schema-version: 0.1.0
standard:
  schema-version: 0.1.0
  sequence: 290
  standard_id: REL-009
  title: Coordinated Remediation Adoption
  summary: Providers publish versioned remediation sets and supported adoption procedures
    so consumers can resolve the intended patched dependencies without reconstructing
    transitive dependency overrides themselves.
  extended-by:
  - REL-009-JAVA
  doc-status: Draft
  standard-version: 0.1.0
  candidate-pack: OSERA-SP-0.2.0 required
  ratified-in: Not ratified
  ratified-date: Not ratified
  fitness-role: Required check
  type: REL
  category: Release Process
  applies-to:
  - Package patch providers
  - Repository operators
  - Enterprise recipients
  - Package ecosystem profile authors
  requirements:
  - id: REL-009.REQ-001
    level: MUST
    text: Providers must declare the supported dependency scope, upstream baselines,
      applicable ecosystem profile, and consumer entry points and tooling configurations
      for adopting a remediation set.
    checkability: partially-automated
    checks:
    - id: REL-009.CHECK-001
      title: Supported scope and adoption entry points are declared
      type: release-evidence
      severity: blocking
      implementation: osera-fitness.rel009.supported_scope
      evidence:
      - supported_dependency_scope
      - upstream_baselines
      - applicable_profile
      - consumer_entry_points
      - supported_tooling_configurations
  - id: REL-009.REQ-002
    level: MUST
    text: Providers must publish an immutable, versioned remediation set identifying
      exact artifact versions and associated remediation evidence, and disclose the
      dependency changes, validation performed, and known limitations for adoption.
    checkability: partially-automated
    checks:
    - id: REL-009.CHECK-002
      title: Versioned remediation set identifies exact artifacts and evidence
      type: release-evidence
      severity: blocking
      implementation: osera-fitness.rel009.remediation_set
      evidence:
      - remediation_set_identity
      - artifact_versions
      - remediation_evidence
    - id: REL-009.CHECK-007
      title: Dependency changes and validation scope are disclosed
      type: release-evidence
      severity: blocking
      implementation: osera-fitness.rel009.change_disclosure
      evidence:
      - dependency_version_changes
      - validation_evidence
      - inherited_evidence_references
      - known_limitations
  - id: REL-009.REQ-003
    level: MUST
    text: Providers must publish a supported adoption procedure that avoids consumers
      having to author and maintain artifact-by-artifact transitive dependency overrides,
      verify that it resolves the intended remediations for the declared configurations,
      and report when those remediations cannot be resolved.
    checkability: partially-automated
    checks:
    - id: REL-009.CHECK-003
      title: Supported adoption procedure is published
      type: release-evidence
      severity: blocking
      implementation: osera-fitness.rel009.adoption_procedure
      evidence:
      - adoption_procedure
      - consumer_entry_points
    - id: REL-009.CHECK-006
      title: Adoption resolves the intended remediations in supported configurations
      type: release-evidence
      severity: blocking
      implementation: osera-fitness.rel009.consumer_resolution
      evidence:
      - adoption_procedure
      - supported_tooling_configurations
      - consumer_change
      - resolved_versions_before
      - resolved_versions_after
      - resolution_result
      - resolution_failures
  source_path: docs/_standards/rel-009-line-release-and-bom-propagation.md
  url: "/standards/rel-009-line-release-and-bom-propagation/"