Skip to content

feat: release/signed-bundle-envelope-and-branch-protection #99

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mdheller merged 9 commits into from
Jul 18, 2026
Merged

feat: release/signed-bundle-envelope-and-branch-protection #99

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
4032ba8
Add signed release bundle envelope schema
mdheller May 4, 2026
88d2166
Validate SignedReleaseBundleEnvelope examples by kind
mdheller May 4, 2026
566d0b1
Add unsigned release bundle envelope example
mdheller May 4, 2026
3760ced
Add signed-placeholder release bundle envelope example
mdheller May 4, 2026
a575e44
Document signed release bundle envelope
mdheller May 4, 2026
e7256de
Require signed release envelope schema mapping in package validation
mdheller May 4, 2026
802da73
Link signed release envelope docs
mdheller May 4, 2026
7a670ff
Document branch protection and required checks
mdheller May 4, 2026
bbf1da9
merge: resolve conflicts keeping all content from both sides
mdheller Jul 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ Agent Machine is a bootstrap runtime-control substrate for SourceOS agent worklo
| [AgentRegistryGrant resolution](architecture/agent-registry-grant-resolution.md) | Local Agent Registry grant resolver and fail-closed missing-grant behavior. |
| [Image digest pinning and provenance](architecture/image-digest-pinning-and-provenance.md) | Supply-chain strict-mode gate for digest-pinned release-candidate artifacts. |
| [Release evidence bundle](architecture/release-evidence-bundle.md) | Deterministic validation/source/inventory/render/supply-chain/readiness bundle. |
| [Signed release bundle envelope](architecture/signed-release-bundle-envelope.md) | Signing envelope contract for release evidence bundles. |
| [Signed release bundle envelope](architecture/signed-release-bundle-envelope.md) | Signing/verification envelope around a release evidence bundle. |
| [Runtime package layout](architecture/runtime-package-layout.md) | Migration from loose scripts to `src/agent_machine/` package modules. |
| [Homebrew Python dependencies](architecture/homebrew-python-dependencies.md) | Current dependency strategy for render/evaluation commands. |
Expand Down Expand Up @@ -133,4 +134,5 @@ Current blockers:
- TopoLVM runtime integration beyond skeleton manifests;
- provider discovery and controlled provider activation implementation;
- M2 Asahi host measurement/provider readiness data;
- rollback, teardown, and wipe workflows.
- rollback, teardown, and wipe workflows.
- rollback, teardown, and wipe workflows.
1 change: 1 addition & 0 deletions src/agent_machine/contracts.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ def schema_by_kind(root: Path | None = None) -> dict[str, Path]:
"InferenceProvider": base / "inference-provider.schema.json",
"PolicyAdmission": base / "policy-admission.schema.json",
"ReleaseEvidenceBundle": base / "release-evidence-bundle.schema.json",
"SignedReleaseBundleEnvelope": base / "signed-release-bundle-envelope.schema.json",
"RuntimeInstallReceipt": base / "runtime-install-receipt.schema.json",
"SignedReleaseBundleEnvelope": base / "signed-release-bundle-envelope.schema.json",
"SteeringArtifactReceipt": base / "steering-artifact-receipt.schema.json",
Expand Down
Loading