{ "schemaVersion": "1.0", "title": "Release artifacts and verification", "description": "Use this page to distinguish artifacts that identify the recorded v1.0.0 source release from artifacts that the later, unreleased workflow is designed to produce. Never infer an image, signature, SBOM, attestation, or private package from t", "canonical": "https://getaip.org/docs/reference/release-artifacts", "route": "/docs/reference/release-artifacts", "source": "docs/reference/release-artifacts.md", "protocol": "Agent Interoperability Protocol", "protocolVersion": "1.0", "section": "Project and Releases", "documentType": "Reference", "language": "en", "downloads": { "md": "/docs/download/reference/release-artifacts.md", "txt": "/docs/download/reference/release-artifacts.txt", "json": "/docs/download/reference/release-artifacts.json", "pdf": "/docs/download/reference/release-artifacts.pdf" }, "content": { "format": "text/markdown", "markdown": "---\ntitle: Release artifacts and verification\ndescription: Verify the v1.0.0 source release and evaluate the unexecuted immutable-image pipeline separately\nkind: release-reference\naudience: evaluator\nappliesTo: \"1.x\"\nwritingStandard: \"aip-docs/1.0\"\nlastReviewedRevision: \"97be86e9efedf07ecf1783b03800f683f107fb04\"\n---\n\n# Release artifacts and verification\n\nUse this page to distinguish artifacts that identify the recorded `v1.0.0`\nsource release from artifacts that the later, unreleased workflow is designed\nto produce. Never infer an image, signature, SBOM, attestation, or private\npackage from the presence of its workflow definition.\n\n| Evidence state | What exists in the reviewed source |\n| --- | --- |\n| Recorded release identity | Annotated `v1.0.0` tag, exact commit and tree, source-snapshot metadata, changelog, 52 native schemas, and legal files |\n| Defined for a future tag | Thirteen multi-platform image jobs, source-boundary inventories, image digest files, Cosign verification records, SBOMs, and provenance attestations |\n| Not established by this review | A run of that workflow, published image digests, registry contents, signed source tag, permanent evidence catalog, source-archive checksum, or private SDK packages |\n\nThe repository and workflows were inspected at source revision\n`97be86e9efedf07ecf1783b03800f683f107fb04`. No release job, registry, service,\nor remote publication was executed or queried.\n\n## Inventory the actual 1.0.0 source release\n\nThe source release is identified by Git objects, not by a container or package\nmanifest.\n\n| Artifact | Exact identity or state |\n| --- | --- |\n| Annotated tag | `v1.0.0`; tag object `270ffb55d6f239c42d3487a6842a011d4a7f8d2a` |\n| Commit | `034a520608eea44e6b14e61c34734bd402d989c0` |\n| Tree | `0784fbb30a9795e3098eb2498126d9ddccde243d` |\n| Source snapshot | `SOURCE_SNAPSHOT.json`; SHA-256 `45e905fbc83e710e8a7261ccb8f940f92ad083197430a10cabf44e922b74bcd2` |\n| Changelog | `CHANGELOG`; release date 21 July 2026 |\n| Native schemas | `52` files under `schemas/aip` |\n| Legal set | `LICENSE`, `NOTICE`, and `THIRD_PARTY_NOTICES` |\n| Publication shape | Private clean-root source snapshot with one Markdown file |\n\nThe tag object is annotated but contains no embedded cryptographic signature.\nGit object IDs detect content changes inside a trusted object database; they do\nnot authenticate the publisher by themselves.\n\nThe tag contains neither `.github/workflows/release.yml` nor\n`private-sdk-release.json`. It records no canonical source-archive checksum,\nimage digest manifest, SBOM, provenance statement, Cosign verification record,\nor registry package identity. Do not attach artifacts from the post-tag\nworkflow to `v1.0.0` retrospectively.\n\n### Verify the local source identity\n\nRun these read-only checks in a trusted clone that contains the tag:\n\n```sh\ntest \"$(git rev-parse v1.0.0^{tag})\" = \\\n \"270ffb55d6f239c42d3487a6842a011d4a7f8d2a\"\ntest \"$(git rev-parse v1.0.0^{commit})\" = \\\n \"034a520608eea44e6b14e61c34734bd402d989c0\"\ntest \"$(git rev-parse v1.0.0^{tree})\" = \\\n \"0784fbb30a9795e3098eb2498126d9ddccde243d\"\ngit show v1.0.0:SOURCE_SNAPSHOT.json | sha256sum\n```\n\nThe final digest must be\n`45e905fbc83e710e8a7261ccb8f940f92ad083197430a10cabf44e922b74bcd2`.