Skip to content

Publish recovery candidate 2 evidence #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Chris-ObtuseAI merged 1 commit into from
Aug 4, 2026
+29 −19
Merged

Publish recovery candidate 2 evidence #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions docs/RELEASE_EVIDENCE_0.3.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ packages, public artifacts, and physical two-machine behavior are separate claim
| Desktop, edge, and TypeScript builds | `pnpm check` | PASS — desktop 18, edge 2, SDK 12 tests plus all production builds |
| Proposal-only intelligence | Ruff, mypy, and pytest | PASS — Ruff clean, mypy clean across 9 files, 17 tests |
| NSIS installer and desktop shortcut | `scripts/Smoke-RampageInstaller.ps1` | PASS — install 0, uninstall 0, six payloads, controller/intelligence ready, one signed node and offer, shortcut created then removed, no leaked sidecars |
| Public release assets | [`v0.3.1-recovery.1`](https://github.com/ObtuseAI/rampage/releases/tag/v0.3.1-recovery.1) | PASS — 12 uploaded assets, three source-bound manifests, three checksum files, and GitHub build-provenance attestation |
| Public release assets | [`v0.3.1-recovery.2`](https://github.com/ObtuseAI/rampage/releases/tag/v0.3.1-recovery.2) | PASS — 12 uploaded assets, three source-bound manifests, three checksum files, and GitHub build-provenance attestation |
| Physical owner upgrade and recovery | Public candidate 2 on Windows | PASS — exact public hash, install exit 0, runtime preserved, desktop shortcut present, lifecycle consistent, non-destructive repair restart, controller ready, one resident agent, and one fresh signed offer |
| Physical owner/laptop re-pair | Fresh 0.3.1 installs | PENDING physical laptop action |
| Physical owner-to-laptop view | `scripts/Qualify-RampageRemoteAssist.ps1 -ExpectedVersion 0.3.1` | PENDING live opted-in worker |

Expand All @@ -39,23 +40,28 @@ The source-current Recovery Center capture is

## Public candidate artifacts

The tag-bound GitHub Actions run rebuilt every package from merged commit
`51b4c054748200c76bdc45798e705a75da42d98e`. Its Windows manifest reports version 0.3.1,
The candidate-2 tag-bound GitHub Actions run rebuilt every package from merged commit
`a6b608e4585ddf84702c288c73872a6d1a5f695c`. Its Windows manifest reports version 0.3.1,
and the recommended Windows download returned HTTP 200 with the expected byte length after the
release was published.

| Package | Bytes | SHA-256 |
| --- | ---: | --- |
| `Rampage_0.3.1_x64-setup.exe` | 69,112,909 | `22e4ea85dfc63bb2667b32523409acab1b377b0eebd1ea25c9655df53fe73c9c` |
| `Rampage_0.3.1_x64_en-US.msi` | 78,987,264 | `c6ad9513c9a5667f2964e05034735a5a52bb83033deab92a9a303f601941bb43` |
| `Rampage_0.3.1_amd64.AppImage` | 168,880,632 | `9d6a05bfed97d0367dc6561a14e70317685d74972953ff86dbed27dd705ee16a` |
| `Rampage_0.3.1_amd64.deb` | 98,031,344 | `4745a39166d008ceb0d13c902c40745eeb50975364b1b0b7a7f6c6049f886a5d` |
| `Rampage_0.3.1_aarch64.dmg` | 86,234,740 | `ba00e8feba971d2de6fe19c35cc9ceb978e04bae127b975227f95dbe35d74d04` |
| `Rampage.app.zip` | 84,272,637 | `644aa2d82823dd1bb226de3bc36bf0dc74699da22f977be339f08f83c953aa01` |
| `Rampage_0.3.1_x64-setup.exe` | 69,113,786 | `ee7872088b6a9c72aea7c3c01157d8090cf9db020090a8b8078444d4aa3de38f` |
| `Rampage_0.3.1_x64_en-US.msi` | 78,999,552 | `7973ea3e9a9d53fd576eaba7872cf5683ec0c7b9e3d1eeddcf779a1b12a22ce8` |
| `Rampage_0.3.1_amd64.AppImage` | 168,905,208 | `c27e050e6c9993fcc9e1715506c1d2e2f3eaf89efcb8352251ec9d8ede853ae3` |
| `Rampage_0.3.1_amd64.deb` | 98,046,092 | `7480b85d9f6f155f5dfc49f42b4dbbd873acf0fbc81be940c8e56c741fab68ad` |
| `Rampage_0.3.1_aarch64.dmg` | 86,246,925 | `1c31ece2407183c0952b2e35fbfcd7c96487a34e2dc7537f4dc6f5eec9a5f1a6` |
| `Rampage.app.zip` | 84,285,483 | `46474441e098ffa3af77ef260adb92041c789e503209aac5a6ddb2f82a674190` |

Candidate Windows and macOS packages are intentionally identified as unsigned/not notarized; the
workflow keeps production-signing gates reserved for a future stable channel.

