A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I2165

A released archive carries a provenance attestation the installer can check

Where it stands

devtask.issue

Readiness: complete completion is recorded and every required evidence token is present
Status: DONE
Can start: not now
Milestone: safe-self-update
Milestone status: ACTIVE
Wave: 0
Waiting on: none
Holds back: I2724
Behind it in all: 1
Evidence: 2 of 2

Moves

plan.transition

What it is

Objective: Attest each release archive in the publish job, verify the attestation in install.sh when the tooling is present, and state in docs/DISTRIBUTION.md what each install path verifies.
Why: Artifacts are checksummed, not signed: per-artifact sha256 and size sit in releases/<tag>.json and latest.json and are checked by verify_checksum in site/static/install.sh:478 (called at :706); SHA256SUMS is uploaded to the GitHub release (.github/workflows/release.yml). There is no signature, attestation or Sigstore, and docs/DISTRIBUTION.md:151-153 records that as deferred on purpose. A checksum fetched from the same origin as the archive proves integrity in transit, not provenance. The pack's premise that releases are signed is false, as is its premise that majordomus update is a self-updater: it regenerates provider projections (lib/update.sh:4), and there is no self-update command (docs/DISTRIBUTION.md:416-439). Lowest priority because the deferral is a recorded decision. Baseline audit of 2026-10-09 at master 1fb8d6be44, failure gap 12 and premises 1-2.
Now: install.sh verifies a checksum served beside the archive; provenance is not verifiable.
Wanted: The publish job attests each archive with GitHub artifact attestations; install.sh verifies the attestation when the gh tool is present and says which it verified, provenance or checksum only; docs/DISTRIBUTION.md states it.
Done when: unknown: the record declares no `completion`
Risk: unknown: the record declares no `risk`

Acceptance

Each archive of a release carries an attestation that gh attestation verify accepts for this repository
install.sh reports whether it verified provenance or only the checksum
docs/DISTRIBUTION.md names what each installation path verifies

Validation: bin/majordomus plan validateMJ_TEST_JOBS=4 bash test/run.sh 85_installer
Evidence required: attested_releaseinstaller_reports_verification_case
Evidence present: installer_reports_verification_caseattested_release

Scope

Touches: .github/workflows/release.ymlsite/static/install.shdocs/DISTRIBUTION.mdtest/cases/85_installer.sh
Not: unknown: the record declares no `non_scope`
Depends on: none
Priority: p1
Profile: implementation
Parallel safe: true
Owner: unknown: the record declares no `owner`

The work so far

Branches: none
Merged: none
Commits: 0
Trunk: master
Sessions: none
Created: 2026-10-09
Updated: 2026-10-14
Started: 2026-10-14T08:02:21Z
Verified: unknown: the record declares no `verified_at`
Completed: 2026-10-14T08:02:30Z

Synchronisation

Adapter: scripts/github-sync
Repository: unknown: the derived plan's header carries no repository
External issue: unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there: unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.