Skip to content

Releases: beyond10x/substrate

Release list

0.7.7

0.7.7 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Sep 22:08
Immutable release. Only release title and notes can be modified.
0.7.7
3fafeae

Built by this release workflow from 3fafeae65fe6ee9f36c3ba17d49b36a1a0d1a3a3, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/34528834147

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.7.7
digest sha256:5e20467bd03ad7e619ffcf8664dcc6d3323c62fb62eb1f0e25f001333092a409
revision label 3fafeae65fe6ee9f36c3ba17d49b36a1a0d1a3a3 (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:5e20467bd03ad7e619ffcf8664dcc6d3323c62fb62eb1f0e25f001333092a409

Disposable MCP test image
image ghcr.io/beyond10x/b10x-substrate-mcp:0.7.7
digest sha256:e40c16ae56fa06353e508e5245b8d78b336ecd1cebf3fde20b8dddaf18b42b7c
posture local stdio development/conformance testing

Run by digest with stdin attached, no network, a read-only root and private temporary
state:

docker run --rm -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev   ghcr.io/beyond10x/b10x-substrate-mcp@sha256:e40c16ae56fa06353e508e5245b8d78b336ecd1cebf3fde20b8dddaf18b42b7c

Development contract bundle
artifact ghcr.io/beyond10x/b10x-substrate-wire:0.16.0
digest sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7
contract status development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7 \
  ./substrate-wire-0.16.0:0.16.0

Verify the signatures

All three artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.7 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:5e20467bd03ad7e619ffcf8664dcc6d3323c62fb62eb1f0e25f001333092a409

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.7 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.7 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-mcp@sha256:e40c16ae56fa06353e508e5245b8d78b336ecd1cebf3fde20b8dddaf18b42b7c

What this release does not claim

  • The published wire contract remains a development bundle.
    ghcr.io/beyond10x/b10x-substrate-wire:0.16.0 remains a development bundle; OCI publication,
    digest pinning and a verified signature do not make it a stable contract. A
    stable-contract decision is its own ADR under atlas ADR 0019
    (architecture/adr/0019-substrate-contract-release-and-conformance.md).
  • The image's default posture is development, not hosted. Its EXPOSE 8080 and
    VOLUME describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The binary also implements the production TLS/Identity profile,
    but a hosted deployment must explicitly supply that profile's certificates, trust
    roots and authority settings; the default container command does not do so.
  • The MCP image is local test tooling, not production ingress. It has no listener,
    authentication or remote transport and is intended for an attached stdio harness with
    --network=none. Its tool surface is not a stable contract independent of Substrate.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Assets 3
Loading

0.7.6

0.7.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Sep 18:42
Immutable release. Only release title and notes can be modified.
0.7.6
68b4e21

Built by this release workflow from 68b4e21115b4a57cd8c273287225e00a7f8efe97, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/34051053302

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.7.6
digest sha256:2ffe9021c9f498cda8d08e5b7438f0e3ca2bc371bdb1bf467e18ab7403073170
revision label 68b4e21115b4a57cd8c273287225e00a7f8efe97 (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:2ffe9021c9f498cda8d08e5b7438f0e3ca2bc371bdb1bf467e18ab7403073170

Disposable MCP test image
image ghcr.io/beyond10x/b10x-substrate-mcp:0.7.6
digest sha256:61b08d32b1c2e365c7466113c87334ae99b269716f3a469626134abf1ea580a2
posture local stdio development/conformance testing

Run by digest with stdin attached, no network, a read-only root and private temporary
state:

docker run --rm -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev   ghcr.io/beyond10x/b10x-substrate-mcp@sha256:61b08d32b1c2e365c7466113c87334ae99b269716f3a469626134abf1ea580a2

Development contract bundle
artifact ghcr.io/beyond10x/b10x-substrate-wire:0.16.0
digest sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7
contract status development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7 \
  ./substrate-wire-0.16.0:0.16.0

Verify the signatures

All three artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.6 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:2ffe9021c9f498cda8d08e5b7438f0e3ca2bc371bdb1bf467e18ab7403073170

