Repository navigation
runtime-image.yml and cargo-runtime-image.yml now upload a V5 source document and import nothing. manifest-path names a repo-relative V5 document (release.mode: source, runtime.kind: native_image); the policy-import step is gone from both workflows.
New outputs on runtime-image-upload and both workflows, read from the finalize response: artifact-digest, source-repository, source-ref, source-commit, source-workflow-identity, binding-revision, revocation-epoch. Publish afterwards with proof liskov application policy publish <app> --file <document> --artifact-digest … --binding-revision … --revocation-epoch … --source-ref … --source-commit … --workflow-identity … --expected-pointer-version <n> --yes, or with a pinned document naming artifact-digest.
Cargo source assurance. cargo-runtime-image.yml gains the optional source-assurance input (default false) and the source-digest and sbom-path outputs. The source-assurance action generates a deterministic CycloneDX SBOM from Cargo.lock when no pnpm-lock.yaml is present; existing pnpm SBOM bytes are unchanged.
Who is affected. Callers of acurast-app.yml@v2, marketplace-ingest.yml@v2 and policy-sync.yml@v2 see no change. A caller of the two runtime-image workflows that still builds from a V4 manifest stays on @v1, which is frozen at v1.3.2; it moves to @v2 together with a V5 document. On the action, authored-digest and release-intent-digest remain as the V4 mode, mutually exclusive with manifest-path, until V4 import closes.
Required server release. The Liskov control plane must carry liskov-rs #1632 (BKLG-20261008-k2hx). It is live in production. Against an older server the V5 mode fails closed at the upload session with domain_mismatch.
Source commit: 2eef49238a02a0a17824abf9c697935aa73f5734 (PR #17 / BKLG-20261008-7dyo and PR #18 / BKLG-20261008-v5rb).
Validation on this exact source: typecheck, 59 TypeScript tests and the Python suites, Python compileall, the regenerated distribution check, and main's build check all passed. No @v2 runtime-image workflow has run against production yet; the first run is the first live proof of the V5 upload arm.