[prk-Jr]

Summary

• Open Phase 1 as an incremental draft for visibility. The current committed diff contains the phased contract, implementation plan, inventory and historical evidence only; the release workflow, SBOM tooling, operator guidance and release checks are pending.
• Reduce the first release to four attested binaries: Fastly wasm and the Linux x86_64, macOS ARM64 and macOS Intel ts executables. Phase 1 will provide provenance, artifact-specific Cargo/npm SBOMs, immutable release assets and GitHub CLI verification, with configuration independence enforced in CI. Phase 1 makes no reproducibility claim.
• Preserve the reviewed destination design and every source-diff path from #1262, frozen at 122b78664b1235c717e9208fd200f9a9b0c335df. The 434-path inventory assigns later work to Phase 2 slices; source PR progress and its ordinary-CI runs are historical evidence, not validation of this branch.

Changes

File	Change
docs/superpowers/specs/2026-10-09-1235-release-attestation-design.md	Preserve the source contract; add controlling Phasing section and per-requirement phase labels.
docs/superpowers/plans/2026-10-13-attested-release-implementation.md	Add Phase 1 checklist, acceptance mapping and Phase 2 slice plan; replace source task-status snapshot with frozen-source/run references; add per-task phase labels.
docs/superpowers/plans/binary-attestations-slice-map.json	Assign all 434 frozen-source diff paths exactly once, with source and shaping-commit references.
docs/superpowers/specs/2026-01-15-attestation-design.md	Retain the source branch's historical-spec pointer.
docs/superpowers/specs/2026-10-12-1235-release-attestation-feasibility.md	Retain reviewed feasibility findings and unresolved qualification boundaries.
docs/superpowers/specs/2026-10-14-release-tooling-rust-migration.md	Retain the destination Rust producer migration constraint.
docs/superpowers/specs/schemas/release-index-v1.schema.json	Preserve the destination schema unchanged. Phase 1 does not introduce the custom index/verifier.
docs/superpowers/plans/2026-10-13-cli-packaging-attestation-integration.md	Preserve separate CLI packaging follow-up.
docs/superpowers/plans/2026-10-13-fastly-prebuilt-edgezero-integration.md	Preserve separate EdgeZero integration follow-up.
scripts/release/js-composition.md	Preserve the linked source composition narrative.
scripts/release/qualification/2026-10-15-consumer-real-fixtures.md	Preserve historical consumer fixture evidence.
scripts/release/qualification/2026-10-15-js-two-builds.md	Preserve historical JS comparison evidence.
scripts/release/qualification/2026-10-16-confined-cargo-candidate.md	Preserve historical confined Cargo candidate evidence.
scripts/release/qualification/2026-10-16-fastly-canonical-reproduction-equality.md	Preserve historical Fastly comparison evidence.
scripts/release/qualification/2026-10-16-fastly-runtime-gate.md	Preserve historical Fastly runtime evidence.
scripts/release/qualification/2026-10-16-linux-cli-candidate.md	Preserve historical Linux CLI candidate evidence.
scripts/release/qualification/2026-10-16-producer-normalized-manifests.md	Preserve historical normalized-manifest evidence.
scripts/release/qualification/2026-10-19-apple-sdk-inputs.md	Preserve historical Apple SDK findings.
scripts/release/qualification/2026-10-20-apple-cli-candidates.md	Preserve historical Apple CLI candidate evidence.
scripts/release/qualification/2026-10-20-linux-cli-gnu-follow-up.md	Preserve historical GNU follow-up evidence.
scripts/release/qualification/2026-10-21-candidate-release-index.md	Preserve historical candidate-index evidence.
scripts/release/qualification/2026-10-21-four-asset-candidate-join.md	Preserve historical four-asset join evidence.
scripts/release/qualification/2026-10-21-native-reproduction-schedule.md	Preserve historical native comparison scheduling evidence.

Pending implementation: .github/workflows/release.yml, Phase 1 SBOM/preflight tooling and tests, verification/deployment documentation, and configuration-independence enforcement. These are planned scope, not current functionality.

Preservation and phase boundaries

Original specification sentences remain unchanged; additions establish Phasing and per-requirement phase labels. The implementation plan's original Current task status — 2026-10-21 section is replaced by Historical progress references, which points to the exact frozen source and CI runs. Its other changes add Phasing and per-task labels. All other imported source documents are byte-identical to that source commit.

The review boundaries remain distinct: controlled builds/composition, signing/publication, verifier/policy, retained verified bytes, EdgeZero prepared context, and operation recovery. Phase 1 implements ordinary pinned builds and conservative SBOM coverage, standard GitHub attestation/release primitives, and documented GitHub CLI verification. Confined recipes, complete composition evidence, the custom verifier, retained-byte values, publication owner and same-commit validation remain Phase 2+. EdgeZero and additional adapters remain follow-ups. The original #1262 remains open and frozen.

Human release gates remain pending: maintainers enable immutable releases and protected tags; a user-provided throwaway fork rehearses signing with separate approval for each tag; the first real release tag requires explicit authorization. This draft does not authorize repository settings changes, tags, signing, publishing or deployment.

Spec

Spec: Release artifact attestation and verified consumption, preserving the review history from #1262. The reduced scope uses that reviewed contract; no new specification approval cycle is introduced.

Plan: Phased implementation and remaining-work inventory.

Test plan

The current committed scope is documentation only. Runtime, workflow and release verification are pending; historical CI results linked in the imported documents do not validate this branch.

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check — documentation commits b772cd38e and be81ca871
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Targeted documentation Prettier and domain checks — documentation commits b772cd38e and be81ca871
• Full docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Inventory verification: 434 unique paths, matching the frozen source diff exactly
• Independent review of imported documentation and additive phase boundaries
• Implementation tests, actionlint, touched build gates, full required CI, independent implementation/security review
• Human-approved throwaway-fork release rehearsal and immutable release readback

Checklist

• Reviewed source spec and its review history linked above
• Documentation follows AGENTS.md conventions
• No production code changed in the documentation commits b772cd38e and be81ca871
• New implementation has tests
• No secrets or credentials committed
• Phase 1 implementation and release acceptance complete
• Ready for review — retain draft status; no reviewer request