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.6 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.6 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-mcp@sha256:61b08d32b1c2e365c7466113c87334ae99b269716f3a469626134abf1ea580a2

What this release does not claim

  • The published wire contract remains a development bundle.
    ghcr.io/beyond10x/b10x-substrate-wire:0.16.0 remains a development bundle; OCI publication,
    digest pinning and a verified signature do not make it a stable contract. A
    stable-contract decision is its own ADR under atlas ADR 0019
    (architecture/adr/0019-substrate-contract-release-and-conformance.md).
  • The image's default posture is development, not hosted. Its EXPOSE 8080 and
    VOLUME describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The binary also implements the production TLS/Identity profile,
    but a hosted deployment must explicitly supply that profile's certificates, trust
    roots and authority settings; the default container command does not do so.
  • The MCP image is local test tooling, not production ingress. It has no listener,
    authentication or remote transport and is intended for an attached stdio harness with
    --network=none. Its tool surface is not a stable contract independent of Substrate.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Loading

0.7.5

0.7.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Sep 22:20
Immutable release. Only release title and notes can be modified.
0.7.5
64ae2ed
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Built by this release workflow from 64ae2ed5a888663b036cbe06515cbfd277369d58, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33994311085

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.7.5
digest sha256:e69032ec391a7e2cea57ff46465e2c2af2b413795174a173ac8c6d76d4f11e0c
revision label 64ae2ed5a888663b036cbe06515cbfd277369d58 (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:e69032ec391a7e2cea57ff46465e2c2af2b413795174a173ac8c6d76d4f11e0c

Disposable MCP test image
image ghcr.io/beyond10x/b10x-substrate-mcp:0.7.5
digest sha256:ba0bfd9ea73abb3111dc95fd5a6ff998723db5a19e14c581e783de080431cd5f
posture local stdio development/conformance testing

Run by digest with stdin attached, no network, a read-only root and private temporary
state:

docker run --rm -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev   ghcr.io/beyond10x/b10x-substrate-mcp@sha256:ba0bfd9ea73abb3111dc95fd5a6ff998723db5a19e14c581e783de080431cd5f

Development contract bundle
artifact ghcr.io/beyond10x/b10x-substrate-wire:0.16.0
digest sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7
contract status development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7 \
  ./substrate-wire-0.16.0:0.16.0

Verify the signatures

All three artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.5 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:e69032ec391a7e2cea57ff46465e2c2af2b413795174a173ac8c6d76d4f11e0c

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.5 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.5 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-mcp@sha256:ba0bfd9ea73abb3111dc95fd5a6ff998723db5a19e14c581e783de080431cd5f

What this release does not claim

  • The published wire contract remains a development bundle.
    ghcr.io/beyond10x/b10x-substrate-wire:0.16.0 remains a development bundle; OCI publication,
    digest pinning and a verified signature do not make it a stable contract. A
    stable-contract decision is its own ADR under atlas ADR 0019
    (architecture/adr/0019-substrate-contract-release-and-conformance.md).
  • The image's default posture is development, not hosted. Its EXPOSE 8080 and
    VOLUME describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The binary also implements the production TLS/Identity profile,
    but a hosted deployment must explicitly supply that profile's certificates, trust
    roots and authority settings; the default container command does not do so.
  • The MCP image is local test tooling, not production ingress. It has no listener,
    authentication or remote transport and is intended for an attached stdio harness with
    --network=none. Its tool surface is not a stable contract independent of Substrate.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Loading

0.7.4

0.7.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Sep 21:11
Immutable release. Only release title and notes can be modified.
0.7.4
3979d63
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Built by this release workflow from 3979d631667e43e6f8d81251fe259485a6f43c28, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33991078621

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.7.4
digest sha256:7f3213a766f3b734a306e374cbcfb37b48a4b577348d9a3142c9c21bed76308f
revision label 3979d631667e43e6f8d81251fe259485a6f43c28 (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:7f3213a766f3b734a306e374cbcfb37b48a4b577348d9a3142c9c21bed76308f

