New publishes require the latest assessment for the exact source bytes to be GO / GO-WITH-CONDITIONS, with no unresolved declared dependencies. Repository eligibility is not environment qualification; historical entries require a separate review before deployment. Artifacts are served read-only at /rval-gateway/repo/ (unauthenticated: image builds cannot perform SSO; the repo contains approved artifacts only).