Public release release-b8454b34d38c

Source commit: b8454b34d38cc2ba0bd278e842060db45d091e1c

Public tree identity: sha256:69d6c8143bf6227e1bb07852aa94e8af9c26793eca252bb46788894f728cb6d2

docs/releases.md

@@ -0,0 +1,34 @@
+# Release candidates
+
+Clusterflux release binaries are built once. The same candidate archive is
+deployed, exercised by the strict production-shaped batch, and copied into the
+final assets without rebuilding.
+
+Create the candidate in a dedicated directory:
+
+~~~bash
+CLUSTERFLUX_PUBLIC_RELEASE_DIR=target/release-candidate \
+CLUSTERFLUX_ALLOW_INCOMPLETE_RELEASE_EVIDENCE=1 \
+./scripts/prepare-public-release.js
+~~~
+
+Deploy `target/release-candidate/assets/clusterflux-public-binaries-*.tar.gz`.
+Set `CLUSTERFLUX_PUBLIC_RELEASE_MANIFEST` to the candidate manifest while
+running the strict batch. Set `CLUSTERFLUX_QUALITY_GATE_EVIDENCE_PATH` to the
+JSON record from the private and public acceptance commands. The result records
+the source commit, source-tree and
+public-tree identities, candidate binary digests, deployment generation, and
+configuration identity.
+
+Finalize into a different directory after the strict result passes:
+
+~~~bash
+CLUSTERFLUX_PUBLIC_RELEASE_DIR=target/public-release \
+CLUSTERFLUX_RELEASE_CANDIDATE_MANIFEST=target/release-candidate/public-release-manifest.json \
+CLUSTERFLUX_FINAL_RESULT_PATH=target/acceptance/cli-happy-path-live.json \
+./scripts/prepare-public-release.js
+~~~
+
+Finalization rejects a changed commit, source tree, public tree, candidate
+archive, binary digest set, deployment binding, or strict result. It never runs
+the release binary build when a candidate manifest is supplied.