\nInspect the JSON and confirm its source revision, source tree, file count,\nexport method, normalization, license, and publication boundary before using\nthe source.\n\nIf an organization creates a source archive from the tag, record the archive\nformat, command, tool version, and SHA-256 as a new packaging artifact. The\nrepository does not provide a canonical archive digest to compare against.\n\n## Inventory the prospective image set\n\nThe pinned `immutable-release` workflow defines thirteen image jobs. They are\nsource intent for a future tag, not evidence that the images exist.\n\n| Group | Images defined by the workflow | Count |\n| --- | --- | ---: |\n| Platform and operator | Core daemon, migration bundle, connector control plane, and `aipctl` | 4 |\n| Public connector hosts | Cal.diy, Hermes Agent, Chatwoot, Dify, CrewAI, and Twenty hosts | 6 |\n| Product runtime | CrewAI Python sidecar | 1 |\n| Controlled qualification | Two validation-only host images, not public product connectors | 2 |\n| Total | All image matrix entries | 13 |\n\nEvery job targets `linux/amd64` and `linux/arm64`. The registry coordinate is\nderived as `ghcr.io//`. The workflow creates a version tag and a\nlong source-SHA tag; it does not create `latest`.\n\nThe six public host images correspond exactly to the maintained connector set.\nThe controlled qualification images must not appear in the public connector\ncatalog or be mistaken for supported products.\n\n## Understand the release gate\n\nImages depend on a source release gate that requires all of the following:\n\n1. The ref name is `v`.\n2. The checked-out commit equals the event SHA and the worktree is clean.\n3. Publication hygiene and the complete source release check pass.\n4. Generated native schemas leave no diff.\n5. Private-SDK and connector-repository boundaries are valid.\n6. Deterministic inventories for both repository boundaries are generated.\n\nThe source-boundary inventories are uploaded as one Actions artifact retained\nfor 90 days. A separate release-check workflow also runs the complete source\ngate and history secret scan, but the image workflow repeats the release gate\nbefore building images.\n\nManual dispatch does not bypass tag identity: the same ref-name and workspace\nversion checks still apply.\n\n## Understand each image result\n\nBefore building, the job rejects an existing remote version tag. A successful\njob then:\n\n1. builds one multi-platform image from the exact tagged checkout;\n2. writes OCI source, revision, and version labels;\n3. requests a BuildKit SBOM and maximum-mode provenance;\n4. pushes the version and long-SHA tags and captures the multi-platform digest;\n5. signs that digest keylessly with GitHub OIDC through Cosign;\n6. verifies the signature against the exact workflow identity and GitHub token\n issuer;\n7. publishes a GitHub build-provenance attestation to the registry;\n8. writes `.digest` and `.cosign-verification.json`;\n9. uploads both files as an Actions artifact retained for 90 days.\n\nThe workflow has no final job that combines all thirteen digests into one\nsigned release manifest. It also does not create standalone binary archives,\na source archive, a package-registry release, or a release-page attachment.\n\n## Verify a published image result\n\nObtain the digest from the retained release evidence, not from a mutable image\ntag. Set the exact image, tag, and digest before verification:\n\n```sh\nTAG=\"v1.1.0\"\nIMAGE=\"ghcr.io/getaip/aipd-core\"\nDIGEST=\"sha256:\"\nIDENTITY=\"https://github.com/getaip/core/.github/workflows/release.yml@refs/tags/${TAG}\"\n\ndocker buildx imagetools inspect \"${IMAGE}@${DIGEST}\"\ncosign verify \\\n --certificate-identity \"${IDENTITY}\" \\\n --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" \\\n --output json \\\n \"${IMAGE}@${DIGEST}\"\n```\n\nDo not accept a successful tag lookup as digest verification. Compare the\nresolved index digest with the retained `.digest` file, then verify:\n\n- both required platform manifests;\n- the OCI source, revision, and version labels;\n- the keyless signature identity and issuer;\n- the BuildKit SBOM and provenance linked to the exact subject digest;\n- the GitHub build-provenance attestation subject and source revision;\n- the corresponding source-boundary inventories and clean tagged tree.