clawql-release MVP (Layer 0)
Immutable release manifests for 7.0.0 — GitHub + GHCR anchor (Arweave deferred).
Full source doc: clawql-release-mvp.md
Quick start
clawql release init
clawql release publish --tag v7.0.0 \
--sbom sbom-cyclonedx-repo.cdx.json \
--npm-tgz clawql-mcp-7.0.0.tgz \
--image-digest clawql-mcp=sha256:YOUR_DIGEST \
--image-digest clawql-dashboard=sha256:...
clawql release verify releases/v7.0.0/manifest.json
What gets recorded
| Field | Source |
|---|---|
repository.commit | git rev-parse HEAD |
artifacts.sbom | SHA-256 of CycloneDX file |
artifacts.npm | SHA-256 of npm pack tarball |
images.* | GHCR ref + sha256: digest |
merkleRoot | Merkle tree over all artifact/image leaves |
Verify at runtime
clawql doctor --smoke auto-resolves releases/v{version}/manifest.json when the bundle exists in a git checkout.
MCP startup (optional):
export CLAWQL_RELEASE_MANIFEST=releases/v7.0.0/manifest.json
npx clawql-mcp
Strict mode: NODE_ENV=production or CLAWQL_RELEASE_MANIFEST_STRICT=1.
Related
- Immutable releases — Layer 0 vision and roadmap
- Phase 1 guide — shipped 7.0 capabilities
- Golden image pipeline — Cosign verify for containers