3. Produce trustworthy integration, build and artifact results
The application team names its mainline, a small change, adequate build/tests and the permission to integrate. The direct DORA CI Method under SYSE.31 supplies the missing shared-mainline result.
A small code counterexample makes that result visible. Mainline M0 allows parcel weights from 1 to 10, with the invariant minimum <= maximum. Source change A raises the minimum to 8; source change B, developed against M0, lowers the maximum to 5. These source-change labels are local to this example, not the obtaining arrangements above.
| Checked source state | Range | Result |
|---|---|---|
| A on M0 | 8..10 | Branch check passes. |
| B on M0 | 1..5 | Branch check passes. |
| B combined with already integrated A | 8..5 | Combined invariant fails despite no textual merge conflict. |
| Withdraw B and retain A | 8..10 | Rebuild/retest can qualify the restored mainline. |
A current-base check would stop B before integration. In the adverse history where stale branch feedback was accepted, the post-integration check blocks qualification of that shared revision’s artifacts. The authorized application team withdraws B, rebuilds/retests the restored result and returns the conflicting business intent before B is tried again.
SYSE.30 recovers the chosen integrated revision’s resolved dependencies, runner/toolchain and relevant generated inputs. A clean-build comparison exposes an embedded build timestamp. The team removes irrelevant variation from the specified artifact or explains the difference under a weaker comparison. In the latter case, only that weaker comparison is qualified.
SYSE.31 also reproduces fixture interference: one test deletes a row still used by another. Attempt-specific fixtures remove that interference while a deliberately wrong transformation still fails. Slower integration and application acceptance remain required where their different questions matter.
Using SYSE.32, the consumer obtains the tested artifact by its qualified identity, checks applicable evidence and the expected builder/source/provenance correspondence, and retains the same bytes for the next use. A correctly signed but unexpected origin fails the configured trust condition. Obtain the required verifier result before relying on the artifact.
SYSE.33 constructs an isolated test environment from the versioned configuration and synthetic data seed. A clean creation, a relevant configuration change and a partial-creation failure are exercised. Existing resources are recovered by attempt identity before retry; cleanup is bounded by ownership and retained-data permission. Check that the intended task can run before relying on the environment.
SYSE.28 places two different controls from the supplied constraints. Untrusted branch execution must not obtain release credentials. Artifact verification must occur before the consumer relies on transferred bytes. The example uses no production personal data. Production changes require the product release holder’s permission.