[prk-Jr]

Summary

Publishers and vendors need verifiable release bytes, and operators need to distinguish those bytes from ordinary source builds. This PR contains the binary-attestation contract, implementation plans, release build guards, JS composition capture, and the first private Rust producer utilities. It is an implementation PR with explicitly pending release gates.

• Select Fastly default WASM and three native ts executables, with provenance, artifact-specific SPDX, immutable membership, mandatory Fastly/shared-JS byte equality, and bounded native rebuild outcomes.
• Enforce full source identity and checked prebuilt JS in release mode, expose owning package/source/target/variant facts, and preserve the existing development prebuilt flow.
• Replace the introduced Python tooling with a host-only Rust foundation, add native CI coverage, and reconcile the specification and plans with review 5514253951.

The producer bootstrap remains closed. Source/preflight, authenticated acquisition, actual Rust preparation/boundaries/recipes, hosted qualification, signing/publication, and the consumer verifier are not complete. This checkpoint enables no official release or deployment and does not close #1235.

Changes

Files / surface	Result
docs/superpowers/specs/2026-10-09-1235-release-attestation-design.md, feasibility audit, migration addendum and three implementation plans	Define the cohort, evidence graph, trust inputs, reproducibility requirements and completion boundaries; distinguish historical prototypes and pending proofs; remove execution journals and private paths.
crates/trusted-server-release/**, workspace manifest/lockfile	Add private bounded strict-JSON utilities, held-file reads, raw-byte hashing, atomic output and offline schema evaluation; retain exact SPDX schema/license bytes and committed positive/negative fixtures. No core/CLI/JS dependency or fifth canonical asset.
Core build source helper and build_info.rs; CLI/Fastly build scripts and owning readers	Require full source commit in release mode; derive target from Cargo and variant from owning features; report labeled CLI facts and one existing Fastly startup diagnostic; compile out the release CLI checkout fallback.
JS build.rs, inventory/copy/bundle helpers and native fixtures	Require checked inventory for release; preserve legacy development copying without inventory; reject leaf-link bypasses, mutations and unsafe opaque integers; use actual behavioral tests and specific stderr assertions.
JS build/composition/Vitest pipeline and scripts/release/collect-js.mjs	Record conservative contribution/material evidence without changing bundle bytes; fix portable temporary paths, symlink invocation and environment cleanup; keep the complete release tests mandatory in CI and planned A/B producers.
scripts/release/**	Remove introduced Python and validator requirements; retain Node/POSIX adapters, pending qualification data, reviewed seccomp/license bytes and an inert hosted proposal outside registered workflows.
.github/workflows/test.yml, format.yml; crate READMEs and operator guides	Add Linux/macOS native utility/prebuilt tests with nonzero-selection guards and lint/docs checks, full JS fixture selection, external .mjs formatting, and current build-fact/control documentation.
CLI domain lint	Recognize exact standard schema/RDF identifiers with strict token boundaries; retain domain enforcement for lookalikes and continuations.

The governing index-v1 schema, cohort and consumer-policy bytes were preserved during this review correction. Structural schema acceptance does not authorize staging or another artifact; the selected cohort and planned semantic policy enforcement remain narrower.

The initial deployment choice is the validated manual Fastly production route (AC-9). Integrated EdgeZero context checks, staging and recovery are the later AC-8 milestone. Publisher/configuration authority and actual remote execution remain separate #161 claims.

Linked work

Refs #1235, #1213, #1214, #1292 and #161. The packaging and EdgeZero plans describe later reviewed milestones; they are not implemented by this checkpoint.

Test plan

Local platform: macOS 26.6.2 ARM64, Rust 1.95.0 and Node 24.12.0. These results do not qualify macOS 15, native Intel, the GNU compatibility floor, signing/publication or provider submission.

