Public frozen source downloads

Current measured source release

Published source: a10323dede4413fbf295916b8ad12e3dbad7514e, with measurement evidence committed at 0400fe99a49faa53f9cb3a19bcb75e5299bf4336 under measurements/graviton5-production-a10323d-20260909. Its signed Nitro observation reports state=warming, Graviton5 verification, 43,768,124 iterations per segment, and this exact source commit in software_version. Source publication does not restart the enclave or establish a public relay endpoint or full-duration result.

Readable source SHA256: a860d9d26861580e5dc58f16510eded6d1430f8bdf131a961a7269d646325ce6. Shallow checkout SHA256: d3af8f47a23835d3b4fed9225e86377e0a2b845e82024c6c1734bea1f3f1f8dd. PCR0: 51e61c21424fabbf27f3d8a3e8a6a14af8538752c9d55238b33b00c4bda2e01392ab27131f5769defa33d39270a2f2b7.

The current archive has 446 source files; the shallow object store has 490 objects and exactly one commit. Every source blob matched the frozen tree. The only reviewed scanner false positive was the public report filename formed by "pypi-" + "client-real-nitro-diagnostic.json" under reviews/current/. Raw tree entries are parsed, and only that exact parent tree/name/blob identity is permitted after its file content passed the ordinary blob scan. Git-index entries are likewise matched to the scanned paths/OIDs. No blob, commit or general token-pattern exemption is applied; unknown token-like names still fail. The exception is disclosed in the public manifest. Raw NSM evidence is included as warming-evidence.json and was reverified against the selected source/PCRs.

All eleven objects use conditional PUTs and full-byte anonymous HTTPS readback. The publication proof is reviews/current/public-source-release-a10323dede4413fbf295916b8ad12e3dbad7514e.json. The original release below remains available and unchanged.

Earlier frozen release

Published source commit: 474083ea74d0df069275da613e62a985d6960056. This is the production image observed warming on 2026-09-09, not the later entropy or CBOR revisions. No runtime service or enclave was restarted.

Public HTTPS downloads:

The readable archive is exactly git archive of the frozen commit: 324 source files, each compared against its Git blob ID. It includes the root MIT license, vendored RandomX license, and Python-package licenses. It excludes local state, credentials, build outputs and all Git metadata/history.

The additional checkout was created in a fresh temporary repository with git fetch --depth=1 file://... 474083ea74d0df069275da613e62a985d6960056 and a detached checkout. Its archive contains the same worktree plus only .git/HEAD, config, index, shallow, objects, and an empty refs directory. Every decoded Git object was scanned; the object database contains exactly one commit, with no ancestor history. Remotes, FETCH_HEAD, reflogs and hooks are omitted. A fresh extraction passed exact HEAD, shallow=true, clean-tree and one-reachable-commit checks. This supports the existing build script's Git identity checks without inventing a replacement commit.

Both source forms were scanned for private-key PEM markers, PyPI/OpenRouter/AWS credentials, literal bearer tokens and secret assignments. Excluded state/build paths and executable binary signatures were checked separately. The public AWS Nitro root certificate is intentionally included. The pattern scan found no matches; it is not an exhaustive guarantee about all possible secret encodings.

Production PCR/build/reproduction metadata was copied byte-for-byte from committed evidence at 04d67264ce55d140d42518390fe5b5a855eddf5a, which recorded measurements of the frozen source after its commit. Two independent builds have identical PCR0/PCR1/PCR2; their complete EIF SHA256 hashes differ because the unmeasured EIF metadata differs. The release does not claim identical EIF bytes or that the currently warming image includes later security fixes.

S3 scope and publication

Dedicated bucket: attested-relay-releases-370686332139-us-west-2, region us-west-2, owner account 370686332139. It was created with BucketOwnerEnforced, then versioning was enabled. ACLs remain disabled/ignored. Bucket-local public-block settings permit the narrowly scoped policy in bucket-policy.json: anonymous HTTPS GetObject only under releases/*. No public write, delete, bucket listing, or other-prefix access is granted. Account-wide settings and the separate private archive bucket were unchanged. No deletion, lifecycle or retention operation was performed.

prepare.py regenerates and scans only the selected commit and explicitly pinned metadata, staging locally under ignored .local/public-source-release/ paths. Temporary checkouts and failed preparation artifacts are retained. Existing source/metadata files are reused only when identical. The minimal shallow archive is reused after its Git identity/history/clean-tree checks; temporary index metadata is not expected to be byte-identical between fresh checkouts. Preparation does not contact AWS.

publish.py checks the bucket policy, public-access scope and versioning before upload. Every PUT uses If-None-Match: *, an explicit SHA256 checksum and AES256 server-side encryption. A conflicting existing object cannot be overwritten; an idempotent retry must pass full anonymous readback against the expected hash. All ten public objects were downloaded over unsigned HTTPS and checked in full. The script also verifies anonymous bucket listing and reads outside releases/ return 403. Version IDs and readback evidence are saved in reviews/current/public-source-release.json.

Run the fixed release workflow from the repository root:

python3 deploy/source-release/prepare.py
python3 deploy/source-release/publish.py

The second command is an explicitly publishing operation. It does not create or change bucket policy; the dedicated bucket must already have the reviewed configuration. Replaying it preserves existing objects and writes a new timestamped local proof. These source downloads do not imply a public relay HTTP endpoint, service readiness, completed production timing or an independent retention guarantee. Cloudflare front-door deployment remains separate.

Another frozen source release

Omitting selectors retains the original 474083e release exactly. To select any other evidence, supply all three arguments to both scripts:

python3 deploy/source-release/prepare.py \
  --source-commit a10323dede4413fbf295916b8ad12e3dbad7514e \
  --metadata-commit 0400fe99a49faa53f9cb3a19bcb75e5299bf4336 \
  --metadata-directory measurements/graviton5-production-a10323d-20260909

That example now selects the actual committed Nitro proof. For a future release, select its actual committed proof before invoking publication. Both commits must be full lowercase 40-hex Git commit IDs. The directory must be a canonical relative path under measurements/. Nothing is read from the dirty working tree. Each source commit has a separate staging directory and releases/<source_commit>/ prefix.

The selected evidence must contain pcrs.json, build-info.json, reproducibility.json, reproduce.sh, eif-description-build1.json, eif-description-build2.json, and warming-evidence.json. The first two build descriptions and reproduction metadata must agree on PCR0/PCR1/PCR2; source IDs and EIF hashes must agree too. New-release preparation also requires the attested-relay Python verifier installed (for example, run from the verification venv). It rechecks the actual NSM document at its signed timestamp, nonce, certificate SPKI, all three selected PCRs, Graviton5 policy, and the signed software version's exact source commit. Displayed policy/boolean claims alone cannot satisfy this gate. The authenticated state is a historical observation, which may be warming; no live readiness assertion follows from it.

Only after the real proof passes and the files are reviewed, invoke publish.py with the same three selectors. Missing proof or mismatched old measurements fails before staging/cloud calls. The newer source was published only after its committed proof passed these checks. The new README describes the selected observation and actual EIF-hash comparison; it does not reuse claims about which later patches are absent from the old image. The new manifest includes the selected metadata directory and authenticated observation summary. A different manifest for an already published source commit is rejected before any object upload; the original public release is preserved.

Safe local validation (uses the committed old Nitro proof, not invented new evidence; never invokes publication APIs):

python3 -m unittest discover -s deploy/source-release -p test_release.py -v

AWS documents conditional no-overwrite writes and bucket public-access controls.