Add signed runtime distribution pipeline

2026-08-03 00:54:06 +02:00
parent 29acb55b7c
commit 43380eb068
24 changed files with 3371 additions and 54 deletions
@@ -141,6 +141,12 @@ The canonical backlog item is

 Implementation status as of the current source tree:

+- Slice 1 now has the source-controlled production artifact boundary: offline
+  per-architecture wheel resolution, non-root API/Web image definitions,
+  multi-architecture OCI publication, signed composition/SBOM/provenance,
+  immutable Gitea assets, a signed one-file deployer, and fail-closed manifest
+  adoption. The first real published release and cross-architecture runtime
+  evidence remain release-operator work rather than source-code claims.
 - Slice 6 has a working application-tier foundation: state profiles, shared
  object storage, runtime node registration/heartbeats/drain, fenced scheduler,
  migration serialization, exact-head startup waiting, Ops visibility, and a