chore: sync main -> dev

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.6.2"
+  ".": "3.8.0"
 }

CHANGELOG.md

@@ -11,6 +11,41 @@ this file at release-prep. See [`changelog.d/README.md`](changelog.d/README.md).
 
 <!-- towncrier release notes start -->
 
+## [3.8.0](https://github.com/OpenRAE/env-packs/compare/v3.7.0...v3.8.0) (2026-08-03)
+
+
+### Features
+
+* **techvault:** author operator-access proxies + capture sidecar as component builds ([7cf97fb](https://github.com/OpenRAE/env-packs/commit/7cf97fbb5cf2a9c0d28d2c98a33cedd53d7dbabb))
+* **techvault:** author the indexer internal_users.yml ([58e79a9](https://github.com/OpenRAE/env-packs/commit/58e79a977997bdae76518e503675010ffe7e1417))
+* **techvault:** declare aptl-tempo config and startup command ([18d2f10](https://github.com/OpenRAE/env-packs/commit/18d2f101f9102d05e94f78e1600461287c8a2a47))
+* **techvault:** declare misp-db and shuffle-opensearch runtime environment ([a1a1211](https://github.com/OpenRAE/env-packs/commit/a1a12111a5ee86bfba9ed32ce2ec2cb2dc8adcdd))
+* **techvault:** declare SOC app configs (otel, grafana, cortex, thehive) ([#259](https://github.com/OpenRAE/env-packs/issues/259)) ([d448316](https://github.com/OpenRAE/env-packs/commit/d4483165d59d2df0d9979460b19f3c582dc2887d))
+* **techvault:** declare suricata run config + cortex-index-init placement ([#259](https://github.com/OpenRAE/env-packs/issues/259)) ([02314a8](https://github.com/OpenRAE/env-packs/commit/02314a868096cd47fdd3922495972e4b69517c14))
+* **techvault:** declare wazuh cluster env desired-state ([#259](https://github.com/OpenRAE/env-packs/issues/259)) ([4ef0569](https://github.com/OpenRAE/env-packs/commit/4ef0569ac35945a6e12452c05a7c51171fdb7988))
+* **techvault:** declare wazuh loopback published ports ([c318349](https://github.com/OpenRAE/env-packs/commit/c31834971c30a7659e099422debe1b1cac8f6179))
+* **techvault:** declare wazuh sidecar agent environment ([6abf245](https://github.com/OpenRAE/env-packs/commit/6abf245473bb4d9c1fe2697acfefecdc3df34956))
+* **techvault:** declare wazuh-dashboard config content ([#259](https://github.com/OpenRAE/env-packs/issues/259)) ([a2a2ddc](https://github.com/OpenRAE/env-packs/commit/a2a2ddc6a11e94b84960233bbf789065e60cc38a))
+* **techvault:** declare wazuh-indexer opensearch.yml security config ([#259](https://github.com/OpenRAE/env-packs/issues/259)) ([499bd04](https://github.com/OpenRAE/env-packs/commit/499bd04b72252c67b9891c81a03825bfbae7c62e))
+* **techvault:** fully declare cortex-index-init (image, entrypoint, script) ([99973e7](https://github.com/OpenRAE/env-packs/commit/99973e75d311bd5e0131e428326b8d49bfa23cd5))
+
+
+### Bug Fixes
+
+* **techvault:** align soc-certificate output paths with the issued layout ([f4444a9](https://github.com/OpenRAE/env-packs/commit/f4444a9c605e9882de8b22b59c510e3f4af11fdf))
+* **techvault:** declare thehive-es ES env (single-node, security off, 512m heap) ([#259](https://github.com/OpenRAE/env-packs/issues/259)) ([8601f71](https://github.com/OpenRAE/env-packs/commit/8601f71bdccf06994a3e4c434efc42cd8a2f6cc3))
+* **techvault:** mark cortex-index-init as one-shot (autoremove) ([#259](https://github.com/OpenRAE/env-packs/issues/259)) ([09ff951](https://github.com/OpenRAE/env-packs/commit/09ff9517cc4ea5b8db505c3c6dc7b63d80230281))
+* **techvault:** realize the misp-sync TLS flag and the db-log forwarding source ([74ba39d](https://github.com/OpenRAE/env-packs/commit/74ba39deeb02ff6a89a9e7394905c24112f7f599))
+* **techvault:** suricata direct exec, cortex-init ES wait, ad samba caps ([#259](https://github.com/OpenRAE/env-packs/issues/259)) ([32857a9](https://github.com/OpenRAE/env-packs/commit/32857a96c756492ffd8282fb252f0f9027cbe7e0))
+* **techvault:** update proxy component-build spec digests ([1d842ce](https://github.com/OpenRAE/env-packs/commit/1d842ce2d7d1a6f7f33ab3621e65b2ccb5293ef3))
+
+## [3.7.0](https://github.com/OpenRAE/env-packs/compare/v3.6.2...v3.7.0) (2026-08-02)
+
+
+### Features
+
+* **distribution:** add verified pack supply-chain workflows ([#257](https://github.com/OpenRAE/env-packs/issues/257)) ([759ec95](https://github.com/OpenRAE/env-packs/commit/759ec95ccc8d505fd67259701f4a35bedf6674bd))
+
 ## [3.6.2](https://github.com/OpenRAE/env-packs/compare/v3.6.1...v3.6.2) (2026-08-02)
 
