Qualify the v1.1 Candidate on physical amd64 and arm64

[BrettKinny]

This was generated by AI during triage.

Type: HITL

What to build

Perform the final physical-hardware qualification of one v1.1 Candidate digest on both amd64 and arm64, verify the signed release assets and lifecycle identity, and record the promotion decision. This is the human gate after platform-specific UAT; both machines must pull the same manifest digest and no image rebuild is permitted between qualification and promotion.

Acceptance criteria

• Record the Candidate version, source SHA, multi-architecture digest, both host/runtime versions, and links to the completed platform UAT issues.
• Pull the published Candidate by digest on physical amd64 and physical arm64 hardware and confirm each native image starts.
• On both architectures, release.json, the version file, MOTD, checked-out source ref/SHA, image repository, and digest agree.
• Verify every release asset against SHA256SUMS, the checksum Sigstore bundle against the exact workflow/tag identity, and the image identity signature.
• Run fresh and retained-home Compose flows against the digest on both architectures; Workspace and Managed-home state persist through force recreation.
• Confirm stable installers cannot discover this Release before all required Evidence and assets pass.
• Confirm the published Evidence report contains every required amd64/arm64 scan, lifecycle, setup, update, Podman, Compose, and PowerShell assertion.
• Promote the exact tested digest without rebuilding; version aliases and GHCR/GitHub latest identify the greatest stable version.
• Rerun an older stable workflow or equivalent dry-run check and confirm it cannot rewind either latest pointer.
• Record an explicit promote/no-promote decision and any follow-up defects in this issue.

Blocked by

• Validate v1.1 Linux Docker and interactive setup #99
• Validate v1.1 rootless Podman on Fedora SELinux #100
• Validate v1.1 on macOS Docker Desktop #101
• Validate v1.1 Windows PowerShell and Git Bash lifecycle #102
• Validate v1.1 Dev Containers and Codespaces #103

[BrettKinny]

This was generated by AI during triage.

The stable publication gate is now implemented and configured: the final-version workflow prepares and verifies a non-discoverable draft, then the publish-release job waits on the protected v1.1-production environment. BrettKinny is the required reviewer. Approve that deployment only after the platform UAT dependencies and both-architecture physical checks in this issue pass; approval publishes the exact prepared digest and assets without rebuilding. Record the workflow/deployment URL with the promote or no-promote decision. Prerelease publication remains automatic through the separate unprotected environment.

[BrettKinny]

This was generated by AI during triage.

Release qualification now has three explicit repository controls: immutable Releases are enabled; the active Protect release tags ruleset blocks v* updates and deletions with no bypass actors; and stable publication waits for BrettKinny approval on v1.1-production. Before approval, record the peeled remote tag SHA and confirm it equals the Candidate source SHA, download and verify the draft assets, and confirm the controls remain active. Approve v1.1-production only after #99-#104 and both physical architectures pass. After publication, require gh release verify for the GitHub immutable-Release attestation and verify both GitHub and GHCR latest still identify the greatest stable SemVer. The local UAT checklist now carries these exact steps.

[BrettKinny]

Partial final-candidate evidence for v1.1.0-rc8. Explicit decision: NO-PROMOTE to stable yet. This issue remains open.

Candidate identity:

• Version: v1.1.0-rc8
• Source SHA: 09b80b6
• Multi-architecture digest: sha256:6252490bab55ca56747f1c540efaef801b6a3ba197220ba3552a0b5eccfd1c51
• Release: https://github.com/SquareWaveSystems/squarebox/releases/tag/v1.1.0-rc8
• Qualification run: https://github.com/SquareWaveSystems/squarebox/actions/runs/29489931250

Release qualification completed:

• Candidate E2E passed amd64 and arm64 smoke, both architecture security scans, image lifecycle, rootless Podman, Compose recreation, PowerShell static checks, module tests, assertion-backed report, exact architecture verification, signing, asset verification, and publication.
• gh release verify confirmed the immutable GitHub Release attestation.
• Downloaded release.json matched SHA256SUMS and passed the repository release-identity validator.
• Tower pulled and deployed the exact release.json digest on physical amd64 without rebuilding.
• Unraid 7.3.1 x86_64 with Docker 29.5.2 retained Managed-home and Workspace state across force recreation and restart; VERSION and image metadata remained v1.1.0-rc8.

Not yet satisfied:

• No physical arm64 host has qualified this digest. The green arm64 paths above use GitHub-hosted QEMU/emulation.
• Platform UAT dependencies Validate v1.1 Linux Docker and interactive setup #99 through Regenerate the v1.1 setup demo #104 remain open.
• Stable alias promotion and historical stable rerun protection have therefore not been exercised as the final human gate.

Decision: keep RC8 as a prerelease and do not approve stable v1.1.0 promotion until the remaining platform UAT and physical arm64 checks pass.