| 1 | # Release candidates |
| 2 | |
| 3 | The protected `main-v2` control workflow prepares an immutable candidate after |
| 4 | reviewed Stable Notes are embedded. `Prepare release candidate` with `version` |
| 5 | builds the shared CLI/npm files, signs Desktop files, runs final-package native |
| 6 | acceptance, and seals a record. `Publish release candidate` accepts only that |
| 7 | record, checks its provenance and bytes, and requires one `release` approval |
| 8 | before creating the three tags and publishing. `recover` reuses the same sealed |
| 9 | files; it must not rebuild or sign them. |
| 10 | |
| 11 | For qualification without publication, dispatch `Prepare release candidate` on |
| 12 | protected `main-v2` with `version` and `rehearsal=true`. An already reviewed |
| 13 | version may be used for this isolated run. It uses separate |
| 14 | `release-candidate-rehearsal-*` artifacts, records `purpose=rehearsal`, and |
| 15 | cannot pass the normal publish resolver or payload verifier. The Desktop child |
| 16 | accepts the existing version tag only in this non-publishing mode. The run must |
| 17 | still complete source CI, signing, and native acceptance. It creates no tags, |
| 18 | GitHub Releases, npm packages, Homebrew updates, R2 pointers, or site changes. |
| 19 | |
| 20 | After sealing, run `Verify release candidate rehearsal` on `main-v2` with its |
| 21 | candidate ID. This independent workflow downloads the exact record and payload |
| 22 | artifact IDs. It checks the GitHub archive digest, protected producer run, |
| 23 | OIDC file attestations, sealed file digests, and native acceptance receipts. |
| 24 | Its 90-day report binds the producer and verifier runs without compiler or |
| 25 | signing credentials. The verifier proves reuse of the same signed bytes; it is |
| 26 | not a publication or a substitute for a later formal release's public checks. |
| 27 | |
| 28 | The candidate payload lasts 30 days and its record/evidence 90 days. If the |
| 29 | payload expires before publication, prepare a new candidate. The release |
| 30 | skill's public postflight remains the authority for tags, npm, Desktop |
| 31 | updates, Homebrew, and the hydrated website after an authorized publication. |
| 32 |