Disposable MCP test image
image ghcr.io/beyond10x/b10x-substrate-mcp:0.7.4
digest sha256:72d160135447d965b0abf6ee5632c8b85fb3a390168f2a1c9abb77d0d06b4a07
posture local stdio development/conformance testing

Run by digest with stdin attached, no network, a read-only root and private temporary
state:

docker run --rm -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev   ghcr.io/beyond10x/b10x-substrate-mcp@sha256:72d160135447d965b0abf6ee5632c8b85fb3a390168f2a1c9abb77d0d06b4a07

Development contract bundle
artifact ghcr.io/beyond10x/b10x-substrate-wire:0.16.0
digest sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7
contract status development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7 \
  ./substrate-wire-0.16.0:0.16.0

Verify the signatures

All three artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:7f3213a766f3b734a306e374cbcfb37b48a4b577348d9a3142c9c21bed76308f

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-mcp@sha256:72d160135447d965b0abf6ee5632c8b85fb3a390168f2a1c9abb77d0d06b4a07

What this release does not claim

  • The published wire contract remains a development bundle.
    ghcr.io/beyond10x/b10x-substrate-wire:0.16.0 remains a development bundle; OCI publication,
    digest pinning and a verified signature do not make it a stable contract. A
    stable-contract decision is its own ADR under atlas ADR 0019
    (architecture/adr/0019-substrate-contract-release-and-conformance.md).
  • The image's default posture is development, not hosted. Its EXPOSE 8080 and
    VOLUME describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The binary also implements the production TLS/Identity profile,
    but a hosted deployment must explicitly supply that profile's certificates, trust
    roots and authority settings; the default container command does not do so.
  • The MCP image is local test tooling, not production ingress. It has no listener,
    authentication or remote transport and is intended for an attached stdio harness with
    --network=none. Its tool surface is not a stable contract independent of Substrate.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Loading

0.7.3

0.7.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Sep 09:49
Immutable release. Only release title and notes can be modified.
0.7.3
329a128

Built by this release workflow from 329a128606a7c18c4477d6fff58ffc57b296fb70, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33955401226

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.7.3
digest sha256:0900b2bc2c7f589ced4503f5238915f14b480472905ad3895bc0803eb1a2893b
revision label 329a128606a7c18c4477d6fff58ffc57b296fb70 (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:0900b2bc2c7f589ced4503f5238915f14b480472905ad3895bc0803eb1a2893b

Disposable MCP test image
image ghcr.io/beyond10x/b10x-substrate-mcp:0.7.3
digest sha256:ac78c94823793094c7a6e46e7adfd0e4d0b83fda6c07c976893f4ff1a5fa2b8d
posture local stdio development/conformance testing

Run by digest with stdin attached, no network, a read-only root and private temporary
state:

docker run --rm -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev   ghcr.io/beyond10x/b10x-substrate-mcp@sha256:ac78c94823793094c7a6e46e7adfd0e4d0b83fda6c07c976893f4ff1a5fa2b8d

Development contract bundle
artifact ghcr.io/beyond10x/b10x-substrate-wire:0.16.0
digest sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7
contract status development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7 \
  ./substrate-wire-0.16.0:0.16.0

Verify the signatures

All three artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:0900b2bc2c7f589ced4503f5238915f14b480472905ad3895bc0803eb1a2893b

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-mcp@sha256:ac78c94823793094c7a6e46e7adfd0e4d0b83fda6c07c976893f4ff1a5fa2b8d

What this release does not claim

  • The published wire contract remains a development bundle.
    ghcr.io/beyond10x/b10x-substrate-wire:0.16.0 remains a development bundle; OCI publication,
    digest pinning and a verified signature do not make it a stable contract. A
    stable-contract decision is its own ADR under atlas ADR 0019
    (architecture/adr/0019-substrate-contract-release-and-conformance.md).
  • The image's default posture is development, not hosted. Its EXPOSE 8080 and
    VOLUME describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The binary also implements the production TLS/Identity profile,
    but a hosted deployment must explicitly supply that profile's certificates, trust
    roots and authority settings; the default container command does not do so.
  • The MCP image is local test tooling, not production ingress. It has no listener,
    authentication or remote transport and is intended for an attached stdio harness with
    --network=none. Its tool surface is not a stable contract independent of Substrate.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Loading

