Supply chain and secure releases

Current build checks

Backend CI verifies formatting, static analysis, the module graph, unit/architecture/end-to-end tests, race detection, reachable dependency vulnerabilities, and component images. Agent CI independently verifies its pinned module graph, architecture and recorded compatibility suites, race behavior, executable build identity, and reachable vulnerabilities. Contracts CI regenerates bindings and checks backward compatibility.

These checks improve source and build integrity. They do not establish a signed artifact provenance chain, an authenticated package repository, or a verified remote update path by themselves.

Agent release target

The architecture plan calls for reproducible trusted builds, native installation, cryptographically verified updates, and compatibility-aware fleet rollout. A release profile must demonstrate the required gates. Current build identity and go version -m output describe how a binary was built; they are not remote attestation of the binary actually running.

Protect signing credentials outside source and images. Avoid shared endpoint bootstrap secrets. Treat dependencies, CI credentials, artifact storage, and update trust roots as separate owners. No existing remote-update command should be inferred from this guidance.

Source evidence

Reviewed against the source baseline. Seagull-backend-v2/.github/workflows/ci.yml · Seagull-agent-v2/.github/workflows/ci.yml · Seagull-contracts/.github/workflows/ci.yml · Seagull-agent-v2/README.md.