From c26442f6f51c45e9d6bbb23e7878132a5c8a4711 Mon Sep 17 00:00:00 2001
From: Codex <codex@localhost>
Date: Tue, 13 Oct 2026 23:51:31 +0300
Subject: [PATCH] Record successful public signed update delivery and recovery
 verification

---
 docs/releases/2026-10-13-laptop-ready/README.md  |  4 ++++
 .../2026-10-13-laptop-ready/artifacts.json       |  5 +++++
 .../public-update-verification.json              | 16 ++++++++++++++++
 .../superpowers/plans/2026-10-13-laptop-ready.md |  7 ++++---
 4 files changed, 29 insertions(+), 3 deletions(-)
 create mode 100644 docs/releases/2026-10-13-laptop-ready/public-update-verification.json

diff --git a/docs/releases/2026-10-13-laptop-ready/README.md b/docs/releases/2026-10-13-laptop-ready/README.md
index b8b0a1e..db150a2 100644
--- a/docs/releases/2026-10-13-laptop-ready/README.md
+++ b/docs/releases/2026-10-13-laptop-ready/README.md
@@ -22,6 +22,10 @@ laptop diagnostics.
 
 Independent final integration review found no actionable issues and verified all
 19 signed runtime payload files against source bytes/modes and the pinned key.
+After publication, [public update verification](public-update-verification.json)
+discovered the signed release through the normal HTTPS path, checked it against
+the image's pinned key, and verified installation of all 19 files, CLI startup,
+exact rollback and replay rejection in a separate staging root.
 
 The final [artifact record](artifacts.json), [whole-disk report](whole-disk-acceptance.json)
 and [laptop report](laptop-acceptance.json) identify the exact ISO, firmware and
diff --git a/docs/releases/2026-10-13-laptop-ready/artifacts.json b/docs/releases/2026-10-13-laptop-ready/artifacts.json
index 3097e20..675f995 100644
--- a/docs/releases/2026-10-13-laptop-ready/artifacts.json
+++ b/docs/releases/2026-10-13-laptop-ready/artifacts.json
@@ -75,6 +75,11 @@
       "name": "rootfs-manifest.json",
       "size": 142178,
       "sha256": "126c66d84b7c2160a517cbd0c3649630982a4d734e113ecdd6ee48e0859f1630"
+    },
+    {
+      "name": "public-update-verification.json",
+      "size": 665,
+      "sha256": "7d5df66c6f13b1638abf0de9e280338755520b2eb020f54d33a4a19d6731746b"
     }
   ]
 }
diff --git a/docs/releases/2026-10-13-laptop-ready/public-update-verification.json b/docs/releases/2026-10-13-laptop-ready/public-update-verification.json
new file mode 100644
index 0000000..a8c31af
--- /dev/null
+++ b/docs/releases/2026-10-13-laptop-ready/public-update-verification.json
@@ -0,0 +1,16 @@
+{
+  "status": "passed",
+  "source_commit": "ebeebc7fb1aed07a5f50bc62374365d614953dad",
+  "version": "0.2.0",
+  "sequence": 1,
+  "archive_url": "https://git.shanaty.ru/Emil_Shanaty/Hydra-OS/raw/branch/main/releases/stable/runtime.zip",
+  "archive_sha256": "9284edd5de37f621955189f3d317ebcfa76f60a4b6e1f481361b6aad1967f4f8",
+  "public_artifacts_match_local_signed_candidate": true,
+  "signature_verified_against_image_pinned_key": true,
+  "staging_apply_all_files_and_modes": 19,
+  "staging_cli_help": "passed",
+  "staging_rollback_exact_originals": true,
+  "staging_replay_refused": true,
+  "actual_system_mutated": false,
+  "recorded_utc": "2026-10-13T20:51:13Z"
+}
diff --git a/docs/superpowers/plans/2026-10-13-laptop-ready.md b/docs/superpowers/plans/2026-10-13-laptop-ready.md
index 5c48ecc..c1d792c 100644
--- a/docs/superpowers/plans/2026-10-13-laptop-ready.md
+++ b/docs/superpowers/plans/2026-10-13-laptop-ready.md
@@ -101,7 +101,7 @@ or helper as needed, CLI wiring and docs; do not edit these while other tasks do
 - [x] Run focused fixes only for observed failures, rerun affected acceptance.
 - [x] Verify exact release files, checksums, source revisions and absence of secrets.
 - [x] Complete final independent branch review.
-- [ ] Integrate and publish authorized source/artifacts using available authenticated
+- [x] Integrate and publish authorized source/artifacts using available authenticated
   transport; report any unavailable publishing action.
 - [x] Report physical checks still requiring live laptop boot, not unsupported success.
 
@@ -112,6 +112,7 @@ Implementation and scoped reviews are complete through source
 431 tests in 26.048 seconds. Independent final review is complete. The final ISO
 passed the unchanged whole-disk harness (13 checks) and laptop/recovery harness
 (23 checks), with no skips. Exact artifact identities and public evidence passed
-review. Publication is the only remaining delivery step; physical checks remain
-operator work after live laptop boot.
+review. Source and signed artifacts are published in the public repository.
+Actual public discovery, signature verification, staging apply/rollback and replay
+rejection passed. Physical checks remain operator work after live laptop boot.
 See the [release record](../../releases/2026-10-13-laptop-ready/README.md).