Qualify the final v1.2 Candidate on physical amd64 and arm64

[BrettKinny]

This was generated by AI during triage.

Type: HITL

Parent

• Release v1.2.1 from one qualified Candidate #125

What to build

Perform the final physical-hardware qualification of the protected v1.2.1
Candidate on amd64 and arm64, verify its signed Release assets and lifecycle
identity, and record the explicit promotion decision. Both machines must pull
the same multi-architecture digest and publication must reuse those exact
bytes.

Acceptance criteria

• Record the final version, source SHA, multi-architecture digest, both host/runtime versions, and links to every completed v1.2 platform qualification issue.
• Pull the Candidate by digest on physical amd64 and physical arm64 hardware and confirm both native images start.
• On both architectures, release.json, version file, MOTD, checked-out source ref/SHA, repository, and digest agree.
• Verify every asset against SHA256SUMS, the checksum Sigstore bundle against the exact workflow/tag identity, and the image identity signature.
• Run fresh and retained-home Compose flows on both architectures; Workspace and Managed-home data survive force recreation.
• Confirm stable installers cannot discover the draft before approval and that required assertion Evidence is complete.
• Confirm the active release-tag ruleset still rejects update/deletion and the peeled tag SHA equals the Candidate source SHA.
• Approve the protected stable environment only after all gates pass, publishing without rebuilding.
• Verify the immutable GitHub Release attestation plus GitHub and GHCR latest identities.
• Rerun an older stable workflow or equivalent dry-run and confirm neither latest pointer can rewind.
• Record an explicit promote/no-promote decision and follow-up defects here.

Blocked by

• Qualify v1.2 Linux Docker and interactive setup #126
• Qualify v1.2 rootless Podman on Fedora SELinux #127
• Qualify v1.2 on macOS Docker Desktop #128
• Qualify v1.2 Windows PowerShell and Git Bash lifecycle #129
• Validate v1.2 Dev Containers and Codespaces #130
• Regenerate the v1.2 setup demo #104

[BrettKinny]

This was generated by AI during triage.

Partial physical-hardware qualification completed for amd64 only. This is not a promotion approval.

Identity:

• Version/tag: v1.2.0
• Source SHA: d1b676b7475b855e912f98d51dad136ea4bb9b4b
• Candidate digest: sha256:39aece45244763c75122875d7722a1beac4f3cd1fcda84b29ebbf066ddf4884e
• Physical host: Arch Linux, x86_64, kernel 7.1.4-arch1-1, UID/GID 1000:1000
• Runtime: Docker Engine 29.6.2, Compose 5.3.1
• Candidate workflow: https://github.com/SquareWaveSystems/squarebox/actions/runs/30616998950

Passed on physical amd64:

• Pulled the Candidate by the exact digest; local inspection reports linux/amd64 and the exact repository digest.
• Native start reports x86_64; /usr/local/lib/squarebox/VERSION and MOTD both report v1.2.0.
• Authenticated draft assets were independently downloaded; every SHA256SUMS entry passed. release.json agrees on version, source ref/SHA, repository, and digest.
• Cosign verified SHA256SUMS.sigstore.json and the image signature against https://github.com/SquareWaveSystems/squarebox/.github/workflows/e2e.yml@refs/tags/v1.2.0 and the GitHub Actions OIDC issuer.
• Fresh Compose start and force recreation used the exact digest. The replacement had a new container ID, retained the install-identity label, and preserved markers in both Workspace and Managed home. Isolated test resources were removed afterward.
• The production installer with explicit SQUAREBOX_TAG=v1.2.0 received the expected public API 404 while the Release is a draft; its cloned checkout was cleaned and no Docker volume was created.
• Annotated tag peels to the exact source SHA. Active refs/tags/v* ruleset still blocks update and deletion with no bypass actors.
• Public GitHub latest remains immutable v1.1.0; GHCR latest remains sha256:0e240dc74f3bc49b49d9a276a50477412be81b0aac704452bf7adab1bac25780, not the v1.2 Candidate.
• Required Candidate Evidence, signing, and draft-adapter jobs all passed.

Still required before this issue can pass:

• Repeat native pull/start, identity, signature, and retained-home Compose checks on physical arm64.
• Complete linked platform qualifications Qualify v1.2 Linux Docker and interactive setup #126-Validate v1.2 Dev Containers and Codespaces #130.
• Only then approve stable-release, verify immutable publication and both latest pointers, and run the no-rewind check.

Current decision: NO-PROMOTE (external platform gates remain open).

[BrettKinny]

This was generated by AI during triage.

Final update for the v1.2.0 Candidate: NO-PROMOTE confirmed after #130 reproduced Managed-home loss on Dev Container rebuild. The protected publication workflow has been cancelled without approval.

The fix merged as #139 at main SHA a2bfdd6d35ef6c7239690cf481f23b0c7f18faa2, so it is necessarily outside the protected v1.2.0 tag. This qualification issue remains open and must be rerun against the new final Candidate digest after the release version is advanced.

[BrettKinny]

This was generated by AI during triage.

v1.2.1 qualification rollover

This issue now targets the future protected v1.2.1 Candidate. Existing
v1.2.0 amd64 evidence remains historical NO-PROMOTE evidence and must not be
credited to the new source, digest, assets, or tag. Both physical architectures
and every linked platform gate must be qualified again against v1.2.1 before
stable approval.