Record successful public signed update delivery and recovery verification

2026-10-13 23:51:31 +03:00
parent 6855c62ba1
commit c331f4f26f
4 changed files with 29 additions and 3 deletions
@@ -22,6 +22,10 @@ laptop diagnostics.

 Independent final integration review found no actionable issues and verified all
 19 signed runtime payload files against source bytes/modes and the pinned key.
+After publication, [public update verification](public-update-verification.json)
+discovered the signed release through the normal HTTPS path, checked it against
+the image's pinned key, and verified installation of all 19 files, CLI startup,
+exact rollback and replay rejection in a separate staging root.

 The final [artifact record](artifacts.json), [whole-disk report](whole-disk-acceptance.json)
 and [laptop report](laptop-acceptance.json) identify the exact ISO, firmware and
@@ -75,6 +75,11 @@
      "name": "rootfs-manifest.json",
      "size": 142178,
      "sha256": "126c66d84b7c2160a517cbd0c3649630982a4d734e113ecdd6ee48e0859f1630"
+    },
+    {
+      "name": "public-update-verification.json",
+      "size": 665,
+      "sha256": "7d5df66c6f13b1638abf0de9e280338755520b2eb020f54d33a4a19d6731746b"
    }
  ]
 }
@@ -0,0 +1,16 @@
+{
+  "status": "passed",
+  "source_commit": "ebeebc7fb1aed07a5f50bc62374365d614953dad",
+  "version": "0.2.0",
+  "sequence": 1,
+  "archive_url": "https://git.shanaty.ru/Emil_Shanaty/Hydra-OS/raw/branch/main/releases/stable/runtime.zip",
+  "archive_sha256": "9284edd5de37f621955189f3d317ebcfa76f60a4b6e1f481361b6aad1967f4f8",
+  "public_artifacts_match_local_signed_candidate": true,
+  "signature_verified_against_image_pinned_key": true,
+  "staging_apply_all_files_and_modes": 19,
+  "staging_cli_help": "passed",
+  "staging_rollback_exact_originals": true,
+  "staging_replay_refused": true,
+  "actual_system_mutated": false,
+  "recorded_utc": "2026-10-13T20:51:13Z"
+}
@@ -101,7 +101,7 @@ or helper as needed, CLI wiring and docs; do not edit these while other tasks do
 - [x] Run focused fixes only for observed failures, rerun affected acceptance.
 - [x] Verify exact release files, checksums, source revisions and absence of secrets.
 - [x] Complete final independent branch review.
- [ ] Integrate and publish authorized source/artifacts using available authenticated
+- [x] Integrate and publish authorized source/artifacts using available authenticated
  transport; report any unavailable publishing action.
 - [x] Report physical checks still requiring live laptop boot, not unsupported success.

@@ -112,6 +112,7 @@ Implementation and scoped reviews are complete through source
 431 tests in 26.048 seconds. Independent final review is complete. The final ISO
 passed the unchanged whole-disk harness (13 checks) and laptop/recovery harness
 (23 checks), with no skips. Exact artifact identities and public evidence passed
-review. Publication is the only remaining delivery step; physical checks remain
-operator work after live laptop boot.
+review. Source and signed artifacts are published in the public repository.
+Actual public discovery, signature verification, staging apply/rollback and replay
+rejection passed. Physical checks remain operator work after live laptop boot.
 See the [release record](../../releases/2026-10-13-laptop-ready/README.md).