 

docs/requirements/ASP-0001/requirement.md

@@ -0,0 +1,30 @@
+---
+id: ASP-0001
+title: "Explicit pack validation roots and portable bulk convenience"
+status: ACTIVE
+type: FUNCTIONAL
+priority: MUST
+created_at: 2026-07-15T17:59:23.591618Z
+updated_at: 2026-07-15T17:59:40.186486Z
+---
+
+# ASP-0001 — Explicit pack validation roots and portable bulk convenience
+
+## Statement
+
+The author and release utilities shall validate an explicitly supplied pack directory without assuming a catalog layout. Optional bulk validation shall enumerate every real direct child directory of a caller-supplied packs root deterministically and validate each candidate; pack.yaml shall remain a pack-contract requirement rather than a discovery filter. Shared tooling shall contain no downstream catalog paths, names, issue history, or policy checks.
+
+## Rationale
+
+Scope corrected with the repository owner: single-pack validation is primary; bulk enumeration is optional convenience and must not own downstream catalog layout.
+
+## Traceability
+
+- TESTS → TEST `tests/test_release.py` (Release validation root tests)
+- TESTS → TEST `tests/test_content_ci.py` (Author validation root and discovery tests)
+- TESTS → TEST `tests/test_cli_coverage.py` (Explicit single-pack CLI coverage)
+- DOCUMENTS → DOCUMENTATION `README.md` (Explicit pack validation usage)
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/release.py` (Explicit pack release check and packs-root convenience)
+- IMPLEMENTS → PULL_REQUEST `116` (fix: accept explicit pack validation roots)
+- IMPLEMENTS → GITHUB_ISSUE `113` (Explicit pack validation roots and portable bulk convenience)
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/content_ci.py` (Explicit pack validation and packs-root author gate)

docs/requirements/ASP-0002/requirement.md

@@ -0,0 +1,27 @@
+---
+id: ASP-0002
+title: "Complete pack-local validator and test discovery"
+status: ACTIVE
+type: FUNCTIONAL
+priority: MUST
+created_at: 2026-07-15T18:09:30.283175Z
+updated_at: 2026-07-15T22:35:14.542977Z
+---
+
+# ASP-0002 — Complete pack-local validator and test discovery
+
+## Statement
+
+The author validation utility shall deterministically execute each direct validate_*.py under sdl, validation, profiles, and flags, and shall discover unittest suites under sdl/tests, validation/tests, build/tests, profiles/tests, ctfd/tests, and pack-root tests, only for packs that pass static validation. Execution shall fail closed on unsafe or changed filesystem identity, use argv without shell construction, and bound subprocess output and lifetime. Shared tooling shall contain no downstream catalog paths, names, or skip lists.
+
+## Rationale
+
+Catalogs adopting the packaged author gate must retain all contract-supported pack-local checks without wrappers or package-internal imports.
+
+## Traceability
+
+- TESTS → TEST `tests/test_content_ci.py` (Pack-local executable discovery and safety tests)
+- DOCUMENTS → ADR `docs/decisions/adrs/0013-separate-consumer-static-validation-from-author-ci.md` (Author-CI executable discovery contract)
+- IMPLEMENTS → PULL_REQUEST `117` (feat: discover all supported pack checks)
+- IMPLEMENTS → GITHUB_ISSUE `114` (Discover all contract-supported pack validators and test suites)
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/content_ci.py` (Contract-supported validator and unittest discovery)