0.7.0

0.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Sep 15:21
Immutable release. Only release title and notes can be modified.
0.7.0
a72f134

Built by this release workflow from a72f134ebc9b7fcb13c3f8c2adbb5f97b0511efc, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33887237297

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.7.0
digest sha256:62ad44f814a4cae4f95b826aaad69f5205f1d16a46e98700b96efe1b3a8a5f51
revision label a72f134ebc9b7fcb13c3f8c2adbb5f97b0511efc (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:62ad44f814a4cae4f95b826aaad69f5205f1d16a46e98700b96efe1b3a8a5f51

Disposable MCP test image
image ghcr.io/beyond10x/b10x-substrate-mcp:0.7.0
digest sha256:56265329568f4f3eebb0559f35dc61b6fa6501d0facf626362fac6573989797a
posture local stdio development/conformance testing

Run by digest with stdin attached, no network, a read-only root and private temporary
state:

docker run --rm -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev   ghcr.io/beyond10x/b10x-substrate-mcp@sha256:56265329568f4f3eebb0559f35dc61b6fa6501d0facf626362fac6573989797a

Development contract bundle
artifact ghcr.io/beyond10x/b10x-substrate-wire:0.15.0
digest sha256:ba95171e3a05d7917e4083759107132ad6fb707003e791e15b47d9fb20424ac8
contract status development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:ba95171e3a05d7917e4083759107132ad6fb707003e791e15b47d9fb20424ac8 \
  ./substrate-wire-0.15.0:0.15.0

Verify the signatures

All three artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:62ad44f814a4cae4f95b826aaad69f5205f1d16a46e98700b96efe1b3a8a5f51

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:ba95171e3a05d7917e4083759107132ad6fb707003e791e15b47d9fb20424ac8

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-mcp@sha256:56265329568f4f3eebb0559f35dc61b6fa6501d0facf626362fac6573989797a

What this release does not claim

  • The published wire contract remains a development bundle.
    ghcr.io/beyond10x/b10x-substrate-wire:0.15.0 remains a development bundle; OCI publication,
    digest pinning and a verified signature do not make it a stable contract. A
    stable-contract decision is its own ADR under atlas ADR 0019
    (architecture/adr/0019-substrate-contract-release-and-conformance.md).
  • The image's default posture is development, not hosted. Its EXPOSE 8080 and
    VOLUME describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The binary also implements the production TLS/Identity profile,
    but a hosted deployment must explicitly supply that profile's certificates, trust
    roots and authority settings; the default container command does not do so.
  • The MCP image is local test tooling, not production ingress. It has no listener,
    authentication or remote transport and is intended for an attached stdio harness with
    --network=none. Its tool surface is not a stable contract independent of Substrate.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Loading

0.6.0

0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Sep 11:05
Immutable release. Only release title and notes can be modified.
0.6.0
79c74ed

Built by this release workflow from 79c74ed1bc6d3e2958646d38dfb0426ab82aa131, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33864792450

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.6.0
digest sha256:55a080c8b65c977ba6031d15ad7a336f49b4175266ea40b8bf10151ad822a711
revision label 79c74ed1bc6d3e2958646d38dfb0426ab82aa131 (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:55a080c8b65c977ba6031d15ad7a336f49b4175266ea40b8bf10151ad822a711

Disposable MCP test image
image ghcr.io/beyond10x/b10x-substrate-mcp:0.6.0
digest sha256:c7a189a389d5760780f3329a0b3d8470e5eaf1247cd6fc6ecfdad170e10c0fbc
posture local stdio development/conformance testing

Run by digest with stdin attached, no network, a read-only root and private temporary
state:

docker run --rm -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev   ghcr.io/beyond10x/b10x-substrate-mcp@sha256:c7a189a389d5760780f3329a0b3d8470e5eaf1247cd6fc6ecfdad170e10c0fbc

