v3.5.0 Release Readiness Checklist

This document tracks the release readiness checklist for MultiModel Dev OS v3.5.0. The v3.5.0 milestone represents the integration of HMAC-SHA256 provenance lockfiles, Ed25519 public-key signature checks, and the trusted publisher key store.

---

Release Governance Status

WARNING

Status: Pending (Internal Preparation) This is an unreleased internal development build. Do not tag, publish to npm, or mark v3.5.0 as released.

---

Readiness Checklist

1. Cryptography and Identity Trust

• [x] Ed25519 Public-Key Signatures: Asymmetric signing and timing-safe verification verified end-to-end using Node.js built-ins.
• [x] Zero Runtime Dependencies: Cryptographic functions use native Node crypto only.
• [x] Trust Store: Key loading and parsing validated with active status, expiration, and scope constraint checks.
• [x] Deterministic Serialization: Canonical payload sorting proven stable and deterministic across platforms.

2. End-to-End Fixtures

• [x] Valid Signed Registry: Proven to pass verification.
• [x] Tampered Manifest: Rejected during verification with signature verification errors.
• [x] Wrong Signing Key: Rejected as untrusted.
• [x] Revoked/Disabled Keys: Correctly blocked by trust store status gates.
• [x] Unsupported Algorithms: Properly rejected by policy validation.
• [x] Lockfile & Provenance Integrity: Local registry-lock.json entries record precise verdicts and error details.

3. Build & Package Hygiene

• [x] Generated CLI Freshness: scripts/check-build-fresh.js validates that bin/multimodel-dev-os.js matches the src/ modules.
• [x] Shebang & Header Validations: Generated binary has exactly one shebang and includes the warning header.
• [x] No Private Keys Committed: No private keys or .ai/registry-signing-key files are tracked by Git.
• [x] Clean Packing Exclusion: Manifest configuration filters out .npmrc, .env, private keys, local tarballs, and temporary smoke directories.

4. Command Safety & UX

• [x] URL Safety Gate: No shell-based URL interpolation is used. Synchronous fetching uses execFileSync arguments.
• [x] Approval Gated Sync: registry sync strictly requires --approved flag before performing network fetches.
• [x] Offline Stability: Registry verification and catalog features operate offline using cache directory fixtures.

5. Verification Metrics

• [x] Unit Test Suite: All unit tests pass cleanly.
• [x] Strict Verification Assertions: scripts/verify.js executes successfully with zero failures.
• [x] Documentation Coverage: Threat models, architecture guides, policies, and roadmap files are updated.