docs/requirements/ASP-0003/requirement.md

@@ -0,0 +1,30 @@
+---
+id: ASP-0003
+title: "Environment-pack publication profile bound to RAES artifact authority"
+status: ACTIVE
+type: FUNCTIONAL
+priority: MUST
+created_at: 2026-07-28T17:15:31.596222Z
+updated_at: 2026-07-28T17:15:37.252979Z
+---
+
+# ASP-0003 — Environment-pack publication profile bound to RAES artifact authority
+
+## Statement
+
+Release tooling shall emit and validate one immutable, schema-backed publication profile per environment-pack release, describing the release views it distributes. The profile shall consume the RAES artifact-requirement contract rather than redefine it: author posture, mechanism vocabulary, acquisition, timing, permitted routes, and trust references shall remain RAES-owned and be validated through the exactly pinned upstream models. Every published claim shall be joined to the authored requirement by compiled RAES address, and refused when it substitutes an exact artifact, exceeds an open requirement's authority, names a backend profile that does not resolve in the trusted RAES corpus, resolves ambiguously, or lacks a validated semantic-parent and associated-artifact-set binding. Immutable release identity shall be separate from mutable provider, location, and channel records; a published release shall not be overwritten with different bound identities; and credentials, tokens, signed-URL values, and entitlement shall never be publication content.
+
+## Rationale
+
+Environment Packs owns release packaging while RAES owns artifact-requirement semantics (ADR 0028, RAES ADR-098). Without an anchored requirement the publication gate would ship as an executable enforcement layer with no traceability, and the boundary it protects would have no contract of record.
+
+## Traceability
+
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/publication.py` (Publication profile authority validator)
+- IMPLEMENTS → SPEC `src/raes_env_packs/resources/schemas/publication-profile.schema.yaml` (environment-pack-publication/v1 schema)
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/release.py` (Release emission, view binding and immutability enforcement)
+- IMPLEMENTS → ADR `docs/decisions/adrs/0028-project-raes-artifact-satisfaction-into-publication.md` (ADR 0028 — Project RAES artifact satisfaction into pack publication)
+- TESTS → TEST `tests/test_publication.py` (Publication profile authority and identity tests)
+- TESTS → TEST `tests/test_release.py` (Release emission, immutability and staging-safety tests)
+- IMPLEMENTS → GITHUB_ISSUE `141` (Define the environment-pack publication profile for artifact satisfaction)
+- IMPLEMENTS → PULL_REQUEST `184` (feat: define the environment-pack publication profile for artifact satisfaction)