\n\nStore the verification output with the release record. A later registry\nlookup does not replace the evidence captured when the release was accepted.\n\n## Promote ephemeral evidence to a durable catalog\n\nThe workflow's inventory, digest, and Cosign verification artifacts expire\nafter 90 days. General Gitea CI retains boundary and qualification artifacts\nfor 30 days; those CI runs are not substitutes for a tagged release record.\n\nBefore accepting a future release, assemble a durable, access-controlled\ncatalog containing:\n\n- tag object, commit, tree, workspace version, and source-snapshot identity;\n- source-boundary inventory JSON and its checksum;\n- one row for every expected image with name, platforms, digest, and labels;\n- Cosign verification JSON, SBOM, provenance, and build attestation for each\n image digest;\n- release-gate and secret-scan run identities and terminal states;\n- license and third-party notice checksums;\n- applicable conformance and qualification evidence identities;\n- missing, failed, skipped, superseded, or revoked artifact records.\n\nSign or otherwise integrity-protect the catalog itself. A directory of\nunsigned digest files cannot prove that the expected set is complete.\n\n## Keep private SDK publication separate\n\nThe pinned source defines an inventory order for 24 private SDK packages and a\n12-package connector repository boundary. It does not enable publication:\n\n```text\npublication_mode = disabled_until_registry_bootstrap\nminimum_verified_private_sdk_releases = 2\n```\n\nAll reviewed workspace packages remain `publish = false`. Generated inventory\nJSON proves a selected source boundary; it is not a package archive, registry\nentry, signature, or successful private SDK release.\n\n## Accept or reject an artifact set\n\nAccept a future immutable-image release only when:\n\n- the semantic version tag, commit, tree, and workspace version agree;\n- the source gate and boundary inventories are complete;\n- all thirteen expected workflow jobs have exact digests;\n- every accepted image has both required platforms, correct labels, verified\n signature, SBOM, provenance, and build attestation;\n- the durable catalog covers the complete set and survives CI retention;\n- conformance and product qualification claims cite their own exact artifacts;\n- no evidence is borrowed from `v1.0.0` or another source revision.\n\nOtherwise report the artifact set as incomplete or unverified. Do not replace\na missing signature, digest, platform, inventory, or qualification result with\nthe statement that its workflow is present.\n\n## Related documentation\n\n- [Release notes](release-notes.md)\n- [Licensing](licensing.md)\n- [Implementation status](implementation-status.md)\n- [Testing and qualification](../testing/README.md)\n- [Production deployment](../guides/production-deployment.md)\n", "text": "Release artifacts and verification\n\nUse this page to distinguish artifacts that identify the recorded v1.0.0\nsource release from artifacts that the later, unreleased workflow is designed\nto produce. Never infer an image, signature, SBOM, attestation, or private\npackage from the presence of its workflow definition.\n\n| Evidence state | What exists in the reviewed source |\n\n| Recorded release identity | Annotated v1.0.0 tag, exact commit and tree, source-snapshot metadata, changelog, 52 native schemas, and legal files |\n| Defined for a future tag | Thirteen multi-platform image jobs, source-boundary inventories, image digest files, Cosign verification records, SBOMs, and provenance attestations |\n| Not established by this review | A run of that workflow, published image digests, registry contents, signed source tag, permanent evidence catalog, source-archive checksum, or private SDK packages |\n\nThe repository and workflows were inspected at source revision\n97be86e9efedf07ecf1783b03800f683f107fb04. No release job, registry, service,\nor remote publication was executed or queried.\n\nInventory the actual 1.0.0 source release\n\nThe source release is identified by Git objects, not by a container or package\nmanifest.