Full RC Release Rehearsal

A NON_PRODUCTION RC release rehearsal was completed on 28 August 2026. It used synthetic dual-architecture candidate inputs, invoked the real candidate-bundle assembler, and then inspected the candidate index, evidence files, and all six files intended for a future immutable origin. The repository release contracts and test suite ran as part of the same rehearsal.

The result is completed-non-production, not GA approval. The rehearsal read no production private key, Apple credential, or production-origin configuration. It performed no real Developer ID signing, notarization, upload, atomic pointer transition, or public publication, and it produced no real installer for users. Every rehearsal phase carries productionCredit: none.

Inspect the machine-readable rehearsal record, the RC rehearsal schema, or the Release Manifest page.

What the rehearsal verified

• Synthetic input can enter only through the explicit --fixture-only mode and cannot be mistaken for a real candidate.
• Candidate aggregation, index binding, exact byte sizes, and SHA-256 values follow the release contracts.
• The Release Manifest, latest pointer, platform matrix, and platform-acceptance contracts are pinned in the rehearsal record.
• Release-test output is retained and verified as test-only evidence.
• A candidate cannot contain a published manifest, signature, or latest metadata that the runtime would accept.
• Publication, production-secret, and production-origin capabilities remain disabled throughout.

Problems found and fixed

The rehearsal found that the Artifact Runtime lockfile hash had changed while its evidence manifest still pinned the previous digest. The evidence record and runtime manifest were rebound, and the regression test then passed.

It also exposed a sequencing cycle: macOS candidate construction required product media to be GA-ready, while media GA required the final candidate index, package hashes, and platform acceptance. The workflow is now split into two stages. A private candidate is built and accepted first; real product media is then bound to those candidate bytes and reviewed. Only promotion requires media GA, and that gate must pass before a production private key is read or a production origin is accessed.

Why publication is still blocked

Production remains blocked because these facts do not yet exist:

1. a verifiable canonical Git source identity, clean release tree, and formally signed tag;
2. protected native macOS arm64 and x64 runners, real Developer ID credentials, and Apple notarization credentials;
3. real install, first-launch, upgrade, recovery, and platform-acceptance evidence bound to the same candidate;
4. final-RC bilingual product media, rights review, and a 14-day soak;
5. a real publisher, brand clearance, official domain, and support, security, privacy, and legal contact channels;
6. an immutable HTTPS origin, a provider-specific CAS or atomic publication adapter, and final readback evidence.

Downloads, automatic updates, and claims such as “publicly released,” “production ready,” or “platform acceptance complete” remain disabled until every gate closes.