0.7.4

Built by this release workflow from 3979d631667e43e6f8d81251fe259485a6f43c28, the commit this tag names, after
.github/workflows/gate.yml concluded success for it: https://github.com/beyond10x/substrate/actions/runs/33991078621

Image

image	ghcr.io/beyond10x/b10x-substrate-daemon:0.7.4
digest	sha256:7f3213a766f3b734a306e374cbcfb37b48a4b577348d9a3142c9c21bed76308f
revision label	3979d631667e43e6f8d81251fe259485a6f43c28 (org.opencontainers.image.revision)
platform	linux/amd64

Pull by digest, never by tag:

docker pull ghcr.io/beyond10x/b10x-substrate-daemon@sha256:7f3213a766f3b734a306e374cbcfb37b48a4b577348d9a3142c9c21bed76308f

Disposable MCP test image

image	ghcr.io/beyond10x/b10x-substrate-mcp:0.7.4
digest	sha256:72d160135447d965b0abf6ee5632c8b85fb3a390168f2a1c9abb77d0d06b4a07
posture	local stdio development/conformance testing

Run by digest with stdin attached, no network, a read-only root and private temporary
state:

docker run --rm -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev   ghcr.io/beyond10x/b10x-substrate-mcp@sha256:72d160135447d965b0abf6ee5632c8b85fb3a390168f2a1c9abb77d0d06b4a07

Development contract bundle

artifact	ghcr.io/beyond10x/b10x-substrate-wire:0.16.0
digest	sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7
contract status	development (dev.b10x.contract.status)

Copy the exact OCI layout by digest, never by tag:

oras cp --to-oci-layout \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7 \
  ./substrate-wire-0.16.0:0.16.0

Verify the signatures

All three artifacts are signed keylessly through Sigstore. Each certificate identity is this
workflow at the ref that performed the release, so a signature from any other workflow,
ref or repository fails:

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-daemon@sha256:7f3213a766f3b734a306e374cbcfb37b48a4b577348d9a3142c9c21bed76308f

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-wire@sha256:4c4e57a1b2427cb004a05cb475c1193e979777c5c79d9a9505ba5facbe10daf7

cosign verify \
  --certificate-identity https://github.com/beyond10x/substrate/.github/workflows/release.yml@refs/tags/0.7.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/beyond10x/b10x-substrate-mcp@sha256:72d160135447d965b0abf6ee5632c8b85fb3a390168f2a1c9abb77d0d06b4a07

What this release does not claim

• The published wire contract remains a development bundle.
  ghcr.io/beyond10x/b10x-substrate-wire:0.16.0 remains a development bundle; OCI publication,
  digest pinning and a verified signature do not make it a stable contract. A
  stable-contract decision is its own ADR under atlas ADR 0019
  (architecture/adr/0019-substrate-contract-release-and-conformance.md).
• The image's default posture is development, not hosted. Its EXPOSE 8080 and
  VOLUME describe the static-bearer TCP posture that design 06, section 1, marks
  development_only. The binary also implements the production TLS/Identity profile,
  but a hosted deployment must explicitly supply that profile's certificates, trust
  roots and authority settings; the default container command does not do so.
• The MCP image is local test tooling, not production ingress. It has no listener,
  authentication or remote transport and is intended for an attached stdio harness with
  --network=none. Its tool surface is not a stable contract independent of Substrate.
• The binary is not bit-for-bit reproducible. The digest above is recorded;
  reproducing it from source independently is a later milestone.
• The delegated execution lane is not exercised by CI. A host without a delegated
  cgroup v2 subtree answers exec.sandbox-unavailable rather than running unconfined.