Spaces:
Running
Running
a11oy — UDS v0.3.1 Release Plan
Repo: szl-holdings/a11oy
Plan date: 2026-05-29
Target cut: 2026-06-10 (T-6 before Warhacker, 2026-06-16)
Doctrine: v6 (strict) — no fake catalog claims, honest STAGED labels
What v0.3.0 Has (landed 2026-05-29)
| Item | Status | Evidence |
|---|---|---|
| Source tarball on Hugging Face | ✓ DONE | SZLHOLDINGS/a11oy-source · a11oy-uds-0.3.0.tar.zst |
| sha256 of tarball | ✓ DONE | 96a301140ef24c886718e91d122ade83b8db26696ec48681b46653cd753410b8 |
| SPDX SBOM in release | ✓ DONE | Generated by sbom.yml CI workflow |
| L6 policy gates (5 anchor formulas) | ✓ DONE | PR #86 merged · 584 lines across adversarialRobustness, falsePosition, liuHuiPi, madhavaBound, summationInvariant |
| DSSE attestation chain | ✓ DONE | ATTESTATIONS.json · spec v1.0 body/signature separation |
| 248 CI assertion tests | ✓ DONE | npm test — all passing |
| Andrew Greene Option-A endorsement | ✓ DONE | 2026-05-22 — authorizes UDS licensing operation, not catalog acceptance |
| Investor-grade docs surface | ✓ DONE | WARHACKER_UDS_PROOF_POINT, INTEGRATION_QUICKSTART, VERIFICATION |
| UDS_FRONTIER_GAP_MAP.md | ✓ DONE | a11oy#94 merged by Cursor proxy |
Release tag uds-v0.3.0 |
✓ DONE | Published 2026-05-29T22:13:02Z |
What v0.3.0 Does NOT Have (Honest)
| Item | Why Missing | Blocker |
|---|---|---|
| Signed binary assets on GitHub release | Agent proxy cannot upload to uploads.github.com |
FA-001 Founder Action |
Cosign attestation (.sig) attached to release |
Same blocker as above | FA-001 Founder Action |
Container pushed to ghcr.io/szl-holdings/a11oy |
Not yet pushed | FA-001 Founder Action |
UDS Package CR (uds.dev/v1alpha1) |
No in-cluster service/selector yet | Engineering task |
What v0.3.1 Will Add
Target: 2026-06-10 cut · All items subject to FA-001 founder action prerequisite
| Item | Description | Prerequisite | Stage |
|---|---|---|---|
| Signed cosign attestation | cosign sign-blob on tarball with org dev key; .sig + .pub attached to GH release |
FA-001: founder runs cosign sign-blob locally |
[STAGED: awaiting FA-001] |
| Full Zarf package | zarf package create produces zarf-package-a11oy-amd64.tar.zst |
Container pushed to GHCR | [STAGED: awaiting container push] |
| Container push to GHCR | docker push ghcr.io/szl-holdings/a11oy:uds-v0.3.1 |
FA-001: founder authenticates docker login ghcr.io |
[STAGED: awaiting FA-001] |
| in-toto provenance | SLSA Build L3 provenance attestation signed with org key | Zarf package + cosign keys | [STAGED: awaiting Zarf + FA-001] |
UDS Package CR |
deploy/manifests/a11oy-uds-package.yaml with ingress/SSO/monitoring/networkpolicy |
Requires real in-cluster service | Engineering task |
Release tag uds-v0.3.1 |
GitHub release with all 4 signed assets: tarball + .sig + .sha256 + .pub |
All above | [STAGED: pending all above] |
Release Schedule
| Date | Milestone |
|---|---|
| 2026-05-29 | v0.3.0 SBOM-only tag published |
| 2026-05-30 – 06-05 | FA-001: founder signs tarballs locally, pushes containers, uploads assets |
| 2026-06-06 | Engineering: UDS Package CR + Zarf package create + validate |
| 2026-06-08 | in-toto provenance generation + CI wiring |
| 2026-06-10 | Cut uds-v0.3.1 across all 6 repos |
| 2026-06-16 | Warhacker demo — live cluster with v0.3.1 stack |
Founder Action Checklist (FA-001)
# 1. Download tarball from HF
pip install huggingface_hub
python3 -c "
from huggingface_hub import hf_hub_download
path = hf_hub_download(repo_id='SZLHOLDINGS/a11oy-source',
filename='a11oy-uds-0.3.0.tar.zst', repo_type='dataset')
print(path)
"
# 2. Verify sha256
sha256sum a11oy-uds-0.3.0.tar.zst
# Expected: 96a301140ef24c886718e91d122ade83b8db26696ec48681b46653cd753410b8
# 3. Sign with cosign
cosign sign-blob --key <org-dev-private-key.pem> \
a11oy-uds-0.3.0.tar.zst \
--output-signature a11oy-uds-0.3.1.tar.zst.sig
# 4. Push container (for v0.3.1)
docker login ghcr.io
docker build -t ghcr.io/szl-holdings/a11oy:uds-v0.3.1 .
docker push ghcr.io/szl-holdings/a11oy:uds-v0.3.1
# 5. Upload signed assets to GitHub release
gh release upload uds-v0.3.1 --repo szl-holdings/a11oy \
a11oy-uds-0.3.1.tar.zst \
a11oy-uds-0.3.1.tar.zst.sig \
a11oy-uds-0.3.1.tar.zst.sha256 \
a11oy-uds-dev.pub
What v0.3.1 Is NOT
- Not UDS Catalog acceptance (requires Andrew Greene sponsor approval + container push + cosign keys — all pending)
- Not a Defense Unicorns product endorsement (Option-A collaboration endorsement only)
- Not a trademark non-objection (counsel review post-Warhacker)
Generated: 2026-05-29 | Doctrine v6 strict | STAGED items clearly labeled