Verify reproducible release artifacts and map acceptance evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f0-a6f6-7b93-9124-55ef584930e2
This commit is contained in:
tegwick 2026-09-28 10:22:52 +02:00
parent c976c9c277
commit c29bf39b5d
13 changed files with 577 additions and 3 deletions

View file

@ -11,7 +11,7 @@ depends_on:
owner: codex
topic_slug: custodian
created: "2026-09-14"
updated: "2026-09-24"
updated: "2026-09-28"
depends_on_workplans:
- RCLK-WP-0002
state_hub_workstream_id: "904e08b5-978f-5bfc-b543-ca5347a56ac5"
@ -63,3 +63,16 @@ records and are not leftovers of this plan. `RCLK-WP-0005` owns
infrastructure-as-code delivery. `RCLK-WP-0004` owns the railiance01 pilot and
the first consumer migration, and it waits on `RCLK-WP-0005` as well as this
plan.
### Release-evidence follow-up — 2026-09-28
T03 now has a repeatable [release verifier](../docs/release-verification.md),
hash-pinned build tools, independent byte-identical wheel/sdist build evidence,
an isolated installed-wheel signed HTTP/CLI smoke check, and a runtime SBOM.
The [acceptance coverage map](../docs/acceptance-coverage.md) explicitly records
that the original task prose exceeds current evidence: no local approval/CAS
concurrency fixture or historical event-translation test, and no complete native
platform or consumer proof. Finished status retains only the previously stated
reference boundary; those broader claims are not asserted. Existing
0002-T04/0004-T02/T03 and 0005 retain their owner/native gates.