v1.34.0-rc.3

Pre-release on the edge channel; rc.2 plus three release-pipeline fixes found by running
rc.2 (the second pre-release tag; every fix is pinned by an executed test):

• cosign is installed by the pipeline's own retried, sha256-pinned script at all three signing
  sites (COSIGN_VERSION / COSIGN_SHA256); on rc.2 one un-retried download inside the
  installer action failed after the observer-org image had been pushed, leaving the tag
  unsigned and the private release skipped.
• The release-archive filename rule has one owner, internal/update.ParseArtifactName, used by
  both the org server's update import and the pipeline's manifest producer; rc.1's fix had
  patched the importer's copy while the pipeline ran its own, so rc.2's public release failed
  with the same "no agent archives".
• The private GitHub release is created and its assets attached with gh release create /
  gh release upload --clobber, the mechanism the public release has always used; the
  third-party release action aborted its parallel upload batch on both rc attempts.

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.34.0-rc.3-linux-x64.tar.gz
Linux arm64	observer-v1.34.0-rc.3-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.34.0-rc.3-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.34.0-rc.3-darwin-arm64.tar.gz
Windows x86_64	observer-v1.34.0-rc.3-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.34.0-rc.3

Org server (Teams)

The self-hosted org server is an enterprise-licensed product distributed from SuperBased's private container registry with a per-customer pull token issued with your enterprise licence; its release assets are not attached here. Contact sales for a pull token. The pull-and-verify recipe for your exact release is the README.md of the deployment bundle (observer-org deploy export).

Enterprise updates

This release publishes on the edge channel.

Each agent archive carries a detached vendor signature (<archive>.sig, raw Ed25519 over the archive bytes) and the release ships a signed update-manifest-edge.json. Self-hosted org servers consume them with:

observer-org update sync --version v1.34.0-rc.3
observer-org update publish --channel edge --version v1.34.0-rc.3

For a disconnected server, download observer-v1.34.0-rc.3-airgap-bundle.tar (archives + signatures + SHA256SUMS + the signed manifest + provenance), carry it across the gap, and run observer-org update import --version v1.34.0-rc.3 --bundle <dir>.

Supply chain

A CycloneDX SBOM for the agent is attached: observer.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private