0.3.0

Built by b10x-bot from a959d318f082af6ec3a6ae7bc87a047883511354, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33442824070

Image

image	ghcr.io/beyond10x/b10x-substrate-daemon:0.3.0
digest	sha256:9217023c2b21837e30d00e5d01cb4ac53095bb32df7b836fa2a514b2931a9902
revision label	a959d318f082af6ec3a6ae7bc87a047883511354 (org.opencontainers.image.revision)
platform	linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:9217023c2b21837e30d00e5d01cb4ac53095bb32df7b836fa2a514b2931a9902

Verify the signature

The image is signed keylessly through Sigstore. The certificate identity is the workflow
that built it, so a signature from any other workflow, ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.3.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:9217023c2b21837e30d00e5d01cb4ac53095bb32df7b836fa2a514b2931a9902

What this release does not claim

• The wire contract bundles remain development bundles. Every bundle under
  contracts/substrate-wire/ is a development bundle; a signed daemon image makes none
  of them a stable published contract. A stable-contract decision is its own ADR under
  atlas ADR 0019 (architecture/adr/0019-contract-release-and-conformance.md).
• The image's posture is development, not hosted. Its EXPOSE 8080 and VOLUME
  describe the static-bearer TCP posture that design 06, section 1, marks
  development_only. The hosted trust envelope is accepted in design and not
  implemented; do not run this image as a hosted deployment.
• The binary is not bit-for-bit reproducible. The digest above is recorded;
  reproducing it from source independently is a later milestone.
• The delegated execution lane is not exercised by CI. A host without a delegated
  cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.