feat(releases): scaffold releases.hal0.dev publishing path

[thinmintdev]

Summary

Stand up the receiving end for https://releases.hal0.dev/{channel}.json — the URL the hal0 self-updater (src/hal0/updater/updater.py) defaults to. Currently a v1 RC blocker (hal0ai/hal0 task #14) because the host doesn't exist.

• public/releases/stable.json + public/releases/nightly.json — schema-valid hal0.releases.v1 placeholders, flagged _placeholder: true with all-zeros sha256 sentinels. They parse cleanly through ReleaseManifest.model_validate but will fail cosign verify-blob if anything tries to apply() them — intentional, until release.yml in hal0ai/hal0 starts publishing real manifests.
• public/_headers — Cloudflare Pages headers config: Cache-Control: public, max-age=60 + Access-Control-Allow-Origin: * on /releases/*. Short cache so a freshly-tagged release propagates within a minute.
• public/_redirects — host-conditional rewrite (https://releases.hal0.dev/* /releases/:splat 200) so the subdomain serves dist/releases/* without polluting the marketing-site root with channel manifests. The path-based canonical (https://hal0.dev/releases/stable.json) keeps working unchanged.
• README.md — new "Release manifest hosting" section: where the JSON lives, both URL forms, CF Pages + DNS one-time setup (CNAME records for hal0.dev + releases.hal0.dev), and the publish workflow that release.yml in hal0ai/hal0 will follow.

Why subdomain (no updater code change)

hal0.updater.updater.releases_url() defaults to https://releases.hal0.dev/{channel}.json. The _redirects rewrite means we keep that default and don't have to ship a coordinated client patch. Path form (hal0.dev/releases/...) is also live as a fallback / debugging URL.

DRAFT — do not merge

Draft because:

• DNS is not cut over yet (no CNAME exists for releases.hal0.dev, and hal0.dev is still pre-deploy per the existing README).
• CF Pages project is not provisioned yet — the README documents the steps but does not execute them.
• Once release.yml lands in hal0ai/hal0 and the first real tag publishes, the placeholder manifests get overwritten by that workflow.

Marketing pages are untouched — only the new public/releases/ path, public/_headers, public/_redirects, and a README section addition.

Test plan

• npm run build — completes; dist/releases/{stable,nightly}.json, dist/_headers, dist/_redirects all present.
• Both manifests parse through hal0.updater.updater.ReleaseManifest.model_validate (schema OK, version 0.0.0, channels match).
• After CF Pages provision: curl -s https://releases.hal0.dev/stable.json | jq . returns the placeholder.
• After CF Pages provision: curl -sI https://releases.hal0.dev/stable.json shows cache-control: public, max-age=60 and CORS header.
• After release.yml ships in hal0ai/hal0: tagging a release auto-overwrites public/releases/stable.json via PR/deploy-key from that workflow.

Companion docs change in hal0ai/hal0 on branch docs/releases-host-2026-05-15.

Refs: hal0ai/hal0 task #14.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hal0-web	Ready	Preview, Comment	May 16, 2026 1:37am