v1.34.0-rc.4

Pre-release on the edge channel; rc.3 plus the enterprise-deployment Phase 1 and Phase 2
work. Cut so that the Phase 2 attended acceptance has CI-built, cosign-signed images to boot
from (first boot pins the release workflow's signing identity; the observer-postgres image
had never been published):

• observer-org deploy plan (Phase 1): the deployment catalog (axes, constraint table,
  developer-count size map, eleven reference architectures), the bill of materials, the dated
  three-cloud price snapshot with confidence letters and the 90-day stale gate (DR-17), the
  alternatives block, honest ceilings (D2), and the rendered bundle (config.production.toml,
  .env, compose override, nats.conf, RUNBOOK/ESTIMATE); deploy export ships the catalog.
• Azure OpenTofu modules (Phase 2): six thin roots (compact/appliance x
  bootstrap/data/app) over shared child modules under deploy/modules/, embedded and
  exported as the bundle's modules/ row; tfvars rendered from the answer set's sizing and the
  catalog's provision SKU names; cloud-init + on-box units (Key Vault secrets flow, private
  bundle container, pgBackRest timers, restore drill); the observer-postgres image
  (postgres 16 + pgBackRest, DR-51) built, signed and pushed beside observer-org under the
  same tag.
• [metrics] listener + /metrics (DR-12) and observer-org support-bundle (DR-20);
  doctor gains the object-store probe and the SAS-expiry warning.
• The air-gap kit ships the Sigstore trusted root and VERIFY.md verifies with
  --trusted-root; release.sh pre-flight asserts the chart and harness-gateway versions.
• Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.34.0-rc.4-linux-x64.tar.gz
Linux arm64	observer-v1.34.0-rc.4-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.34.0-rc.4-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.34.0-rc.4-darwin-arm64.tar.gz
Windows x86_64	observer-v1.34.0-rc.4-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.34.0-rc.4

Org server (Teams)

The self-hosted org server is an enterprise-licensed product distributed from SuperBased's private container registry with a per-customer pull token issued with your enterprise licence; its release assets are not attached here. Contact sales for a pull token. The pull-and-verify recipe for your exact release is the README.md of the deployment bundle (observer-org deploy export).

Enterprise updates

This release publishes on the edge channel.

Each agent archive carries a detached vendor signature (<archive>.sig, raw Ed25519 over the archive bytes) and the release ships a signed update-manifest-edge.json. Self-hosted org servers consume them with:

observer-org update sync --version v1.34.0-rc.4
observer-org update publish --channel edge --version v1.34.0-rc.4

For a disconnected server, download observer-v1.34.0-rc.4-airgap-bundle.tar (archives + signatures + SHA256SUMS + the signed manifest + provenance), carry it across the gap, and run observer-org update import --version v1.34.0-rc.4 --bundle <dir>.

Supply chain

A CycloneDX SBOM for the agent is attached: observer.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private