0.3.1

Built by b10x-bot from 74626fcecf726ad0337f165a40026fbd3ccd2b23, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33445833777

Image

image	ghcr.io/beyond10x/b10x-substrate-daemon:0.3.1
digest	sha256:48068ba167487fa84fe77e0acf7f8e3f556060f4d220a074d9b9f60f9af71ebf
revision label	74626fcecf726ad0337f165a40026fbd3ccd2b23 (org.opencontainers.image.revision)
platform	linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:48068ba167487fa84fe77e0acf7f8e3f556060f4d220a074d9b9f60f9af71ebf

Verify the signature

The image is signed keylessly through Sigstore. The certificate identity is the workflow
that built it, so a signature from any other workflow, ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.3.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:48068ba167487fa84fe77e0acf7f8e3f556060f4d220a074d9b9f60f9af71ebf

What this release does not claim

• The wire contract bundles remain development bundles. Every bundle under
  contracts/substrate-wire/ is a development bundle; a signed daemon image makes none
  of them a stable published contract. A stable-contract decision is its own ADR under
  atlas ADR 0019 (architecture/adr/0019-contract-release-and-conformance.md).
• The image's posture is development, not hosted. Its EXPOSE 8080 and VOLUME
  describe the static-bearer TCP posture that design 06, section 1, marks
  development_only. The hosted trust envelope is accepted in design and not
  implemented; do not run this image as a hosted deployment.
• The binary is not bit-for-bit reproducible. The digest above is recorded;
  reproducing it from source independently is a later milestone.
• The delegated execution lane is not exercised by CI. A host without a delegated
  cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.