feat(security): authenticate BLAKE3-owned updates

.github/workflows/release.yml

@@ -113,6 +113,15 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          submodules: recursive
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          toolchain: "1.95.0"
+
+      - name: Install pinned b3sum
+        run: cargo install b3sum --version 1.8.5 --locked
 
       - name: Download all binary artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -192,14 +201,17 @@ jobs:
       - name: Generate checksums
         run: |
           cd artifacts
-          sha256sum *.tar.gz > SHA256SUMS.txt
+          b3sum -- ./*.tar.gz | sed 's#  \./#  #' > BLAKE3SUMS.txt
+          sha256sum -- ./*.tar.gz | sed 's#  \./#  #' > SHA256SUMS.txt
+          cat BLAKE3SUMS.txt
           cat SHA256SUMS.txt
 
       - name: Attest release provenance
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: |
             artifacts/*.tar.gz
+            artifacts/BLAKE3SUMS.txt
             artifacts/SHA256SUMS.txt
 
       - name: Install cosign
@@ -210,15 +222,42 @@ jobs:
           COSIGN_YES: "true"
         run: |
           cd artifacts
-          for asset in *.tar.gz SHA256SUMS.txt; do
+          for asset in *.tar.gz BLAKE3SUMS.txt SHA256SUMS.txt; do
             cosign sign-blob --yes --bundle "${asset}.sigstore.json" "$asset"
           done
 
+      - name: Verify release signatures
+        run: |
+          cd artifacts
+          IDENTITY="https://github.com/astrid-runtime/astrid/.github/workflows/release.yml@refs/tags/${GITHUB_REF_NAME}"
+          ISSUER="https://token.actions.githubusercontent.com"
+          for asset in *.tar.gz BLAKE3SUMS.txt SHA256SUMS.txt; do
+            cosign verify-blob \
+              --bundle "${asset}.sigstore.json" \
+              --certificate-identity "$IDENTITY" \
+              --certificate-oidc-issuer "$ISSUER" \
+              --use-signed-timestamps \
+              "$asset"
+          done
+
+      - name: Verify release archives with the native updater policy
+        env:
+          ASTRID_RELEASE_GATE_ARTIFACTS: ${{ github.workspace }}/artifacts
+          ASTRID_RELEASE_GATE_VERSION: ${{ github.ref_name }}
+          CARGO_BUILD_JOBS: "1"
+        run: |
+          ASTRID_RELEASE_GATE_VERSION="${ASTRID_RELEASE_GATE_VERSION#v}"
+          export ASTRID_RELEASE_GATE_VERSION
+          cargo test -p astrid --bin astrid --locked \
+            commands::update_auth::tests::release_gate_authenticates_all_archives_with_production_policy \
+            -- --ignored --exact
+
       - name: Create release
         uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           files: |
             artifacts/*.tar.gz
+            artifacts/BLAKE3SUMS.txt
             artifacts/SHA256SUMS.txt
             artifacts/*.sigstore.json
           body_path: release-notes.md

CHANGELOG.md

@@ -51,6 +51,41 @@ Changelog tracking starts with 0.2.0. Prior versions were not tracked.
   treats the stored `key_id` as informational and re-derives it from the public
   key, so existing local profiles self-heal; device-scoped bearer sessions must
   authenticate again after upgrading.
+- **Self-managed updates now authenticate the release publisher before any
+  archive is extracted or installed.** The updater requires a Sigstore bundle
+  for the exact archive bytes, verifies it with fresh public-good trust
+  material, and pins the certificate to Astrid's release workflow, repository,
+  tag, and GitHub Actions issuer. Only an authenticated archive can enter the
+  independent BLAKE3 integrity stage; missing, duplicated, malformed, or
+  mismatched evidence fails closed with a distinct publisher-authentication or
+  integrity error. Homebrew and Cargo installs remain delegated to their
+  package managers, and the signed SHA-256 compatibility manifest remains
+  available to downstream tooling. Before publishing, release automation now
+  requires both Cosign and the updater's native production verifier to accept
+  every generated archive and bundle pair. Existing v0.9.x self-updaters cannot
+  enforce the new publisher policy retroactively; it applies from the first
+  release containing this updater onward. Closes #1250.
+
+- **Astrid-owned identifiers now use domain-separated BLAKE3.** Invite and
+  pair-device token stores carry an explicit schema and invalidate
+  legacy SHA-256 records that cannot be rehashed without their raw secrets;
+  newly issued bearer tokens use type-specific `astrid_inv_` and
+  `astrid_pair_` prefixes, while fingerprints use an explicit `blake3:` label.
+  CLI key metadata self-heals from the retained public key. Public-key
+  fingerprints share a typed derivation primitive, MCP binary pins now carry
+  an honest `blake3:` label, and gateway env-write logs no longer expose
+  dictionary-testable fingerprints of low-entropy values. External SHA-based
+  protocols such as SRI, Git, and registry checksums remain unchanged. Closes
+  #1247.
+
+- **Astrid release archives now use BLAKE3 as their primary integrity
+  manifest.** Release automation publishes, signs, and attests
+  `BLAKE3SUMS.txt`, while retaining a signed `SHA256SUMS.txt` compatibility
+  manifest for Homebrew and existing downstream tooling. Self-managed updates
+  require a strict lowercase BLAKE3 entry and reject absent, malformed,
+  duplicate, or SHA-only manifests. Existing v0.9.x installations can still
+  cross the boundary through the compatibility manifest. External protocol
+  requirements remain unchanged. Closes #1249.
 
 - **Runtime E2E now stages the pinned Unicity AOS monorepo.** The workflow
   preserves the AOS Cargo workspace outside the core checkout and supplies