• Full assigned Rust gates: 3,690 passed, zero failed, 13 existing ignored; Fastly default/reuse, Axum, Cloudflare, Spin, parity, native build-digest and release utility tests.
• All adapter/CLI/codegen lint gates, WASM clock lint, Rust formatting, release-tool documentation and the Fastly release-profile development build.
• Full native CLI suite: 896 passed, 18 existing ignored; actual Cargo release-control CLI facts/resource tests: four plus three passed.
• Native JS prebuilt tests: 37 passed and one guarded ignored fixture; including that fixture explicitly: 38 passed. Deliberately raising the parser size limit makes its fixed-contract regression fail.
• Full JS opt-in suite: 51 files, 1,261 passed, no type errors; JS build, lint and formatting. Guard-removal mutations fail their intended regression assertions.
• Docs format/lint/VitePress build, expanded external Markdown/.mjs formatting, workflow actionlint, whitespace checks, staged and committed PR domain lint.
• Independent automated spec and quality reviews for the Rust utility, Node, Rust review-fix and docs/CI scopes. These are not maintainer approval or release qualification.
• Actual supported-host qualification, authenticated bootstrap/acquisition, whole Rust producer recipes and real-artifact SPDX coverage.
• Same-run artifact transfer, project signing/immutable publication rehearsal, consumer evidence verification and authorized live Fastly submission.

Checklist

• Preserve the existing branch and PR; introduce no Python release code.
• Add behavioral tests and retain fail-closed production gates.
• Use existing runtime logging; stdout directives remain limited to Cargo build scripts.
• Commit no operator configuration, secrets or credentials.
• Complete all selected release proofs before official enablement.

[aram356]

Summary

This spec answers #1235 with attested release artifacts, verified deployment and byte-for-byte reproducible builds, then defines Phase 2 contracts for Cloudflare, Spin and Axum. Its trust boundaries are careful: build provenance, release membership, publisher identity and runtime claims are kept distinct, and the no-configuration rule is stated well. The main problems are scope and fit. It makes reproducibility of every artifact an all-or-nothing release gate and ties #1235's closure to Phase 2. It designs past two in-flight PRs (#1214 and #1213) that already change the same mechanisms. It doesn't account for how releases are branched or what the gh verifier needs. Several tool facts (Fastly packing and deploy, --signer-workflow matching, the Spin ABI) also need correcting.

The architecture I recommend preserves four small ownership boundaries:

flowchart TD
    A[Controlled build and composition evidence] --> B[Signing and immutable publication]
    B --> C[Trusted Server verifier library]
    P[Trusted local policy and source approval] --> C
    C --> D[Opaque VerifiedArtifact with retained bytes]
    D --> E[EdgeZero prepared payload and resolved context]
    E --> F[Observed operation state and recovery record]

Loading

Internally, the verifier should separately establish build evidence, official publication and consumer/action authorization before constructing VerifiedArtifact. EdgeZero should preserve payload integrity and own concrete lifecycle operations. It should not implement IAB release policy.

6 of the inline comments below carry a one-click GitHub suggestion: use Commit suggestion (or Add suggestion to batch for several at once) to apply them. The rest describe the change in prose because it spans several sections or lines outside a single contiguous range.

Blocking

🔧 wrench

• One reproducibility gate makes every artifact wait for the hardest one: see inline at line 63
• Strict JS mode should build on #1214, not beside it: see inline at line 265
• The verifier's gh prerequisites and trust chain aren't specified: see inline at line 357
• Build facts should be derived where possible, follow the env naming convention, and reconcile with #1213: see inline at line 559
• Rollout steps 2 and 3 are in an order that can't be executed: see inline at line 787
• Phase 2 in the acceptance criteria keeps #1235 open until Spin migrates: see inline at line 835

❓ question

• Which branch are release tags cut from?: see inline at line 320

Non-blocking

♻️ refactor

• Put the release-index v1 schema in the spec: see inline at line 255
• Build tsjs once per release and require identical embedded JS across artifacts: see inline at line 278
• Cargo's own output already separates host and target units; the wrapper and Syft add a component without adding coverage: see inline at line 294
• Drop RELEASE_SETTINGS_READ_TOKEN and check the published release instead: see inline at line 347
• --signer-workflow is a prefix match; pin the exact certificate identity: see inline at line 380
• The pack output doesn't match "exactly one bin/main.wasm member" (suggestion): see inline at lines 528-529
• State what compute deploy does on the native route (suggestion): see inline at line 553

🤔 thinking

• reusable-sandbox is runtime-gated, so it may belong in the canonical artifact: see inline at line 61
• The A/B gate measures nondeterminism, not environment sensitivity: see inline at line 208
• Separate assurance dimensions from release-cohort selection: see inline at line 208
• The CLI platform baselines exclude common operator hosts: see inline at line 234
• Define SBOM coverage before settling the recorder mechanism: see inline at line 294
• A local reusable workflow ties the signer identity to the source commit: see inline at line 326
• Make the evidence graph and verifier policy normative: see inline at line 357
• The release record gives the tag object for annotated tags, not the commit: see inline at line 361
• The publication record carries the same trust as pinning the artifact digest: see inline at line 473
• The EdgeZero seam is new surface, not an addition to an existing typed one: see inline at line 514
• Validate observed Fastly bindings, not only manifest declarations: see inline at line 514
• Recovery needs retained state and explicit ownership: see inline at line 537
• Specify Cloudflare's actual configuration handoff: see inline at line 650
• Spin's locked SDK targets a WASI 0.3 release candidate, not plain WASIp2: see inline at line 658

