AWatch-rus/docs/public-issues/003-release-evidence-package.md

Public issue template 003

Title

[release] Produce first release evidence package

Labels

release, registry, evidence

Purpose

Produce the first release evidence package from the Russian build-runner once the runner is available.

Background

Release evidence scripts exist, but the first real release evidence build must run in the Russian build contour before it can be treated as registry evidence.

Scope

• Run release evidence scripts on the Russian build-runner.
• Collect logs, checksums, artifact manifest and command versions.
• Store evidence in the documented Russian storage contour.
• Link evidence from registry documentation after review.

Non-goals

• No claim that release evidence is already produced.
• No publication of secret build logs.
• No runtime, API or UI changes.

Acceptance criteria

• Release evidence manifest exists.
• Build logs are retained with secrets redacted.
• Checksums are recorded.
• Artifact storage path is documented.
• Review note confirms evidence completeness.

Evidence required

• Release manifest.
• Build logs.
• SHA256 checksums.
• Cargo metadata/tree or equivalent dependency evidence.
• Artifact retention note.

Safety/privacy guardrails

• Do not publish credentials, private paths with sensitive data or customer environment identifiers.
• Redact tokens and private repository access details.
• Keep evidence links scoped to approved public-safe material.

Registry-positioning guardrails

• Do not treat GitHub Actions as release evidence.
• Do not claim registry submission is complete.
• Keep evidence pending until artifacts and checksums exist.

Checklist

• Confirm build-runner readiness.
• Run release evidence script.
• Verify generated checksums.
• Store artifacts in Russian contour.
• Review logs for sensitive data.
• Record evidence links.