docs/requirements/ASP-0004/requirement.md

@@ -0,0 +1,40 @@
+---
+id: ASP-0004
+title: "Verified environment-pack distribution composed from existing authorities"
+status: ACTIVE
+type: FUNCTIONAL
+priority: MUST
+created_at: 2026-08-02T15:04:15.845441Z
+updated_at: 2026-08-02T18:57:49.510104Z
+---
+
+# ASP-0004 — Verified environment-pack distribution composed from existing authorities
+
+## Statement
+
+Environment-pack distribution tooling shall provide install, update, lock, verify, and publish workflows over OCI-backed pack releases while composing existing authorities without merging their models (ADR 0037). The validator-derived RAES associated-artifact set digest shall be the signed pack-release subject; OCI manifest and layer digests shall remain transport addresses only, and every selector and result shall distinguish a RAES set digest from an OCI manifest digest. Once a pack version is published through any route, content identity shall be mandatory even for a claim-free release. The existing schema-backed release.yaml shall remain the single publication carrier, extended to reference the external SBOM and release provenance rather than introducing a parallel manifest or second canonical release digest; generated SBOM and release attestation shall remain outside the associated-artifact set they describe. The author shall declare the pack-controlled component boundary through the extended publication_supply input, validated as a closed schema-backed contract; a shipped or pinned component that is unmapped or omitted shall fail publication, and external, runtime-selected, opaque, and unresolved components shall remain explicit scope states reconciled against the associated-artifact inventory, raes.lock.json records, materialized-kit component inventory recovered through the immutable kit source and revision, and RAES Source/artifact identities. A standards-backed CycloneDX JSON SBOM shall be generated per published pack version, bound to the exact validated release subject, recording its own digest, and shall neither flatten independently scoped upstream SBOMs nor claim safety, authenticity, realizability, or vulnerability-freedom. Install, update, lock, verify, and publish shall follow the proposal-first convention: a silent library shall produce an immutable inspectable operation record rendered by human, JSON, Hub, and MCP adapters, and no network, billable, credential, signing, registry-write, or local filesystem effect shall occur without explicit authorization of that exact proposal, with mutable tags and channels resolved to immutable digests before any write is confirmed. A distribution result shall keep evidence observations separate from blocking diagnostics and shall keep absent, authority-unavailable, present-but-unverified, failed, and verified states distinct rather than collapsing them into a boolean or exception. Before install or update is accepted, the same staged bytes shall pass shared consumer static validation, full associated-artifact byte binding, release signature/attestation and provenance verification, SBOM digest/schema/subject/coverage verification, RAES lock drift and module resolution/signature verification through public RAES APIs under a caller-supplied trust policy, and applicable publication/compatibility checks; no verified state shall be persisted before all required gates succeed, and promotion shall use staged-directory transactions with no-replace or atomic exchange without deleting or overlaying the live target. Registry endpoints, credentials, signing identities, and policy secrets shall stay outside portable pack content, plans, receipts, logs, and machine output; a local CLI shall not be an authentication or authorization boundary.
+
+## Rationale
+
+Issue #191 and ADR 0037 add environment-pack distribution and release policy that ships as executable enforcement (new schema-backed contracts, validation gates, CLIs, and a signing/publish workflow). Without an anchored requirement these gates would ship with no traceability, and the RAES-subordinate trust boundary they protect would have no contract of record. Extends the publication requirement ASP-0003 to the full verified-distribution boundary while keeping RAES the authority for identity, locks, module signatures, and trust evidence classes.
+
+## Traceability
+
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/component_boundary.py`
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/sbom.py`
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/release_provenance.py`
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/verify.py`
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/distribution.py`
+- IMPLEMENTS → CODE_FILE `src/raes_env_packs/release.py`
+- IMPLEMENTS → ADR `docs/decisions/adrs/0037-compose-verified-pack-distribution-from-existing-authorities.md`
+- IMPLEMENTS → SPEC `src/raes_env_packs/resources/schemas/publication-supply.schema.yaml`
+- IMPLEMENTS → CONFIG `.github/workflows/pack-distribution.yml`
+- IMPLEMENTS → GITHUB_ISSUE `191`
+- TESTS → TEST `tests/test_component_boundary.py`
+- TESTS → TEST `tests/test_sbom.py`
+- TESTS → TEST `tests/test_release_provenance.py`
+- TESTS → TEST `tests/test_verify.py`
+- TESTS → TEST `tests/test_distribution.py`
+- TESTS → TEST `tests/test_distribution_archive_safety.py`
+- TESTS → TEST `tests/test_release_publish.py`
+- TESTS → TEST `tests/test_pack_distribution_workflow.py`

packs/techvault/associated-artifacts.json

@@ -419,9 +419,9 @@
       "uri": "raes-environment-pack:/sdl/techvault.sdl.yaml",
       "checksum": {
         "algorithm": "sha256",
-        "value": "fee9dc7b7f448ee14925ae4877e1a56f39a4540ce7b9f4bbfb2a888ecc2b26e8"
+        "value": "efb6e878d9c77e0ac7d21b109a0d7aaa03313eb42ba121b42d3cd19818fe5065"
       },
-      "size_bytes": 122257,
+      "size_bytes": 146773,
       "created_at": "2026-08-02T00:00:00Z",
       "source": "aptl@3db5171f3e4add842efd1d81fa0d4fe078511b7e",
       "satisfies_refs": [],
@@ -461,5 +461,5 @@
       "description": null
     }
   },
-  "set_digest": "sha256:88ce79b536ccfe538d5626228886fde36da1c52e755bda7b0d8ff98257c71850"
+  "set_digest": "sha256:f1c807f70540ca68c640cde72e8b5606b928f4ec40cc00a44d7fd37d6bbfd55f"
 }