The public verifier release now publishes an explicit trust-root profile registry. That makes the signer and witness path inspectable instead of hiding it behind one hard-coded synthetic identity or an unstated future plan.
The current public reference release still defaults to the synthetic signer and synthetic release witness. That keeps the bundle public-safe and replayable without implying a production publication root that does not exist yet.
See the current public releaseThe runtime now also exposes environment-override profiles for release signing and release attestation. That means the move to non-synthetic publication roots is now an explicit contract and resolver path, not only a roadmap item.
Inspect the verifier contractEach profile pins the expected actor type, role, and trust policy. Release signing stays in the verifier-service lane. Release attestation stays in the independent-witness lane.
View actor identities and trust policyThe registry distinguishes synthetic reference roots from environment-supplied roots. That matters because a public-safe demo bundle and a live publication root should not be described as the same thing.
Open trust-root profilesThe public release does not yet claim that a real production trust root is in use. The new profiles make the migration path explicit, but the published bundle still defaults to synthetic identities unless a live root is configured.
Read the trust-model boundaryWithout this registry, the public release can only say “signed” or “attested.” With it, the bundle can say whether it used the reference synthetic roots or an explicitly selected release identity path.
See how release artifacts are publishedThe public reference bundle now ships the registry, the resolver path, and the live placeholders. The remaining gap is exercising those non-synthetic roots in an actually published release line.
Track the remaining hardening work