docs/UDS_v0.3.1_RELEASE_PLAN.md

# a11oy — UDS v0.3.1 Release Plan

**Repo:** `szl-holdings/a11oy`
**Plan date:** 2026-05-29
**Target cut:** 2026-06-10 (T-6 before Warhacker, 2026-06-16)
**Doctrine:** v6 (strict) — no fake catalog claims, honest STAGED labels

---

## What v0.3.0 Has (landed 2026-05-29)

| Item | Status | Evidence |
|------|--------|----------|
| Source tarball on Hugging Face | ✓ DONE | `SZLHOLDINGS/a11oy-source` · `a11oy-uds-0.3.0.tar.zst` |
| sha256 of tarball | ✓ DONE | `96a301140ef24c886718e91d122ade83b8db26696ec48681b46653cd753410b8` |
| SPDX SBOM in release | ✓ DONE | Generated by `sbom.yml` CI workflow |
| L6 policy gates (5 anchor formulas) | ✓ DONE | PR #86 merged · 584 lines across adversarialRobustness, falsePosition, liuHuiPi, madhavaBound, summationInvariant |
| DSSE attestation chain | ✓ DONE | `ATTESTATIONS.json` · spec v1.0 body/signature separation |
| 248 CI assertion tests | ✓ DONE | `npm test` — all passing |
| Andrew Greene Option-A endorsement | ✓ DONE | 2026-05-22 — authorizes UDS licensing operation, not catalog acceptance |
| Investor-grade docs surface | ✓ DONE | WARHACKER_UDS_PROOF_POINT, INTEGRATION_QUICKSTART, VERIFICATION |
| UDS_FRONTIER_GAP_MAP.md | ✓ DONE | a11oy#94 merged by Cursor proxy |
| Release tag `uds-v0.3.0` | ✓ DONE | Published 2026-05-29T22:13:02Z |

### What v0.3.0 Does NOT Have (Honest)

| Item | Why Missing | Blocker |
|------|-------------|---------|
| Signed binary assets on GitHub release | Agent proxy cannot upload to `uploads.github.com` | FA-001 Founder Action |
| Cosign attestation (`.sig`) attached to release | Same blocker as above | FA-001 Founder Action |
| Container pushed to `ghcr.io/szl-holdings/a11oy` | Not yet pushed | FA-001 Founder Action |
| UDS `Package` CR (`uds.dev/v1alpha1`) | No in-cluster service/selector yet | Engineering task |

---

## What v0.3.1 Will Add

**Target:** 2026-06-10 cut · All items subject to FA-001 founder action prerequisite

| Item | Description | Prerequisite | Stage |
|------|-------------|--------------|-------|
| Signed cosign attestation | `cosign sign-blob` on tarball with org dev key; `.sig` + `.pub` attached to GH release | FA-001: founder runs `cosign sign-blob` locally | **[STAGED: awaiting FA-001]** |
| Full Zarf package | `zarf package create` produces `zarf-package-a11oy-amd64.tar.zst` | Container pushed to GHCR | **[STAGED: awaiting container push]** |
| Container push to GHCR | `docker push ghcr.io/szl-holdings/a11oy:uds-v0.3.1` | FA-001: founder authenticates `docker login ghcr.io` | **[STAGED: awaiting FA-001]** |
| in-toto provenance | SLSA Build L3 provenance attestation signed with org key | Zarf package + cosign keys | **[STAGED: awaiting Zarf + FA-001]** |
| UDS `Package` CR | `deploy/manifests/a11oy-uds-package.yaml` with ingress/SSO/monitoring/networkpolicy | Requires real in-cluster service | Engineering task |
| Release tag `uds-v0.3.1` | GitHub release with all 4 signed assets: tarball + `.sig` + `.sha256` + `.pub` | All above | **[STAGED: pending all above]** |

---

## Release Schedule

| Date | Milestone |
|------|-----------|
| 2026-05-29 | v0.3.0 SBOM-only tag published |
| 2026-05-30 – 06-05 | FA-001: founder signs tarballs locally, pushes containers, uploads assets |
| 2026-06-06 | Engineering: UDS Package CR + Zarf package create + validate |
| 2026-06-08 | in-toto provenance generation + CI wiring |
| **2026-06-10** | **Cut `uds-v0.3.1` across all 6 repos** |
| 2026-06-16 | Warhacker demo — live cluster with v0.3.1 stack |

---

## Founder Action Checklist (FA-001)

```bash
# 1. Download tarball from HF
pip install huggingface_hub
python3 -c "
from huggingface_hub import hf_hub_download
path = hf_hub_download(repo_id='SZLHOLDINGS/a11oy-source',
                       filename='a11oy-uds-0.3.0.tar.zst', repo_type='dataset')
print(path)
"

# 2. Verify sha256
sha256sum a11oy-uds-0.3.0.tar.zst
# Expected: 96a301140ef24c886718e91d122ade83b8db26696ec48681b46653cd753410b8

# 3. Sign with cosign
cosign sign-blob --key <org-dev-private-key.pem> \
  a11oy-uds-0.3.0.tar.zst \
  --output-signature a11oy-uds-0.3.1.tar.zst.sig

# 4. Push container (for v0.3.1)
docker login ghcr.io
docker build -t ghcr.io/szl-holdings/a11oy:uds-v0.3.1 .
docker push ghcr.io/szl-holdings/a11oy:uds-v0.3.1

# 5. Upload signed assets to GitHub release
gh release upload uds-v0.3.1 --repo szl-holdings/a11oy \
  a11oy-uds-0.3.1.tar.zst \
  a11oy-uds-0.3.1.tar.zst.sig \
  a11oy-uds-0.3.1.tar.zst.sha256 \
  a11oy-uds-dev.pub
```

---

## What v0.3.1 Is NOT

- Not UDS Catalog acceptance (requires Andrew Greene sponsor approval + container push + cosign keys — all pending)
- Not a Defense Unicorns product endorsement (Option-A collaboration endorsement only)
- Not a trademark non-objection (counsel review post-Warhacker)

---

*Generated: 2026-05-29 | Doctrine v6 strict | STAGED items clearly labeled*