From 352f1f9acb2a96369fcd0c31371010c81c0e3a8d Mon Sep 17 00:00:00 2001 From: Codex Date: Tue, 13 Oct 2026 21:54:25 +0300 Subject: [PATCH] Specify signed updates published through Git alone --- docs/superpowers/specs/2026-10-13-laptop-ready-design.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/superpowers/specs/2026-10-13-laptop-ready-design.md b/docs/superpowers/specs/2026-10-13-laptop-ready-design.md index 7ebded6..ed376fe 100644 --- a/docs/superpowers/specs/2026-10-13-laptop-ready-design.md +++ b/docs/superpowers/specs/2026-10-13-laptop-ready-design.md @@ -61,6 +61,13 @@ JSON/archive entries, traversal/symlinks/special files, excess sizes, tampering unsupported formats. Verify the manifest before trusting the archive. Empty releases are a normal result. No fallback to executing unsigned downloaded Python archives. +Publication must also work using the already available Git SSH access alone. +When native releases have no applicable candidate, support the fixed public +`main/releases/stable` raw path for the same three signed passive artifacts. +The branch is untrusted transport: the pinned signature, hashes and monotonic +sequence remain mandatory. Missing artifacts mean no update; invalid signed +material must produce an error. No API token or extra update server is required. + CLI: `hydra update check`, `status`, `apply` and `rollback TRANSACTION`, plus a standalone `hydra-update-recover` available when the runtime itself is damaged. The trusted engine and recovery bootstrap are outside the runtime update allowlist.