Development contract bundle
artifact ghcr.io/beyond10x/b10x-substrate-wire:0.15.0
digest sha256:ba95171e3a05d7917e4083759107132ad6fb707003e791e15b47d9fb20424ac8
contract status development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:ba95171e3a05d7917e4083759107132ad6fb707003e791e15b47d9fb20424ac8 \
  ./substrate-wire-0.15.0:0.15.0

Verify the signatures

All three artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.6.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:55a080c8b65c977ba6031d15ad7a336f49b4175266ea40b8bf10151ad822a711

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.6.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:ba95171e3a05d7917e4083759107132ad6fb707003e791e15b47d9fb20424ac8

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.6.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-mcp@sha256:c7a189a389d5760780f3329a0b3d8470e5eaf1247cd6fc6ecfdad170e10c0fbc

What this release does not claim

  • The published wire contract remains a development bundle.
    ghcr.io/beyond10x/b10x-substrate-wire:0.15.0 remains a development bundle; OCI publication,
    digest pinning and a verified signature do not make it a stable contract. A
    stable-contract decision is its own ADR under atlas ADR 0019
    (architecture/adr/0019-substrate-contract-release-and-conformance.md).
  • The image's default posture is development, not hosted. Its EXPOSE 8080 and
    VOLUME describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The binary also implements the production TLS/Identity profile,
    but a hosted deployment must explicitly supply that profile's certificates, trust
    roots and authority settings; the default container command does not do so.
  • The MCP image is local test tooling, not production ingress. It has no listener,
    authentication or remote transport and is intended for an attached stdio harness with
    --network=none. Its tool surface is not a stable contract independent of Substrate.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Loading

0.5.0

0.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Sep 10:47
Immutable release. Only release title and notes can be modified.
0.5.0
fcb48e5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Built by this release workflow from fcb48e5b503be32ce4749e7d8ac7a15331637354, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33497345920

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.5.0
digest sha256:5dc8a1a6b61c9b652817c0ae54a4504c23bf781a6fed3cb7617e535bf7c9e786
revision label fcb48e5b503be32ce4749e7d8ac7a15331637354 (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:5dc8a1a6b61c9b652817c0ae54a4504c23bf781a6fed3cb7617e535bf7c9e786

Disposable MCP test image
image ghcr.io/beyond10x/b10x-substrate-mcp:0.5.0
digest sha256:3fc28533df606b1db8d5583c3f4288551393ecf15c293c7815bfe8f599976316
posture local stdio development/conformance testing

Run by digest with stdin attached, no network, a read-only root and private temporary
state:

docker run --rm -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev   ghcr.io/beyond10x/b10x-substrate-mcp@sha256:3fc28533df606b1db8d5583c3f4288551393ecf15c293c7815bfe8f599976316

Development contract bundle
artifact ghcr.io/beyond10x/b10x-substrate-wire:0.15.0
digest sha256:ba95171e3a05d7917e4083759107132ad6fb707003e791e15b47d9fb20424ac8
contract status development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:ba95171e3a05d7917e4083759107132ad6fb707003e791e15b47d9fb20424ac8 \
  ./substrate-wire-0.15.0:0.15.0

Verify the signatures

All three artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.5.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:5dc8a1a6b61c9b652817c0ae54a4504c23bf781a6fed3cb7617e535bf7c9e786

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.5.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:ba95171e3a05d7917e4083759107132ad6fb707003e791e15b47d9fb20424ac8

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.5.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-mcp@sha256:3fc28533df606b1db8d5583c3f4288551393ecf15c293c7815bfe8f599976316

