feat(release): verify detached release signatures

[seonghobae]

Scope

Canonical successor to #222, stacked on current #217. This advances #210 from structural release-evidence validation to a cryptographic operator-verification boundary. It does not publish a release candidate, distribute trust roots, or claim release readiness.

The preserved child lineage verifies detached Ed25519 signatures, rejects forged/substituted/non-canonical evidence and unknown trust identity, exposes bounded verify-release, and keeps same-descriptor O_NOFOLLOW JSON/artifact trust boundaries. Trust is not inferred from embedded keys, GitHub actors, or model output. Key issuance/rotation/revocation/custody, transparency-log/Sigstore policy, publication, install/upgrade/backup/restore, and buyer-journey acceptance remain outside this slice.

Current stack

Parent #217 is exact 59c9d94a5bc61e062e4596f737280581cd684bad, open/Draft/mergeable on protected main@193a87ef54c3fe6dcda4755bce4d6bc81e3a0297.

The newest parent delta is a hosted-RED-driven fixture repair. The production nightly identity invariant from df83b68c065f94ece3c13c53e2ef881b093ed742 correctly rejected a leap-day positive fixture whose version claimed 2024-02-29 while its helper hard-coded a 2026-02-28 generated_at. Minimal parent repair 59c9d94... parameterizes only the fixture generation instant and gives the leap-day control its matching UTC date; production validation remains unchanged.

This child adopted that stronger parent without rewriting historical child work. Current two-parent descendant 40f5877edb9489d24760bbd479cd0b5880a182ad preserves prior child ecfc4e130fd5fd1ae539e8e2fdf76b4413042d49 as first parent and current #217 as additional parent. Branch movement used force=false.

Fresh parent→child compare is ahead-only with behind_by=0, merge base exactly current #217, and exactly the same six child-owned paths remain: packages/commercial-readiness/package.json, src/cli-file-read-contract.test.mjs, src/cli.mjs, src/release-signature-cli.test.mjs, src/release-signature-verification.mjs, and src/release-signature-verification.test.mjs. Parent release-evidence source/test/CHANGELOG changes arrive only through ancestry; no child delta was discarded.

Exact-head acceptance

Current exact head is 40f5877edb9489d24760bbd479cd0b5880a182ad, open/Draft/mergeable with base exact #217 59c9d94.... Submitted reviews and inline review threads are empty. This stacked head does not inherit predecessor workflow/review evidence, and absence of a PR-triggered run is not GREEN.

Keep Draft while #217 remains unmerged. After normal parent integration, retarget/restack non-destructively and reacquire unchanged-head repository/central workflows plus independent review/thread authority. Shared control-plane/dependency/scanner blockers remain owner paths rather than child-local suppressions: #247 for protected-main formatting/control-plane repair, #246 for qs, and ContextualWisdomLab/appguardrail#1106 for scanner false positives.

No self-approval, administrator bypass, force-push, destructive rebase, mutable dependency, stale evidence reuse, or gate weakening is used.

Refs #210, #211, #217, #222, #246, #247.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}