# Local release verification

Run from this repository on Linux with Python 3.11+ and `uv`:

```sh
python3 tools/verify_release.py --output /tmp/rclk-release-UNIQUE
```

The output directory must not already exist. Temporary keys, virtual environments
and build trees are removed at exit. The output retains `verification.json` and
`runtime.cdx.json`; it does not publish or deploy a package. Package downloads may
require registry access. No production credentials or host clock changes are used.

The verifier performs:

1. Byte comparison of the three packaged JSON schemas against `specs/`.
2. A fresh build environment installed from hash-pinned
   `tools/build-requirements.txt`, independently of runtime dependencies.
3. Two sdist/wheel builds from separate source roots with deliberately different
   mtimes and fixed `SOURCE_DATE_EPOCH=315532800`. The sdist explicitly includes
   source, project metadata and README; Hatchling also includes `.gitignore`.
   All four are represented in the input manifest; generated evidence is excluded.
4. A build from the actual checkout, which must match both copied-source builds.
5. A fresh runtime environment installed from the hash-bearing locked runtime
   requirements plus the built wheel, followed by `uv pip check`.
6. An isolated (`python -I`) smoke check outside the checkout: installed-package
   import, schema presence, CLI startup, a signed HTTP exchange with a disposable
   authority, wrong-key refusal, and sanitized CLI failure on unusable health.
7. Installed distribution/version comparison against `uv.lock` and a CycloneDX
   runtime component inventory. Build dependencies are listed separately in the
   receipt; neither development dependencies nor build tools enter the runtime.

Build constraints can be deliberately refreshed with:

```sh
uv pip compile tools/build-requirements.in --generate-hashes -o tools/build-requirements.txt
```

Review that diff and rerun verification after a refresh. Normal verification
uses the committed pins and does not resolve newer build versions. Runtime
installation similarly uses `uv export --locked` and verifies archive hashes.

## Retained evidence

The September 28 run is in
[evidence/2026-09-28-release/verification.json](evidence/2026-09-28-release/verification.json)
and its [runtime SBOM](evidence/2026-09-28-release/runtime.cdx.json).
The receipt records source-input hashes, lock/build-requirement hashes, verifier
hashes, Python/uv/build-tool versions, artifact digests and smoke checks. Its base
commit identifies the checkout before the verification changes were committed;
the input manifest identifies the exact built contents, including pending edits.

This demonstrates repeatability on the recorded Linux/Python toolchain. It does
not establish reproducibility on other platforms/interpreters, native UTC accuracy,
consumer admission, deployment, license clearance or absence of vulnerabilities.
The component inventory covers installed Python distributions, not system libraries
or native libraries embedded inside third-party wheels. Build timestamps are
normalized metadata and are never used as trusted time.

The [acceptance coverage map](acceptance-coverage.md) distinguishes local checks
from unproven native obligations. RCLK-WP-0003-T03 owns this package evidence;
existing 0002/0004/0005 records retain owner acceptance and deployment gates.