fix(release): use deterministic alpha.8 compatibility fixture #38

Merged

ochenstarik-ui merged 1 commit from hermes/alpha8-compat-fixture into main

2026-08-13 06:22:49 +00:00

ochenstarik-ui commented

2026-08-12 18:03:26 +00:00

(Migrated from github.com)

Summary

replace the network-dependent alpha.8 release check with a deterministic synthetic fixture matching smm-bootstrap-manifest/v1
prove unsigned v1 payloads fail closed unless SMM_ALLOW_UNSIGNED=1 is explicitly set
update the alpha.12 version sources and all README translations
document the alpha.8 orphan-signature anomaly, burned alpha.10/alpha.11 tags, pre-tag workflow dispatch, and release-file ownership
make the local Cosign key test deterministic without weakening the production keyless path

TDD evidence

RED: ALPHA8_V1_FIXTURE_RED_EXIT=1 before the fixture existed
GREEN: manifest verification passes strict-reject and explicit-bypass scenarios
GREEN: RELEASE_CONTRACT=PASS

Local verification

bash tests/bootstrap/test-manifest-verification.sh
bash tests/bootstrap/test-release-contract.sh
Bash syntax checks for changed shell scripts
dotnet test tests/ServerMonitorManager.Control.Tests/ServerMonitorManager.Control.Tests.csproj --configuration Release — 120/120 passed
git diff --cached --check

Release sequencing

No alpha.12 tag exists. The Release pipeline will be run with workflow_dispatch on this branch and verified before any immutable tag is created.

## Summary - replace the network-dependent alpha.8 release check with a deterministic synthetic fixture matching `smm-bootstrap-manifest/v1` - prove unsigned v1 payloads fail closed unless `SMM_ALLOW_UNSIGNED=1` is explicitly set - update the alpha.12 version sources and all README translations - document the alpha.8 orphan-signature anomaly, burned alpha.10/alpha.11 tags, pre-tag workflow dispatch, and release-file ownership - make the local Cosign key test deterministic without weakening the production keyless path ## TDD evidence - RED: `ALPHA8_V1_FIXTURE_RED_EXIT=1` before the fixture existed - GREEN: manifest verification passes strict-reject and explicit-bypass scenarios - GREEN: `RELEASE_CONTRACT=PASS` ## Local verification - `bash tests/bootstrap/test-manifest-verification.sh` - `bash tests/bootstrap/test-release-contract.sh` - Bash syntax checks for changed shell scripts - `dotnet test tests/ServerMonitorManager.Control.Tests/ServerMonitorManager.Control.Tests.csproj --configuration Release` — 120/120 passed - `git diff --cached --check` ## Release sequencing No alpha.12 tag exists. The Release pipeline will be run with `workflow_dispatch` on this branch and verified before any immutable tag is created.