{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-29T01:09:39.613311Z",
  "record_id": "VXI-EXT-ICE05-GITLAB-MR-ARTIFACT-REF-IDENTITY-01-v1",
  "record_kind": "external_reference",
  "title": "GitLab merge-request artifact ref identity",
  "system": "GitLab",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does fetching downstream artifacts by branch name identify the upstream merge-request pipeline’s artifacts?",
  "near_questions": [
    "Did this artifact come from the MR pipeline or branch pipeline?",
    "Which ref selects GitLab merge-request artifacts?",
    "Can a branch-name artifact lookup select the wrong pipeline?",
    "How do I bind downstream artifacts to a specific merge request?"
  ],
  "supported_claims": [
    {
      "claim": "GitLab instructs merge-request artifact consumers to use the merge-request ref path through CI_MERGE_REQUEST_REF_PATH. Using the branch name retrieves artifacts from the latest branch pipeline instead of the merge-request pipeline.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Require the intended merge-request ref and artifact identity. A matching branch name is not sufficient evidence that the artifact came from the reviewed merge-request pipeline.",
    "Buyer implementation, live runtime enforcement, settled payment, certification or permission to act are not established.",
    "No expanded capabilities or licences for existing INDEX executables."
  ],
  "public_summary": "GitLab instructs merge-request artifact consumers to use the merge-request ref path through CI_MERGE_REQUEST_REF_PATH. Using the branch name retrieves artifacts from the latest branch pipeline instead of the merge-request pipeline.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "GitLab: Downstream pipelines",
    "source_url": "https://docs.gitlab.com/ci/pipelines/downstream_pipelines/",
    "checked_on": "2026-10-29",
    "candidate_record_id": "VXI-EXT-ICE05-GITLAB-MR-ARTIFACT-REF-IDENTITY-01-v1",
    "candidate_record_sha256": "2ded0a7131a2295a4291f455448e05d2b0905cb4da4d7951964caa8ca86e384a",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "GitLab instructs merge-request artifact consumers to use the merge-request ref path through CI_MERGE_REQUEST_REF_PATH. Using the branch name retrieves artifacts from the latest branch pipeline instead of the merge-request pipeline.",
    "required_buyer_context": "Merge-request ID and ref path; Upstream pipeline/job; Artifact digest; Downstream needs configuration. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-29",
    "claim_to_check": "Does fetching downstream artifacts by branch name identify the upstream merge-request pipeline’s artifacts?",
    "documented_statement": {
      "status": "documented",
      "statement": "GitLab instructs merge-request artifact consumers to use the merge-request ref path through CI_MERGE_REQUEST_REF_PATH. Using the branch name retrieves artifacts from the latest branch pipeline instead of the merge-request pipeline.",
      "source_ids": [
        "gitlab-downstream"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "Review gitlab merge-request artifact ref identity before accepting the buyer claim. The prior record separates GitHub run attempts. This decision addresses GitLab’s distinct branch-versus-merge-request artifact selection mechanism. This is a documentation-review judgment, not an observed deployment outcome.",
      "source_ids": [
        "gitlab-downstream"
      ]
    },
    "buyer_evidence_required": [
      "Merge-request ID and ref path",
      "Upstream pipeline/job",
      "Artifact digest",
      "Downstream needs configuration"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require the intended merge-request ref and artifact identity. A matching branch name is not sufficient evidence that the artifact came from the reviewed merge-request pipeline."
    },
    "unknowns": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected."
    },
    "evidence_sources": [
      {
        "source_id": "gitlab-downstream",
        "url": "https://docs.gitlab.com/ci/pipelines/downstream_pipelines/",
        "final_url": "https://docs.gitlab.com/ci/pipelines/downstream_pipelines/",
        "captured_at_utc": "2026-10-29T00:50:19.883596+00:00",
        "status": 200,
        "content_type": "text/html; charset=utf-8",
        "bytes": 141881,
        "sha256": "49bc72d77d1076f4d965f038eeb4e5aec173fa508a14a39f0358a5cca49f8cbc",
        "title": "GitLab: Downstream pipelines",
        "hash_basis": "SHA-256 of captured HTTP response body bytes",
        "checked_on": "2026-10-29",
        "capture_status": 200,
        "claim_review_completed": true,
        "reviewed_sections": [
          "Multi-project pipelines",
          "Trigger a downstream pipeline from a job in the .gitlab-ci.yml file",
          "Pass a predefined variable",
          "Pass CI/CD variables to a downstream pipeline",
          "Control what type of variables to forward to downstream pipelines",
          "Fetch artifacts from an upstream merge request pipeline"
        ],
        "version_context": "Rolling official documentation captured 2026-10-29; exact response hash is pinned, not a stable vendor release. Verify the deployed API/version and account feature availability. ",
        "rights_review": "Original factual paraphrase and attributed source metadata only. Captured documentation and code remain private; no source prose, examples, images or vendor marks are redistributed. No licence to vendor software or buyer assurance is granted."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Source documentation supports only the stated boundary. Existing licensed checkers analyse supported supplied declarations; they do not query these providers, verify live systems, settle payments or certify compliance.",
    "paid_value": {
      "decision_context": "Review gitlab merge-request artifact ref identity before accepting the buyer claim. The prior record separates GitHub run attempts. This decision addresses GitLab’s distinct branch-versus-merge-request artifact selection mechanism.",
      "free": "Complete review, practical questions, source references and limitations; freely accessible and locally saveable.",
      "single_request": "Unavailable for this publication-only record; historical saved retrieval remains unchanged.",
      "evidence_receipt": "Unavailable for this publication-only record; no new paid retrieval entitlement.",
      "excluded": [
        "Fresh vendor research",
        "Live provider inspection",
        "Runtime enforcement or certification",
        "Expanded executable schemas or licences",
        "Native Coupa, Stripe Issuing, GitLab or Sigstore validation"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck the source and applicable API, account and configuration before current reliance. No monitoring or fresh research is included.",
      "specific_watch": "Fetch artifacts from an upstream merge request pipeline"
    },
    "buyer_relevance": "Review gitlab merge-request artifact ref identity before accepting the buyer claim. The prior record separates GitHub run attempts. This decision addresses GitLab’s distinct branch-versus-merge-request artifact selection mechanism.",
    "refusal_conditions": [
      "Require the intended merge-request ref and artifact identity. A matching branch name is not sufficient evidence that the artifact came from the reviewed merge-request pipeline.",
      "Do not infer buyer deployment conformance or successful business outcomes from source documentation."
    ]
  },
  "niche": {
    "niche_id": "ice05-governance",
    "label": "Agent Governance & Policy Boundaries",
    "classification_id": "governance",
    "classification_label": "Agent Governance & Policy Boundaries",
    "topic_id": "governance",
    "buyer_intent": "Review gitlab merge-request artifact ref identity before accepting the buyer claim. The prior record separates GitHub run attempts. This decision addresses GitLab’s distinct branch-versus-merge-request artifact selection mechanism.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#gitlab-mr-artifact-ref-identity",
  "machine_readable_record": "/varexis-index/records/gitlab-mr-artifact-ref-identity.json"
}