Include dependency inventory in release evidence

Author: Flow Memory Builder

BUILD_REPORT.md

@@ -113,7 +113,7 @@ Added:
 - `src/flow_memory/storage/migrations.py` and `scripts/verify_storage_schema.py` for schema fingerprints and migration metadata verification.
 - `scripts/release_gate.py` now includes storage schema verification.
 - `src/flow_memory/release/manifest.py` and `scripts/generate_release_manifest.py` for offline release manifest generation.
-- `src/flow_memory/release/evidence.py` and `scripts/export_release_evidence.py` for exporting a hashed release evidence bundle.
+- `src/flow_memory/release/evidence.py` and `scripts/export_release_evidence.py` for exporting a hashed release evidence bundle, including dependency inventory.
 - `src/flow_memory/release/readiness.py` and `scripts/release_decision.py` for explicit local/testnet/production go-no-go decisions.
 - `src/flow_memory/release/dependencies.py` and `scripts/export_dependency_inventory.py` for offline dependency inventory.
 

docs/PRODUCTION_READINESS.md

@@ -105,6 +105,6 @@ Each release candidate should attach or link:
 - Known limitations, including whether funds, mainnet, untrusted execution, or production data are intentionally disabled.
 - Release-gate JSON from `scripts/release_gate.py`, including API snapshot, audit replay, Base dry-run, and secret-scan status.
 - Release manifest JSON from `scripts/generate_release_manifest.py`, including commit, branch, API snapshot, storage schema, Base dry-run plan, and release-gate status.
-- Release evidence bundle from `scripts/export_release_evidence.py`, including `index.json`, release manifest, release gates, API snapshot, storage schema, and Base deployment dry-run.
+- Release evidence bundle from `scripts/export_release_evidence.py`, including `index.json`, release manifest, release gates, API snapshot, storage schema, Base deployment dry-run, and dependency inventory.
 - Release decision JSON from `scripts/release_decision.py`, with explicit target, classification, blockers, and required evidence.
 - Dependency inventory JSON from `scripts/export_dependency_inventory.py`, covering Python optional extras, dashboard package metadata, and Rust helper crate metadata.

src/flow_memory/release/evidence.py

@@ -11,6 +11,7 @@
 from flow_memory.crypto.hashes import content_hash
 from flow_memory.release.gates import run_release_gates
 from flow_memory.release.manifest import build_release_manifest
+from flow_memory.release.dependencies import build_dependency_inventory
 from flow_memory.storage.migrations import migration_plan
 from flow_memory.web3.deployment_plan import generate_deployment_plan
 
@@ -36,6 +37,7 @@ def build_evidence_documents(root: str | Path = ".") -> Mapping[str, Mapping[str
         "api_snapshot.json": dict(api_snapshot()),
         "storage_schema.json": migration_plan().as_record(),
         "base_deployment_plan.json": dict(generate_deployment_plan()),
+        "dependency_inventory.json": build_dependency_inventory(root_path).as_record(),
     }
 
 

tests/test_release_evidence.py

@@ -17,6 +17,7 @@ def test_export_and_verify_release_evidence_bundle(self) -> None:
 
             self.assertEqual(bundle.index["bundle_hash"], verified.index["bundle_hash"])
             self.assertIn("release_manifest.json", bundle.index["files"])
+            self.assertIn("dependency_inventory.json", bundle.index["files"])
 
     def test_verify_release_evidence_detects_tamper(self) -> None:
         root = Path(__file__).resolve().parents[1]