records the audit event.</desc><defs><marker id="arrow-open" markerWidth="8" markerHeight="6" refX="7" refY="3" orient="auto"><polyline points="0 0, 8 3, 0 6" fill="none" stroke="#5b6570" stroke-width="1.2"/></marker><marker id="arrow" markerWidth="8" markerHeight="6" refX="7" refY="3" orient="auto"><polygon points="0 0, 8 3, 0 6" fill="#5b6570"/></marker><marker id="arrow-accent" markerWidth="8" markerHeight="6" refX="7" refY="3" orient="auto"><polygon points="0 0, 8 3, 0 6" fill="#b9791f"/></marker><marker id="arrow-link" markerWidth="8" markerHeight="6" refX="7" refY="3" orient="auto"><polygon points="0 0, 8 3, 0 6" fill="#2e7ba6"/></marker></defs><rect x="0" y="16" width="1000" height="620" fill="#f2efe9"/><line x1="112" y1="104" x2="112" y2="560" stroke="rgba(27,31,36,0.20)" stroke-width="1" stroke-dasharray="3,3"/><line x1="352" y1="104" x2="352" y2="560" stroke="rgba(27,31,36,0.20)" stroke-width="1" stroke-dasharray="3,3"/><line x1="592" y1="104" x2="592" y2="560" stroke="rgba(27,31,36,0.20)" stroke-width="1" stroke-dasharray="3,3"/><line x1="832" y1="104" x2="832" y2="560" stroke="rgba(27,31,36,0.20)" stroke-width="1" stroke-dasharray="3,3"/><rect x="348" y="132" width="8" height="416" fill="rgba(27,31,36,0.06)" stroke="#5b6570" stroke-width="0.8"/><rect x="588" y="216" width="8" height="48" fill="rgba(27,31,36,0.06)" stroke="#5b6570" stroke-width="0.8"/><rect x="828" y="300" width="8" height="84" fill="rgba(27,31,36,0.06)" stroke="#5b6570" stroke-width="0.8"/><rect x="828" y="420" width="8" height="84" fill="rgba(27,31,36,0.06)" stroke="#5b6570" stroke-width="0.8"/><path d="M116,140 L346,140" fill="none" stroke="#5b6570" stroke-width="1.2" marker-end="url(#arrow)"/><rect x="180" y="123" width="103" height="12" fill="#f2efe9"/><text x="232.0" y="132" fill="#5b6570" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle" letter-spacing="0.08em">POST /TEKTON/RERUN</text><path d="M356,168 L380,168 L380,188 L360,188" fill="none" stroke="#5b6570" stroke-width="1.2" marker-end="url(#arrow)"/><rect x="388" y="173" width="188" height="12" fill="#f2efe9"/><text x="392" y="182" fill="#5b6570" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="start" letter-spacing="0.08em">OWNER CHECK · TOWER.PIPELINE.RERUN</text><path d="M356,224 L586,224" fill="none" stroke="#5b6570" stroke-width="1.2" marker-end="url(#arrow)"/><rect x="399" y="207" width="145" height="12" fill="#f2efe9"/><text x="472.0" y="216" fill="#5b6570" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle" letter-spacing="0.08em">TOKENREQUEST · TOWER-ACTOR</text><path d="M588,260 L358,260" fill="none" stroke="#5b6570" stroke-width="1.2" stroke-dasharray="5,4" marker-end="url(#arrow)"/><rect x="397" y="243" width="151" height="12" fill="#f2efe9"/><text x="472.0" y="252" fill="#5b6570" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle" letter-spacing="0.08em">10-MIN TOKEN · AUD KIAC-DEV</text><path d="M356,308 L826,308" fill="none" stroke="#2e7ba6" stroke-width="1.2" marker-end="url(#arrow-link)"/><rect x="431" y="291" width="82" height="12" fill="#f2efe9"/><text x="472" y="300" fill="#2e7ba6" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle" letter-spacing="0.08em">GET SOURCE RUN</text><path d="M836,336 L860,336 L860,356 L840,356" fill="none" stroke="#5b6570" stroke-width="1.2" marker-end="url(#arrow)"/><rect x="868" y="341" width="98" height="12" fill="#f2efe9"/><text x="872" y="350" fill="#5b6570" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="start" letter-spacing="0.08em">VERIFY