spec-005: production readiness — real pins, zero placeholders, cross-firewall scaffolding#61

Merged

jeremymanning merged 11 commits intomainfrom

005-production-readiness

May 7, 2026

Commits on Apr 19, 2026

docs(spec-005): production-readiness spec, plan, research, data-model, contracts, tasks

jeremymanning
and
claude
committed
feat(spec-005/phase-1+pins): infrastructure + real AMD/Intel/Rekor pinned fingerprints

jeremymanning
and
claude
committed
feat(spec-005/phase-2): error variants, new types, production feature wiring, release docs

jeremymanning
and
claude
committed
feat(spec-005/us1): cross-firewall mesh scaffolding — WSS/443, DoH, relay-reservation, dial-logging

jeremymanning
and
claude
committed
feat(spec-005): daemon load metric + dial-failure logging + CLI flags + drift-check pipeline

jeremymanning
and
claude
committed
feat(spec-005/us2): remove attestation bypass under production feature + real Rekor P-256 verification

jeremymanning
and
claude
committed
feat(spec-005/us7): eliminate ALL production placeholders — SC-006 gate PASSES

jeremymanning
and
claude
committed
feat(spec-005/us3): real Firecracker rootfs assembly — mkfs.ext4 + loopback + tar extraction

jeremymanning
and
claude
committed
feat(spec-005/us4): real cluster + churn harnesses; fix verify-no-placeholders pipefail bug

jeremymanning
and
claude
committed
feat(spec-005/us8): release engineering scripts — reproducible build, sign, verify, timed quickstart

jeremymanning
and
claude
committed
chore(spec-005/polish): fmt + clippy cleanup + CLAUDE.md honest status + test-build chain acceptance

jeremymanning
and
claude
committed