diff --git a/docs/superpowers/specs/2026-10-13-laptop-ready-design.md b/docs/superpowers/specs/2026-10-13-laptop-ready-design.md
index 7ebded6..ed376fe 100644
--- a/docs/superpowers/specs/2026-10-13-laptop-ready-design.md
+++ b/docs/superpowers/specs/2026-10-13-laptop-ready-design.md
@@ -61,6 +61,13 @@ JSON/archive entries, traversal/symlinks/special files, excess sizes, tampering
 unsupported formats. Verify the manifest before trusting the archive. Empty releases
 are a normal result. No fallback to executing unsigned downloaded Python archives.
 
+Publication must also work using the already available Git SSH access alone.
+When native releases have no applicable candidate, support the fixed public
+`main/releases/stable` raw path for the same three signed passive artifacts.
+The branch is untrusted transport: the pinned signature, hashes and monotonic
+sequence remain mandatory. Missing artifacts mean no update; invalid signed
+material must produce an error. No API token or extra update server is required.
+
 CLI: `hydra update check`, `status`, `apply` and `rollback TRANSACTION`, plus a
 standalone `hydra-update-recover` available when the runtime itself is damaged.
 The trusted engine and recovery bootstrap are outside the runtime update allowlist.