Closes MakazhanAlpamys#309. `soup bom emit` and `soup attest emit` gain --attach-to-registry, and the two new artifact kinds render in `soup card` for free, so a published model card carries its ML-BOM and in-toto attestation instead of leaving them loose on disk. Review found two things, both now fixed and verified by running rather than reading. The signature sidecar was never attached. `attest emit --sign ed25519` writes TWO files and registered ONE -- and `soup attest verify` REQUIRES the .sig via --signature, so the card linked an attestation that could not be verified from the registry alone, on exactly the path docs/compliance.md tells users to take. Confirmed closed end-to-end: both paths were read back OUT OF THE REGISTRY ROWS and fed to verify, which returned exit=0 "Attestation signature valid" with nothing remembered from the emit. Attach failure exited 0, so a typo'd registry id left a compliance pipeline green with the provenance link silently absent -- the gap MakazhanAlpamys#309 exists to close. MakazhanAlpamys#309 asked to mirror `soup eval custom`, which raises typer.Exit(1); the first round mirrored `soup shrink` instead, whose exit codes are already load-bearing (0=SHIP/2=DON'T) and so structurally cannot signal this. Now exits 1 with the file preserved (statement AND .sig on the signed path), while --attach-to-registry without -o exits 2, matching `--format both`'s existing behaviour. The decision is recorded in the docstrings, CHANGELOG and docs/compliance.md rather than only in the PR thread. Ten mutations, nine killed. The survivor is a card.py heading string no test asserts; suppressing the artifact rows in that same file -- which this PR does not touch -- still fails test_card_lists_attached_bom_and_attestation, so the card test is genuinely end-to-end rather than checking database state. The artifact-kind allowlist stays CLOSED (store.py raises on an unknown kind, pinned by a test), and containment is enforced twice over: attach_artifact's enforce_cwd default reaching os.path.realpath + os.path.commonpath -- not Path.resolve().relative_to(), which breaks on Windows short names -- plus atomic_write_text already refusing anything outside cwd. Also fixed a pre-existing docs bug that rode along: the compliance walkthrough omitted the required --base-model, so the documented command errored as written. 1052 passed on the PR's files plus regressions, 2306 across all 33 source-grep files, test_cli_startup_is_light 23/23, ruff clean, 12/12 CI.

Breadcrumbs

User selector

Datepicker

Commit history

Commits on Aug 18, 2026

feat(registry): link BOM and attestation to soup card via registry artifact kinds (#309)

Commits on Jul 15, 2026

feat(compliance): init templates + soup card + soup ci init + GGUF-on-Windows (v0.71.35)