0.4.2

Built by this release workflow from 06875512e4817446c7b1989565efe83ddcc29814, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33460337507

Image

image	ghcr.io/beyond10x/b10x-substrate-daemon:0.4.2
digest	sha256:1aac0c63c1f1e7dae2dff8f1f20a06b4d7f5461b61bb172b4a8a3f137cd2f6d1
revision label	06875512e4817446c7b1989565efe83ddcc29814 (org.opencontainers.image.revision)
platform	linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:1aac0c63c1f1e7dae2dff8f1f20a06b4d7f5461b61bb172b4a8a3f137cd2f6d1

Development contract bundle

artifact	ghcr.io/beyond10x/b10x-substrate-wire:0.12.0
digest	sha256:dd901e848c821aca7d55f7b8cf5ee893e1d99a1428b348e32e7ed1045a375319
contract status	development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:dd901e848c821aca7d55f7b8cf5ee893e1d99a1428b348e32e7ed1045a375319 \
  ./substrate-wire-0.12.0:0.12.0

Verify the signatures

Both artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:1aac0c63c1f1e7dae2dff8f1f20a06b4d7f5461b61bb172b4a8a3f137cd2f6d1

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:dd901e848c821aca7d55f7b8cf5ee893e1d99a1428b348e32e7ed1045a375319

What this release does not claim

• The published wire contract remains a development bundle.
  ghcr.io/beyond10x/b10x-substrate-wire:0.12.0 remains a development bundle; OCI publication,
  digest pinning and a verified signature do not make it a stable contract. A
  stable-contract decision is its own ADR under atlas ADR 0019
  (architecture/adr/0019-substrate-contract-release-and-conformance.md).
• The image's posture is development, not hosted. Its EXPOSE 8080 and VOLUME
  describe the static-bearer TCP posture that design 06, section 1, marks
  development_only. The hosted trust envelope is accepted in design and not
  implemented; do not run this image as a hosted deployment.
• The binary is not bit-for-bit reproducible. The digest above is recorded;
  reproducing it from source independently is a later milestone.
• The delegated execution lane is not exercised by CI. A host without a delegated
  cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.