Public release release-09ca780bd67a

Source commit: 09ca780bd67a00467e78139cf38466b8201b66ca

Public tree identity: sha256:2f744c260b5fc2cf074ad9129f97f87f03714902e5b9fe174128afdc342ec2d0

docs/releases.md

@@ -0,0 +1,36 @@
+# Release candidates
+
+Clusterflux release binaries are built once. The public client/node archive and
+the private-source hosted-service archive are both digest-bound to the same
+candidate. The hosted archive is deployed, the strict production-shaped batch
+uses the public archive against it, and finalization copies both archives
+without rebuilding.
+
+Create the candidate in a dedicated directory:
+
+~~~bash
+CLUSTERFLUX_PUBLIC_RELEASE_DIR=target/release-candidate \
+CLUSTERFLUX_ALLOW_INCOMPLETE_RELEASE_EVIDENCE=1 \
+./scripts/prepare-public-release.js
+~~~
+
+Deploy `target/release-candidate/assets/clusterflux-public-binaries-*.tar.gz`.
+Set `CLUSTERFLUX_PUBLIC_RELEASE_MANIFEST` to the candidate manifest while
+running the strict batch. Set `CLUSTERFLUX_QUALITY_GATE_EVIDENCE_PATH` to the
+JSON record from the private and public acceptance commands. The result records
+the source commit, source-tree and
+public-tree identities, candidate binary digests, deployment generation, and
+configuration identity.
+
+Finalize into a different directory after the strict result passes:
+
+~~~bash
+CLUSTERFLUX_PUBLIC_RELEASE_DIR=target/public-release \
+CLUSTERFLUX_RELEASE_CANDIDATE_MANIFEST=target/release-candidate/public-release-manifest.json \
+CLUSTERFLUX_FINAL_RESULT_PATH=target/acceptance/cli-happy-path-live.json \
+./scripts/prepare-public-release.js
+~~~
+
+Finalization rejects a changed commit, source tree, public tree, candidate
+archive, binary digest set, deployment binding, or strict result. It never runs
+the release binary build when a candidate manifest is supplied.