Candidate 1 was superseded after the first physical owner upgrade exposed a false recovery warning:
an owner legitimately self-enrolls its own local agent. Candidate 2 accepts that state only when the
enrollment marker matches the pinned endpoint and the pinned Ed25519 governor key matches this
owner's local controller. Foreign, incomplete, and mismatched identities remain fail-closed.

## Honest boundary

The Recovery Center screenshot is a browser-rendered view of the real React component using labeled
Expand Down
4 changes: 4 additions & 0 deletions docs/RELEASE_NOTES_0.3.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@ Rampage 0.3.1 closes the device lifecycle that a real multi-machine desktop prod
stale, or interrupted pairing no longer requires uninstalling the app or finding hidden runtime
files. Recovery is available from both first-run setup and the main header.

Candidate 2 also recognizes an owner's cryptographically matching self-enrolled local agent without
confusing it for a worker-role conflict. The fix was added after a physical in-place owner upgrade,
and foreign-controller pins remain fail-closed.

## What changed

- **Fix Rampage** safely restarts a consistent native installation without erasing identity or work.
Expand Down
12 changes: 6 additions & 6 deletions docs/SHA256SUMS-0.3.1.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
22e4ea85dfc63bb2667b32523409acab1b377b0eebd1ea25c9655df53fe73c9c Rampage_0.3.1_x64-setup.exe
c6ad9513c9a5667f2964e05034735a5a52bb83033deab92a9a303f601941bb43 Rampage_0.3.1_x64_en-US.msi
9d6a05bfed97d0367dc6561a14e70317685d74972953ff86dbed27dd705ee16a Rampage_0.3.1_amd64.AppImage
4745a39166d008ceb0d13c902c40745eeb50975364b1b0b7a7f6c6049f886a5d Rampage_0.3.1_amd64.deb
ba00e8feba971d2de6fe19c35cc9ceb978e04bae127b975227f95dbe35d74d04 Rampage_0.3.1_aarch64.dmg
644aa2d82823dd1bb226de3bc36bf0dc74699da22f977be339f08f83c953aa01 Rampage.app.zip
ee7872088b6a9c72aea7c3c01157d8090cf9db020090a8b8078444d4aa3de38f Rampage_0.3.1_x64-setup.exe
7973ea3e9a9d53fd576eaba7872cf5683ec0c7b9e3d1eeddcf779a1b12a22ce8 Rampage_0.3.1_x64_en-US.msi
c27e050e6c9993fcc9e1715506c1d2e2f3eaf89efcb8352251ec9d8ede853ae3 Rampage_0.3.1_amd64.AppImage
7480b85d9f6f155f5dfc49f42b4dbbd873acf0fbc81be940c8e56c741fab68ad Rampage_0.3.1_amd64.deb
1c31ece2407183c0952b2e35fbfcd7c96487a34e2dc7537f4dc6f5eec9a5f1a6 Rampage_0.3.1_aarch64.dmg
46474441e098ffa3af77ef260adb92041c789e503209aac5a6ddb2f82a674190 Rampage.app.zip
f5503739ce0f1a069ea067a9bb807639d541872f7f6487a12efcb46fa414366d rampage-recovery-center.png
8 changes: 4 additions & 4 deletions docs/download/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,16 +3,16 @@
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="refresh" content="0; url=https://github.com/ObtuseAI/rampage/releases/download/v0.3.1-recovery.1/Rampage_0.3.1_x64-setup.exe">
<link rel="canonical" href="https://github.com/ObtuseAI/rampage/releases/download/v0.3.1-recovery.1/Rampage_0.3.1_x64-setup.exe">
<meta http-equiv="refresh" content="0; url=https://github.com/ObtuseAI/rampage/releases/download/v0.3.1-recovery.2/Rampage_0.3.1_x64-setup.exe">
<link rel="canonical" href="https://github.com/ObtuseAI/rampage/releases/download/v0.3.1-recovery.2/Rampage_0.3.1_x64-setup.exe">
<title>Download Rampage for Windows</title>
</head>
<body>
<main>
<h1>Rampage for Windows</h1>
<p>Your download should begin automatically.</p>
<p><a href="https://github.com/ObtuseAI/rampage/releases/download/v0.3.1-recovery.1/Rampage_0.3.1_x64-setup.exe">Download Rampage 0.3.1 for Windows x64</a></p>
<p><a href="https://github.com/ObtuseAI/rampage/releases/tag/v0.3.1-recovery.1">Release notes and SHA-256</a></p>
<p><a href="https://github.com/ObtuseAI/rampage/releases/download/v0.3.1-recovery.2/Rampage_0.3.1_x64-setup.exe">Download Rampage 0.3.1 for Windows x64</a></p>
<p><a href="https://github.com/ObtuseAI/rampage/releases/tag/v0.3.1-recovery.2">Release notes and SHA-256</a></p>
</main>
</body>
</html>