0.2.4

Built by b10x-bot from 8deafb8bbf4b6ab379bed055d75882e79dcb61cf, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33396497900

Image

image	ghcr.io/beyond10x/b10x-substrate-daemon:0.2.4
digest	sha256:18b4bf966ffab38eb76801204dadfb413e898e5110272514accdf8d6e1ec083b
revision label	8deafb8bbf4b6ab379bed055d75882e79dcb61cf (org.opencontainers.image.revision)
platform	linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:18b4bf966ffab38eb76801204dadfb413e898e5110272514accdf8d6e1ec083b

Verify the signature

The image is signed keylessly through Sigstore. The certificate identity is the workflow
that built it, so a signature from any other workflow, ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.2.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:18b4bf966ffab38eb76801204dadfb413e898e5110272514accdf8d6e1ec083b

What this release does not claim

• The wire contract bundles remain development bundles. Every bundle under
  contracts/substrate-wire/ is a development bundle; a signed daemon image makes none
  of them a stable published contract. A stable-contract decision is its own ADR under
  atlas ADR 0019 (architecture/adr/0019-contract-release-and-conformance.md).
• The image's posture is development, not hosted. Its EXPOSE 8080 and VOLUME
  describe the static-bearer TCP posture that design 06, section 1, marks
  development_only. The hosted trust envelope is accepted in design and not
  implemented; do not run this image as a hosted deployment.
• The binary is not bit-for-bit reproducible. The digest above is recorded;
  reproducing it from source independently is a later milestone.
• The delegated execution lane is not exercised by CI. A host without a delegated
  cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.