\n\n| Artifact | Exact identity or state |\n\n| Annotated tag | v1.0.0; tag object 270ffb55d6f239c42d3487a6842a011d4a7f8d2a |\n| Commit | 034a520608eea44e6b14e61c34734bd402d989c0 |\n| Tree | 0784fbb30a9795e3098eb2498126d9ddccde243d |\n| Source snapshot | SOURCESNAPSHOT.json; SHA-256 45e905fbc83e710e8a7261ccb8f940f92ad083197430a10cabf44e922b74bcd2 |\n| Changelog | CHANGELOG; release date 21 July 2026 |\n| Native schemas | 52 files under schemas/aip |\n| Legal set | LICENSE, NOTICE, and THIRDPARTYNOTICES |\n| Publication shape | Private clean-root source snapshot with one Markdown file |\n\nThe tag object is annotated but contains no embedded cryptographic signature.\nGit object IDs detect content changes inside a trusted object database; they do\nnot authenticate the publisher by themselves.\n\nThe tag contains neither .github/workflows/release.yml nor\nprivate-sdk-release.json. It records no canonical source-archive checksum,\nimage digest manifest, SBOM, provenance statement, Cosign verification record,\nor registry package identity. Do not attach artifacts from the post-tag\nworkflow to v1.0.0 retrospectively.\n\nVerify the local source identity\n\nRun these read-only checks in a trusted clone that contains the tag:\n\ntest \"$(git rev-parse v1.0.0^{tag})\" = \\\n \"270ffb55d6f239c42d3487a6842a011d4a7f8d2a\"\ntest \"$(git rev-parse v1.0.0^{commit})\" = \\\n \"034a520608eea44e6b14e61c34734bd402d989c0\"\ntest \"$(git rev-parse v1.0.0^{tree})\" = \\\n \"0784fbb30a9795e3098eb2498126d9ddccde243d\"\ngit show v1.0.0:SOURCESNAPSHOT.json | sha256sum\n\nThe final digest must be\n45e905fbc83e710e8a7261ccb8f940f92ad083197430a10cabf44e922b74bcd2.\nInspect the JSON and confirm its source revision, source tree, file count,\nexport method, normalization, license, and publication boundary before using\nthe source.\n\nIf an organization creates a source archive from the tag, record the archive\nformat, command, tool version, and SHA-256 as a new packaging artifact. The\nrepository does not provide a canonical archive digest to compare against.\n\nInventory the prospective image set\n\nThe pinned immutable-release workflow defines thirteen image jobs. They are\nsource intent for a future tag, not evidence that the images exist.\n\n| Group | Images defined by the workflow | Count |\n\n| Platform and operator | Core daemon, migration bundle, connector control plane, and aipctl | 4 |\n| Public connector hosts | Cal.diy, Hermes Agent, Chatwoot, Dify, CrewAI, and Twenty hosts | 6 |\n| Product runtime | CrewAI Python sidecar | 1 |\n| Controlled qualification | Two validation-only host images, not public product connectors | 2 |\n| Total | All image matrix entries | 13 |\n\nEvery job targets linux/amd64 and linux/arm64. The registry coordinate is\nderived as ghcr.io//. The workflow creates a version tag and a\nlong source-SHA tag; it does not create latest.\n\nThe six public host images correspond exactly to the maintained connector set.\nThe controlled qualification images must not appear in the public connector\ncatalog or be mistaken for supported products.\n\nUnderstand the release gate\n\nImages depend on a source release gate that requires all of the following:\n1. The ref name is v.\n2. The checked-out commit equals the event SHA and the worktree is clean.\n3. Publication hygiene and the complete source release check pass.\n4. Generated native schemas leave no diff.\n5. Private-SDK and connector-repository boundaries are valid.\n6. Deterministic inventories for both repository boundaries are generated.\n\nThe source-boundary inventories are uploaded as one Actions artifact retained\nfor 90 days. A separate release-check workflow also runs the complete source\ngate and history secret scan, but the image workflow repeats the release gate\nbefore building images.\n\nManual dispatch does not bypass tag identity: the same ref-name and workspace\nversion checks still apply.\n\nUnderstand each image result\n\nBefore building, the job rejects an existing remote version tag. A successful\njob then:\n1. builds one multi-platform image from the exact tagged checkout;\n2. writes OCI source, revision, and version labels;\n3. requests a BuildKit SBOM and maximum-mode provenance;\n4. pushes the version and long-SHA tags and captures the multi-platform digest;\n5. signs that digest keylessly with GitHub OIDC through Cosign;\n6. verifies the signature against the exact workflow identity and GitHub token\n issuer;\n7. publishes a GitHub build-provenance attestation to the registry;\n8. writes .digest and .cosign-verification.json;\n9. uploads both files as an Actions artifact retained for 90 days.