PyPI Trusted Publishing Branch Scoping Gap

The goal is to determine the enforcement boundary for branch identifiers when using PyPI Trusted Publishing with OIDC-based tokenless uploads. Publisher bindings specify repository, workflow filename, and optionally environment, but do not include a branch or ref constraint. OIDC tokens emitted by CI providers carry branch information such as ref: refs/heads/main, yet PyPI's trust model does not publicly document whether it validates this claim against the binding.

This creates ambiguity for maintainers who expect branch-scoped releases and rely on the documented permission boundary to prevent cross-branch uploads. Does PyPI validate the ref claim from the OIDC token against the publisher binding, and what occurs when the branch does not match? Is there a documented mechanism to enforce branch restriction within Trusted Publishing, or must maintainers rely on environment naming and compensating controls such as environment protection rules? Can a publisher binding be extended to include a branch constraint, or is the feature set intentionally limited to repository and workflow filename?