What this release does not claim

  • The published wire contract remains a development bundle.
    ghcr.io/beyond10x/b10x-substrate-wire:0.15.0 remains a development bundle; OCI publication,
    digest pinning and a verified signature do not make it a stable contract. A
    stable-contract decision is its own ADR under atlas ADR 0019
    (architecture/adr/0019-substrate-contract-release-and-conformance.md).
  • The image's default posture is development, not hosted. Its EXPOSE 8080 and
    VOLUME describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The binary also implements the production TLS/Identity profile,
    but a hosted deployment must explicitly supply that profile's certificates, trust
    roots and authority settings; the default container command does not do so.
  • The MCP image is local test tooling, not production ingress. It has no listener,
    authentication or remote transport and is intended for an attached stdio harness with
    --network=none. Its tool surface is not a stable contract independent of Substrate.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Loading

0.4.2

0.4.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Sep 02:26
Immutable release. Only release title and notes can be modified.
0.4.2
0687551
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Built by this release workflow from 06875512e4817446c7b1989565efe83ddcc29814, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33460337507

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.4.2
digest sha256:1aac0c63c1f1e7dae2dff8f1f20a06b4d7f5461b61bb172b4a8a3f137cd2f6d1
revision label 06875512e4817446c7b1989565efe83ddcc29814 (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:1aac0c63c1f1e7dae2dff8f1f20a06b4d7f5461b61bb172b4a8a3f137cd2f6d1

Development contract bundle
artifact ghcr.io/beyond10x/b10x-substrate-wire:0.12.0
digest sha256:dd901e848c821aca7d55f7b8cf5ee893e1d99a1428b348e32e7ed1045a375319
contract status development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:dd901e848c821aca7d55f7b8cf5ee893e1d99a1428b348e32e7ed1045a375319 \
  ./substrate-wire-0.12.0:0.12.0

Verify the signatures

Both artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:1aac0c63c1f1e7dae2dff8f1f20a06b4d7f5461b61bb172b4a8a3f137cd2f6d1

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:dd901e848c821aca7d55f7b8cf5ee893e1d99a1428b348e32e7ed1045a375319

What this release does not claim

  • The published wire contract remains a development bundle.
    ghcr.io/beyond10x/b10x-substrate-wire:0.12.0 remains a development bundle; OCI publication,
    digest pinning and a verified signature do not make it a stable contract. A
    stable-contract decision is its own ADR under atlas ADR 0019
    (architecture/adr/0019-substrate-contract-release-and-conformance.md).
  • The image's posture is development, not hosted. Its EXPOSE 8080 and VOLUME
    describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The hosted trust envelope is accepted in design and not
    implemented; do not run this image as a hosted deployment.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Loading

0.4.0

0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Aug 23:20
Immutable release. Only release title and notes can be modified.
0.4.0
31340a6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Built by b10x-bot from 31340a6771cd1207f78d515d938ae0b697bd68f9, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33449368962

Image
image ghcr.io/beyond10x/b10x-substrate-daemon:0.4.0
digest sha256:5a031758dd581b472ad2f250b850b0ed1bac72b3da4476572a6224ee91765193
revision label 31340a6771cd1207f78d515d938ae0b697bd68f9 (org.opencontainers.image.revision)
platform linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:5a031758dd581b472ad2f250b850b0ed1bac72b3da4476572a6224ee91765193

Verify the signature

The image is signed keylessly through Sigstore. The certificate identity is the workflow
that built it, so a signature from any other workflow, ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.4.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:5a031758dd581b472ad2f250b850b0ed1bac72b3da4476572a6224ee91765193

What this release does not claim

  • The wire contract bundles remain development bundles. Every bundle under
    contracts/substrate-wire/ is a development bundle; a signed daemon image makes none
    of them a stable published contract. A stable-contract decision is its own ADR under
    atlas ADR 0019 (architecture/adr/0019-contract-release-and-conformance.md).
  • The image's posture is development, not hosted. Its EXPOSE 8080 and VOLUME
    describe the static-bearer TCP posture that design 06, section 1, marks
    development_only. The hosted trust envelope is accepted in design and not
    implemented; do not run this image as a hosted deployment.
  • The binary is not bit-for-bit reproducible. The digest above is recorded;
    reproducing it from source independently is a later milestone.
  • The delegated execution lane is not exercised by CI. A host without a delegated
    cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.
Loading