Verify final v1.2.1 Candidate and publish

[BrettKinny]

This was generated by AI during triage.

Type: HITL

Parent

• Release v1.2.1 from one qualified Candidate #125

What to build

Verify the protected v1.2.1 Candidate and complete the automated publication decision. Physical amd64/arm64 and desktop-platform qualification are not release gates for v1.2.1.

Acceptance criteria

• Record the final version, source SHA, multi-architecture digest, and links to the completed automated Evidence.
• Confirm release.json, version file, MOTD, checked-out source ref/SHA, repository, and digest agree.
• Verify every asset against SHA256SUMS, the checksum Sigstore bundle against the exact workflow/tag identity, and the image identity signature.
• Confirm stable installers cannot discover the draft before approval and required assertion Evidence is complete.
• Confirm the active release-tag ruleset rejects update/deletion and the peeled tag SHA equals the Candidate source SHA.
• Approve the protected stable environment only after all automated gates pass, publishing without rebuilding.
• Verify the immutable GitHub Release attestation plus GitHub and GHCR latest identities.
• Rerun an older stable workflow or equivalent dry-run and confirm neither latest pointer can rewind.
• Record an explicit promote/no-promote decision and follow-up defects here.

Blocked by

• Release v1.2.1 from one qualified Candidate #125

[BrettKinny]

This was generated by AI during triage.

Partial physical-hardware qualification completed for amd64 only. This is not a promotion approval.

Identity:

• Version/tag: v1.2.0
• Source SHA: d1b676b7475b855e912f98d51dad136ea4bb9b4b
• Candidate digest: sha256:39aece45244763c75122875d7722a1beac4f3cd1fcda84b29ebbf066ddf4884e
• Physical host: Arch Linux, x86_64, kernel 7.1.4-arch1-1, UID/GID 1000:1000
• Runtime: Docker Engine 29.6.2, Compose 5.3.1
• Candidate workflow: https://github.com/SquareWaveSystems/squarebox/actions/runs/30616998950

Passed on physical amd64:

• Pulled the Candidate by the exact digest; local inspection reports linux/amd64 and the exact repository digest.
• Native start reports x86_64; /usr/local/lib/squarebox/VERSION and MOTD both report v1.2.0.
• Authenticated draft assets were independently downloaded; every SHA256SUMS entry passed. release.json agrees on version, source ref/SHA, repository, and digest.
• Cosign verified SHA256SUMS.sigstore.json and the image signature against https://github.com/SquareWaveSystems/squarebox/.github/workflows/e2e.yml@refs/tags/v1.2.0 and the GitHub Actions OIDC issuer.
• Fresh Compose start and force recreation used the exact digest. The replacement had a new container ID, retained the install-identity label, and preserved markers in both Workspace and Managed home. Isolated test resources were removed afterward.
• The production installer with explicit SQUAREBOX_TAG=v1.2.0 received the expected public API 404 while the Release is a draft; its cloned checkout was cleaned and no Docker volume was created.
• Annotated tag peels to the exact source SHA. Active refs/tags/v* ruleset still blocks update and deletion with no bypass actors.
• Public GitHub latest remains immutable v1.1.0; GHCR latest remains sha256:0e240dc74f3bc49b49d9a276a50477412be81b0aac704452bf7adab1bac25780, not the v1.2 Candidate.
• Required Candidate Evidence, signing, and draft-adapter jobs all passed.

Still required before this issue can pass:

• Repeat native pull/start, identity, signature, and retained-home Compose checks on physical arm64.
• Complete linked platform qualifications Qualify v1.2 Linux Docker and interactive setup #126-Validate v1.2 Dev Containers and Codespaces #130.
• Only then approve stable-release, verify immutable publication and both latest pointers, and run the no-rewind check.

Current decision: NO-PROMOTE (external platform gates remain open).

[BrettKinny]

This was generated by AI during triage.

Final update for the v1.2.0 Candidate: NO-PROMOTE confirmed after #130 reproduced Managed-home loss on Dev Container rebuild. The protected publication workflow has been cancelled without approval.

The fix merged as #139 at main SHA a2bfdd6d35ef6c7239690cf481f23b0c7f18faa2, so it is necessarily outside the protected v1.2.0 tag. This qualification issue remains open and must be rerun against the new final Candidate digest after the release version is advanced.

[BrettKinny]

This was generated by AI during triage.

v1.2.1 qualification rollover

This issue now targets the future protected v1.2.1 Candidate. Existing
v1.2.0 amd64 evidence remains historical NO-PROMOTE evidence and must not be
credited to the new source, digest, assets, or tag. Both physical architectures
and every linked platform gate must be qualified again against v1.2.1 before
stable approval.