Release Trust Roots

Release identity is now a published contract.

The public verifier release now publishes an explicit trust-root profile registry. That makes the signer and witness path inspectable instead of hiding it behind one hard-coded synthetic identity or an unstated future plan.

Synthetic reference roots

Default public release path

The current public reference release still defaults to the synthetic signer and synthetic release witness. That keeps the bundle public-safe and replayable without implying a production publication root that does not exist yet.

See the current public release
Environment override roots

Implemented live-root path

The runtime now also exposes environment-override profiles for release signing and release attestation. That means the move to non-synthetic publication roots is now an explicit contract and resolver path, not only a roadmap item.

Inspect the verifier contract

What the registry says

Who

Actor type and role

Each profile pins the expected actor type, role, and trust policy. Release signing stays in the verifier-service lane. Release attestation stays in the independent-witness lane.

View actor identities and trust policy
How

Synthetic fallback vs environment override

The registry distinguishes synthetic reference roots from environment-supplied roots. That matters because a public-safe demo bundle and a live publication root should not be described as the same thing.

Open trust-root profiles
Boundary

What still is not claimed

The public release does not yet claim that a real production trust root is in use. The new profiles make the migration path explicit, but the published bundle still defaults to synthetic identities unless a live root is configured.

Read the trust-model boundary
Why this matters

Without this registry, the public release can only say “signed” or “attested.” With it, the bundle can say whether it used the reference synthetic roots or an explicitly selected release identity path.

See how release artifacts are published
Current state

The public reference bundle now ships the registry, the resolver path, and the live placeholders. The remaining gap is exercising those non-synthetic roots in an actually published release line.

Track the remaining hardening work