feat(delivery): add bounded offline release tooling

2026-10-12 15:15:00 +08:00
parent f576756359
commit 6733d4e435
10 changed files with 1007 additions and 2 deletions
@@ -0,0 +1,30 @@
+# Offline release tooling
+
+This package is an operator composition tool. `policy` validates delivery bounds,
+`manifest` inventories/verifies explicit files, and `build` runs the locked trusted
+checkout build and copies only tracked application/deployment sources, fresh
+production dependencies and separately fingerprinted public runtime inputs.
+It does not import domain ORM/repositories, write application state, implement a
+second migration path, execute student code or perform Sandbox privilege work.
+`scripts/check_architecture.py` enforces its application import boundary.
+
+All dependency resolution for a release uses existing lockfiles and offline
+caches. Backend source is shipped with locked production dependencies rather
+than invoking an unpinned isolated wheel build backend. uvx/pip and package
+startup path hooks are not delivery runtime entry points. Build inputs specify a
+verified public runtime inventory and the three existing image catalogs; an
+independent expected SHA-256 binds each input. Real input paths/receipts are local
+operator data and do not belong in Git.
+
+```sh
+python3.13 -m scripts.release build --repo /native/checkout \
+  --inputs /private/build-inputs.json --output /private/new-bundle \
+  --work /private/new-build-work
+```
+
+The checkout must be clean and committed, build output/work directories new,
+and the output filesystem have the required reserve. The resulting receipt
+contains the source and manifest fingerprints, file count and byte total, with
+`installed=false` and `execution_verified=false`. Installation and service
+acceptance remain separate operations. See `deploy/release/README.md` for the
+versioned installation contract and authority split.