Record exact Druff release artifacts

HANDOFF.md

@@ -2,34 +2,34 @@
 
 ## Finished
 
-- Added one opt-in acceptance journey using Druff's production clients against current protected Dander RC32.
-- Confirmed RC32 retains Druff's exact published Control contract bundle bytes.
-- Kept ordinary unit tests network-free and isolated the cross-repository journey in its own configuration.
-- Made browser acceptance use an explicit safe local port when another workspace occupies port 3000.
+- Merged current-Dander compatibility in PR #23 and passed exact-main CI at `34acec00dfc9aafe93a62b1e3ed2b1b807a66487`.
+- Exercised Druff's production clients against protected Dander RC32 at `33801213ee8c1bab78b8847a4b86bd9b4b8d1c63`.
+- Built and retained exact active and rollback multi-platform OCI artifacts with SBOM and provenance attestations.
+- Verified both artifacts are source-free, non-root, read-only, route-complete, and clean under the protected Trivy policy.
 
 ## Try It
 
-Start current Dander with `uv run dander control serve --ephemeral --project demo-project --port 8770`, then run `DANDER_CONTROL_URL=http://127.0.0.1:8770 DANDER_EXPECTED_VERSION=0.9.0rc32 pnpm test:current-dander`.
+Resolve the retained artifacts with `oras resolve --oci-layout /Users/harrison/.codex/artifacts/druff/2026-08-24-release/druff-active-34acec00dfc9.oci.tar:active` or the matching `druff-rollback-55f1565f3cb8.oci.tar:rollback`. For Control API acceptance, start current Dander and run `DANDER_CONTROL_URL=http://127.0.0.1:8770 DANDER_EXPECTED_VERSION=0.9.0rc32 pnpm test:current-dander`.
 
 ## Checks
 
-- Current-Dander acceptance passed against protected Dander commit `33801213ee8c1bab78b8847a4b86bd9b4b8d1c63`.
-- Contract drift, artifact tests, ESLint, TypeScript, Prettier, and all 669 unit tests passed.
-- Production build and all 11 Playwright journeys passed on isolated port 3100.
+- PR #23 and exact-main run `32787930579` passed Frontend quality, Source-free container, and Secret scan.
+- Current-Dander acceptance, contract/artifact checks, lint, types, format, 669 unit tests, and 11 Playwright journeys passed.
+- Both exact artifacts passed reproducible-layer, promotion, archive, amd64/arm64 runtime/export, and Trivy 0.70.0 HIGH/CRITICAL plus secret checks with zero findings.
 
 ## Decisions
 
-- Retain the public RC19 contract artifact pin because RC32's bundle is byte-identical.
-- Verify service compatibility through a real local HTTP application without adding a runtime adapter.
+- Active is merge commit `34acec00dfc9`; rollback is green PR head `55f1565f3cb8`; both share tree `ce829147ef3b`.
+- Retain the public RC19 contract pin because protected RC32's bundle is byte-identical.
+- Keep the release artifacts as local OCI archives; public registry publication remains a separate external action.
 
 ## Remaining
 
-- Merge the focused protected PR after all three required jobs pass.
-- Build, inspect, scan, and retain exact active and rollback OCI artifacts from protected commits.
-- Record their immutable identities and terminal release disposition.
+- No Druff implementation or release-readiness gap remains.
+- Publish or deploy the retained artifact only when a destination is explicitly approved.
 
 ## Review First
 
-- `integration/current-dander-control.test.ts`
-- `playwright.config.ts`
 - `tickets/DRUFF-31-current-dander-release-acceptance.md`
+- `integration/current-dander-control.test.ts`
+- `/Users/harrison/.codex/artifacts/druff/2026-08-24-release/records`

tickets/DRUFF-31-current-dander-release-acceptance.md

@@ -47,3 +47,27 @@ adapter. Normal Vitest excludes the integration directory.
 The smallest release gap is a real-server compatibility check. The current protected Dander bundle
 matches Druff's published pin byte-for-byte, so regenerating DTOs or changing runtime code would be
 false churn.
+
+### 2026-08-24 — release artifact record
+
+PR #23 merged as `34acec00dfc9aafe93a62b1e3ed2b1b807a66487`; exact-main CI run
+`32787930579` passed all three required jobs. Active uses that merge commit. Rollback uses its green
+PR head `55f1565f3cb8d83efb1c38d0552d13808867b1be`; both resolve to tree
+`ce829147ef3b06cc73c4b4c892541977913686cb`.
+
+| Identity | Active | Rollback |
+| --- | --- | --- |
+| OCI index | `sha256:5ab559fe0c637407dd3398304d0480c73477cd770c073c92de4f8f2cda023eb9` | `sha256:bd1228bbe30a7f17ce3d0d9f9f4967e271a9b6fb9d010c8ffb648b2a8c19175d` |
+| linux/amd64 | `sha256:df39b359f7e16f5ed21b9fe429bbd92b5d1bfdf55eede9ae13bfea5bf807a138` | `sha256:128fbb599b7fbaac4f6655210e118e8cd53da30cfaeab7e6fbb3352b0501d77d` |
+| linux/arm64 | `sha256:cda7a83ad5343ca6766d79cb974d740137c77dbae73166c2aab9251a6f09060d` | `sha256:bcccc122f6b9cf15ce9dc4a211fc76a566eb816bb4d53bc4f82914bd623491f6` |
+| Static layer | `sha256:d55b44dceb9c5300c6c709c29d48c442f66b917ed1594c3fe46475b50d43c6cd` | `sha256:09557745dfe7293e457107cc13b1c2185971d992e468220dc7a441eaa96f0a6a` |
+| Static bundle | `904c7eb1629ba7ab60def188acbe4bc7d0db316954ffb91a8684aee5cec50865` | `8b1d86a49d02cf722de45993d7f1cfdee7bb2781e29b78c3b1476add2c761d2b` |
+| OCI archive SHA-256 | `f40cf29112dd02dd639aa2be4fc93d661f1862d8b4bcc01695a1f42f80d33dfc` | `992ee53405f04bc6b47924eda4310a84e41cfd2763d850a3d4db964ab9eb30c4` |
+
+The archives are retained under `/Users/harrison/.codex/artifacts/druff/2026-08-24-release/`.
+Each contains both platforms plus SPDX SBOM and SLSA provenance attestations. Exact promotion kept
+the source index bytes unchanged; isolated repeat builds reproduced the static layer. Both platform
+manifests for both artifacts passed Trivy 0.70.0 vulnerability and secret scanning with zero
+HIGH/CRITICAL or secret findings. Both platforms also passed exported source-free checks and
+read-only runtime route, probe, cache, and security-header verification. The production clients
+passed again from protected Druff against protected Dander RC32 after the artifacts were retained.