feat(release): verify detached release signatures

[seonghobae]

Scope

Canonical successor to #222, stacked on current #217. This advances #210 from structural signature-presence evidence to a cryptographic operator-verification boundary. It does not publish a release candidate, distribute trust roots, or claim release readiness.

The preserved RED/GREEN lineage verifies detached Ed25519 signatures, rejects forged/substituted/non-canonical evidence and unknown trust identity, exposes bounded verify-release, and uses same-descriptor O_NOFOLLOW JSON/artifact trust boundaries. The signed life-os.release-signature.v1 statement binds source commit, channel, version, artifact name and SHA-256 digest. Trust is never inferred from embedded keys, GitHub actors or model output.

Key issuance/rotation/revocation/custody, Sigstore/cosign identity policy, transparency-log acceptance, publication, install/upgrade/backup/restore and buyer-journey acceptance remain outside this slice.

Current stack

Parent #217 now adopts protected main@b84751674dd92bdcd0e266c7f002cdc43f5a938b as exact head e2965452ddb9227c5a0462a7820f95c70fe11821, preserving #240's repaired CI/Commercial Readiness trigger semantics.

Current child head 4a24880dc90628f25de115c961ac9131b1b7f0a4 is a non-force two-parent descendant of prior child 47a9edaebace6304d2e848505fe9e00823dac0d2 and current parent #217. Fresh compare from e2965452... is ahead-only (behind_by=0) and contains exactly the six signature-verification-owned paths; parent release-evidence files and protected-main workflow blobs are inherited unchanged.

No predecessor review/check evidence transfers after this head move. Keep Draft while #217 is unmerged; after normal parent integration, retarget/restack non-destructively and reacquire exact-head repository/central workflow and current review evidence. Queued, absent, predecessor or skipped evidence is not passing.

Refs #210, #217, #222.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}