JWT · RBAC</text><path d="M828,384 L358,384" fill="none" stroke="#5b6570" stroke-width="1.2" stroke-dasharray="5,4" marker-end="url(#arrow)"/><rect x="679" y="367" width="66" height="12" fill="#f2efe9"/><text x="712" y="376" fill="#5b6570" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle" letter-spacing="0.08em">PIPELINERUN</text><path d="M356,428 L826,428" fill="none" stroke="#2e7ba6" stroke-width="1.2" marker-end="url(#arrow-link)"/><rect x="420" y="411" width="103" height="12" fill="#f2efe9"/><text x="472" y="420" fill="#2e7ba6" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle" letter-spacing="0.08em">CREATE PIPELINERUN</text><path d="M836,456 L860,456 L860,476 L840,476" fill="none" stroke="#5b6570" stroke-width="1.2" marker-end="url(#arrow)"/><rect x="868" y="461" width="114" height="12" fill="#f2efe9"/><text x="872" y="470" fill="#5b6570" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="start" letter-spacing="0.08em">SHAPE POLICY · ADMIT</text><path d="M828,504 L358,504" fill="none" stroke="#b9791f" stroke-width="1.2" marker-end="url(#arrow-accent)"/><rect x="679" y="487" width="66" height="12" fill="#f2efe9"/><text x="712" y="496" fill="#b9791f" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle" letter-spacing="0.08em">201 CREATED</text><path d="M348,544 L118,544" fill="none" stroke="#5b6570" stroke-width="1.2" stroke-dasharray="5,4" marker-end="url(#arrow)"/><rect x="196" y="527" width="71" height="12" fill="#f2efe9"/><text x="232.0" y="536" fill="#5b6570" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle" letter-spacing="0.08em">OK · AUDITED</text><rect x="24" y="48" width="176" height="56" rx="6" fill="#f2efe9"/><rect x="24" y="48" width="176" height="56" rx="6" fill="#ffffff" stroke="#1b1f24" stroke-width="1"/><text x="112.0" y="74.0" fill="#1b1f24" font-size="12" font-weight="600" font-family="'Geist', system-ui, sans-serif" text-anchor="middle">Tower</text><text x="112.0" y="90.0" fill="#5b6570" font-size="8" font-weight="400" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle">signed-in browser</text><rect x="264" y="48" width="176" height="56" rx="6" fill="#f2efe9"/><rect x="264" y="48" width="176" height="56" rx="6" fill="rgba(185,121,31,0.08)" stroke="#b9791f" stroke-width="1"/><text x="352.0" y="74.0" fill="#1b1f24" font-size="12" font-weight="600" font-family="'Geist', system-ui, sans-serif" text-anchor="middle">Backstage backend</text><text x="352.0" y="90.0" fill="#5b6570" font-size="8" font-weight="400" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle">glidepath routes</text><rect x="504" y="48" width="176" height="56" rx="6" fill="#f2efe9"/><rect x="504" y="48" width="176" height="56" rx="6" fill="#ffffff" stroke="#1b1f24" stroke-width="1"/><text x="592.0" y="74.0" fill="#1b1f24" font-size="12" font-weight="600" font-family="'Geist', system-ui, sans-serif" text-anchor="middle">kind-prod API</text><text x="592.0" y="90.0" fill="#5b6570" font-size="8" font-weight="400" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle">issuer · TokenRequest</text><rect x="744" y="48" width="176" height="56" rx="6" fill="#f2efe9"/><rect x="744" y="48" width="176" height="56" rx="6" fill="#ffffff" stroke="#1b1f24" stroke-width="1"/><text x="832.0" y="74.0" fill="#1b1f24" font-size="12" font-weight="600" font-family="'Geist', system-ui, sans-serif" text-anchor="middle">kiac-dev API</text><text x="832.0" y="90.0" fill="#5b6570" font-size="8" font-weight="400" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="middle">authn · RBAC · admission</text><line x1="24" y1="584" x2="976" y2="584" stroke="rgba(27,31,36,0.12)" stroke-width="0.8"/><text x="24" y="604" fill="#5b6570" font-size="8" font-weight="500" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="start" letter-spacing="0.14em">LEGEND</text><rect x="96" y="595" width="16" height="12" rx="3" fill="rgba(185,121,31,0.08)" stroke="#b9791f" stroke-width="1"/><text x="120" y="605" fill="#5b6570" font-size="8" font-weight="400" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="start">Acts for the user</text><line x1="229" y1="601" x2="249" y2="601" stroke="#2e7ba6" stroke-width="1.2"/><text x="257" y="605" fill="#5b6570" font-size="8" font-weight="400" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="start">Call to kiac-dev</text><line x1="361" y1="601" x2="381" y2="601" stroke="#5b6570" stroke-width="1.2"/><text x="389" y="605" fill="#5b6570" font-size="8" font-weight="400" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="start">Other call</text><line x1="463" y1="601" x2="483" y2="601" stroke="#5b6570" stroke-width="1.2" stroke-dasharray="5,4"/><text x="491" y="605" fill="#5b6570" font-size="8" font-weight="400" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="start">Return</text><line x1="545" y1="601" x2="565" y2="601" stroke="#b9791f" stroke-width="1.2"/><text x="573" y="605" fill="#5b6570" font-size="8" font-weight="400" font-family="'Geist Mono', ui-monospace, monospace" text-anchor="start">Success</text></svg>
 </div>
-<div class="cards"><div class="card"><p class="eyebrow"><span class="dot accent"></span>Before any token</p><p>The backend refuses a user who doesn't own the app (<code>tower.pipeline.rerun</code>, or <code>.cancel</code>), and records the refusal. No token is minted for a refused request.</p></div><div class="card"><p class="eyebrow"><span class="dot"></span>The token</p><p><code>TokenRequest</code> for <code>backstage/tower-actor</code>: audience <code>kiac-dev</code>, 600 s, bound to the Backstage pod. Backstage's ServiceAccount may create tokens for that one name only.</p></div><div class="card"><p class="eyebrow"><span class="dot link"></span>At kiac-dev</p><p>The token must come from kind-prod's issuer, carry audience <code>kiac-dev</code>, name <code>backstage/tower-actor</code> and live at most 600 s. <code>tower-pipelinerun-shape</code> then allows only Glidepath's own run shape in an app's <code>-cicd</code> namespace.</p></div></div>
+<div class="cards"><div class="card"><p class="eyebrow"><span class="dot accent"></span>Before any token</p><p>The backend refuses a user who doesn't own the app (<code>tower.pipeline.rerun</code>, or <code>.cancel</code>), and records the refusal. No token is minted for a refused request.</p></div><div class="card"><p class="eyebrow"><span class="dot"></span>The token</p><p><code>TokenRequest</code> for <code>backstage/tower-actor</code>: audience <code>kiac-dev</code>, 600 s. Backstage's ServiceAccount may create tokens for that one name only.</p></div><div class="card"><p class="eyebrow"><span class="dot link"></span>At kiac-dev</p><p>The token must come from kind-prod's issuer, carry audience <code>kiac-dev</code>, name <code>backstage/tower-actor</code> and live at most 600 s. <code>tower-pipelinerun-shape</code> then allows only Glidepath's own run shape in an app's <code>-cicd</code> namespace.</p></div></div>
 <div class="foot"><span>Tower · Cluster credentials</span><span>SPEC-tower-cluster-credentials.md</span></div>
 </div>
 </body>