🏕 camp site

• Bound verification processes and evidence (suggestion): see inline at line 412
• The "configuration baked into the wasm" claims go beyond CI comments (suggestion): see inline at line 788

⛏ nitpick

• The scaffold is the repository-root file (suggestion): see inline at line 163
• artifact-metadata: write isn't needed for file attestations (suggestion): see inline at line 335

Cross-cutting / body-level findings

• ♻️ Add an explicit threat model. §1 lists each claim and what it doesn't establish, but there is no adversary table. Add one row per adversary (asset or mirror tampering, a malicious evidence-transfer path, a compromised dependency or build script, a rogue tag pusher, a compromised runner image, a compromised operator host, GitHub itself) with its capability, the check that defends against it, and what remains. Each check in the spec can then cite the threat it defends against, which makes it easier to see which checks earn their cost, for example the settings token at line 347 and the publication record at line 473.
• ♻️ Write it as a contract. The spec is about 16,000 words with no BCP 14 keywords (42 lowercase "must", no MUST or SHOULD), and paragraphs such as lines 176, 202 and 208 each carry six to ten requirements without IDs. The test plan and acceptance criteria paraphrase each other without traceability. Suggest requirement IDs with BCP 14 keywords, one table mapping requirement → test → acceptance item → #1235 "Done when", and rationale moved to an appendix. Also give the "release manifest" (line 60) and "release-tools manifest" (lines 288 and 412) names and paths; "manifest" already means edgezero.toml and fastly.toml elsewhere in the spec.
• 🌱 Cloudflare notes for the follow-up spec (§12, lines 642-654):
  • worker-build 0.8.5 downloads the wasm-bindgen CLI (0.2.126), binaryen version_130 and @esbuild/linux-x64 0.28.1 (separate from the JS lockfile's esbuild 0.27.3) with no checksum check. A network-denied recipe needs them pre-seeded with digest checks, through WASM_BINDGEN_BIN, WASM_OPT_BIN and ESBUILD_BIN or its cache layout.
  • Output-changing switches to control include CUSTOM_SHIM, RUN_TO_COMPLETION, COREDUMP/COREDUMP_FLAGS, NO_MINIFY, --no-opt and --panic-unwind. worker-build also adds an sdk workers-rs entry to the wasm producers section.
  • build.sh installs worker-build without --locked and derives its version from Cargo.lock at run time.
  • The .tar.zst canonical archive brings back the archive/member identity question that line 242 avoids for Phase 1. Publishing the members as raw assets plus an attested modules.json inventory keeps every subject a raw file.
  • The versions API silently drops unresolved inherit bindings unless bindings_inherit=strict is set, and inherit/keep_bindings resolve against the latest uploaded version, which may not be the deployed one. Line 650's "fail when unresolved" needs bindings_inherit=strict and an explicit version_id.
• 🏕 Mark the January spec as superseded. docs/superpowers/specs/2026-01-15-attestation-design.md still says **Status:** Proposal and doesn't point here. #1235 says this spec replaces its binary-attestation sections, so a one-line "superseded in part by" banner in that file would keep readers from following it.

CI Status

• cargo fmt: PASS (required)
• cargo test: PASS (required)
• format-docs: PASS (required)
• format-typescript: PASS (required)
• Analyze (actions): PASS
• Analyze (javascript-typescript): PASS
• Analyze (javascript-typescript): PASS
• Analyze (python): PASS
• Analyze (rust): PASS
• browser integration tests: PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• cargo test (axum native): PASS
• cargo test (cross-adapter parity): PASS
• cargo test (ts CLI, native) (macos-latest): PASS
• cargo test (ts CLI, native) (ubuntu-latest): PASS
• CLAUDE.md symlink guard: PASS
• CodeQL: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• prepare integration artifacts: PASS
• vitest: PASS

[aram356]

Closing PR since split into phases See #1435 and #1449