Release train (signed distribution)

Artifacts

• /downloads/releases.json + .sig (tools list)
• /standard/registries.bundle.json + .sig (pack manifests SSoT)
• Per-tool downloads include SHA256SUMS + signature checks (where applicable).

Backward compatibility rules

• Never mutate receipts (upgrades create new receipt objects).
• Additive schema only (fields can be added, not removed).
• Domain separation remains intact (issuance on getevidex.net; verify read-only on verify.getevidex.net).

Operator checklist

1. Run tests.
2. Update changelog.
3. Generate signed distribution artifacts.
4. Publish downloads (no remote scripts).