release: freeze Nexus One AI 1.0.0-rc1

release/1.0.0-rc1/build-rc.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+if [ "$#" -ne 4 ]; then echo "Usage: $0 BASE_ISO OFFLINE_PAYLOAD RELEASE_PRIVATE_KEY OUTPUT_ISO" >&2; exit 2; fi
+base=$(cd "$(dirname "$1")" && pwd)/$(basename "$1")
+payload=$(cd "$(dirname "$2")" && pwd)/$(basename "$2")
+key=$(cd "$(dirname "$3")" && pwd)/$(basename "$3")
+out=$4
+for f in "$base" "$payload" "$key"; do test -s "$f" || { echo "Missing/empty required input: $f" >&2; exit 1; }; done
+case "$(basename "$payload")" in *model*|*gguf*|*safetensors*) echo "Model payloads are forbidden in RC1" >&2; exit 1;; esac
+command -v xorriso >/dev/null; command -v openssl >/dev/null
+work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
+xorriso -osirrox on -indev "$base" -extract / "$work/iso" >/dev/null 2>&1
+mkdir -p "$work/iso/nexus/rc1"
+cp "$payload" "$work/iso/nexus/rc1/offline-payload.tar.zst"
+cp "$(dirname "$0")/release.json" "$(dirname "$0")/feature-profiles.json" "$(dirname "$0")/agent-registry.schema.json" "$work/iso/nexus/rc1/"
+(cd "$work/iso/nexus/rc1" && find . -type f -print0 | sort -z | xargs -0 shasum -a 256 > SHA256SUMS)
+openssl dgst -sha256 -sign "$key" -out "$work/iso/nexus/rc1/SHA256SUMS.sig" "$work/iso/nexus/rc1/SHA256SUMS"
+echo "RC1 content staged and signed. Use the Ubuntu-preserving hybrid repack in phase2/appliance-iso/build-iso.sh on the approved amd64 build host." >&2
+echo "$work/iso"
+test "${NEXUS_ALLOW_UNQUALIFIED_REPACK:-0}" = 1 || { echo "Refusing unqualified local repack; stage path retained only during this process." >&2; exit 1; }