\n\nThe workflow has no final job that combines all thirteen digests into one\nsigned release manifest. It also does not create standalone binary archives,\na source archive, a package-registry release, or a release-page attachment.\n\nVerify a published image result\n\nObtain the digest from the retained release evidence, not from a mutable image\ntag. Set the exact image, tag, and digest before verification:\n\nTAG=\"v1.1.0\"\nIMAGE=\"ghcr.io/getaip/aipd-core\"\nDIGEST=\"sha256:\"\nIDENTITY=\"https://github.com/getaip/core/.github/workflows/release.yml@refs/tags/${TAG}\"\n\ndocker buildx imagetools inspect \"${IMAGE}@${DIGEST}\"\ncosign verify \\\n --certificate-identity \"${IDENTITY}\" \\\n --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" \\\n --output json \\\n \"${IMAGE}@${DIGEST}\"\n\nDo not accept a successful tag lookup as digest verification. Compare the\nresolved index digest with the retained .digest file, then verify:\n• both required platform manifests;\n• the OCI source, revision, and version labels;\n• the keyless signature identity and issuer;\n• the BuildKit SBOM and provenance linked to the exact subject digest;\n• the GitHub build-provenance attestation subject and source revision;\n• the corresponding source-boundary inventories and clean tagged tree.\n\nStore the verification output with the release record. A later registry\nlookup does not replace the evidence captured when the release was accepted.\n\nPromote ephemeral evidence to a durable catalog\n\nThe workflow's inventory, digest, and Cosign verification artifacts expire\nafter 90 days. General Gitea CI retains boundary and qualification artifacts\nfor 30 days; those CI runs are not substitutes for a tagged release record.\n\nBefore accepting a future release, assemble a durable, access-controlled\ncatalog containing:\n• tag object, commit, tree, workspace version, and source-snapshot identity;\n• source-boundary inventory JSON and its checksum;\n• one row for every expected image with name, platforms, digest, and labels;\n• Cosign verification JSON, SBOM, provenance, and build attestation for each\n image digest;\n• release-gate and secret-scan run identities and terminal states;\n• license and third-party notice checksums;\n• applicable conformance and qualification evidence identities;\n• missing, failed, skipped, superseded, or revoked artifact records.\n\nSign or otherwise integrity-protect the catalog itself. A directory of\nunsigned digest files cannot prove that the expected set is complete.\n\nKeep private SDK publication separate\n\nThe pinned source defines an inventory order for 24 private SDK packages and a\n12-package connector repository boundary. It does not enable publication:\n\npublicationmode = disableduntilregistrybootstrap\nminimumverifiedprivatesdkreleases = 2\n\nAll reviewed workspace packages remain publish = false. Generated inventory\nJSON proves a selected source boundary; it is not a package archive, registry\nentry, signature, or successful private SDK release.\n\nAccept or reject an artifact set\n\nAccept a future immutable-image release only when:\n• the semantic version tag, commit, tree, and workspace version agree;\n• the source gate and boundary inventories are complete;\n• all thirteen expected workflow jobs have exact digests;\n• every accepted image has both required platforms, correct labels, verified\n signature, SBOM, provenance, and build attestation;\n• the durable catalog covers the complete set and survives CI retention;\n• conformance and product qualification claims cite their own exact artifacts;\n• no evidence is borrowed from v1.0.0 or another source revision.\n\nOtherwise report the artifact set as incomplete or unverified. Do not replace\na missing signature, digest, platform, inventory, or qualification result with\nthe statement that its workflow is present.\n\nRelated documentation\n• Release notes (release-notes.md)\n• Licensing (licensing.md)\n• Implementation status (implementation-status.md)\n• Testing and qualification (../testing/README.md)\n• Production deployment (../guides/production-deployment.md)\n" }, "integrity": { "algorithm": "sha256", "sourceDigest": "ee073ee3a411d14de9596734deab276c9b2c75c907ecd4a5ee062d8794725d57" } }