release: freeze Nexus One AI 1.0.0-rc1

2026-08-17 11:05:19 +05:30
1 parent 63acefd890
commit 4f1419ca93
@@ -0,0 +1,26 @@
+# Artifact Contract Test Vectors
+
+These files are specification fixtures only. They contain conspicuous non-production identifiers and
+digests. They MUST NOT be copied into an installer or accepted by a release verifier.
+
+- `workstation-iso-manifest.valid.json`: structurally valid Workstation ISO payload example.
+- `compatibility-cases.json`: deterministic compatibility outcomes and primary reason codes.
+- `ed25519-test-public.pem`, the four `*-signature.valid.json` envelopes, and
+  `signature-cases.json`: real test-only Ed25519 positive vectors plus tamper and unknown-key
+  negatives. The private key was transient and is intentionally absent.
+- `model-pack-manifest.valid.json`, `update-bundle-manifest.valid.json`, and
+  `trust-bundle-manifest.valid.json`: structural examples for the remaining artifact types.
+- `verification-evidence.md`: current parsing, digest, signature, and scope-limited verification result.
+
+Before Gate 1 approval, add:
+
+1. independent security/platform review of the test-vector procedure;
+2. owner approval of the schemas, compatibility contract, and signing policy.
+
+No production key or customer license may appear in this directory.
+
+Run the complete automated fixture suite with Python packages `jsonschema` and `cryptography`:
+
+```bash
+python3 validate_vectors.py
+```
@@ -0,0 +1,30 @@
+{
+  "schema": "com.cezen.nexus-one.compatibility-cases.v1",
+  "notice": "TEST ONLY - trust and digest checks are assumed successful unless the case names them",
+  "base_context": {
+    "category": "workstation",
+    "tier": "workstation",
+    "platform_version": "0.0.0-test.1",
+    "ubuntu_release": "22.04.5",
+    "architecture": "amd64",
+    "hardware_profile": "test-workstation-amd64",
+    "capabilities": [],
+    "available_bytes": 2,
+    "security_floor": "0.0.0-test.1",
+    "rollback_prerequisite_verified": true
+  },
+  "cases": [
+    { "id": "valid-workstation", "mutation": {}, "expected": "COMPATIBLE" },
+    { "id": "server-category", "mutation": { "targets.categories": ["server"] }, "expected": "CATEGORY_INCOMPATIBLE" },
+    { "id": "server-tier", "mutation": { "targets.tiers": ["starter"] }, "expected": "TIER_INCOMPATIBLE" },
+    { "id": "arm-only", "mutation": { "artifact.architecture": "arm64" }, "expected": "ARCHITECTURE_INCOMPATIBLE" },
+    { "id": "wrong-ubuntu", "mutation": { "targets.ubuntu_release": "24.04" }, "expected": "UBUNTU_RELEASE_INCOMPATIBLE" },
+    { "id": "insufficient-space", "mutation": { "requirements.required_free_bytes": 3 }, "expected": "SPACE_INSUFFICIENT" },
+    { "id": "missing-capability", "mutation": { "requirements.required_capabilities": ["test-gpu"] }, "expected": "CAPABILITY_MISSING" },
+    { "id": "security-downgrade", "mutation": { "lifecycle.to_version": "0.0.0-test.0" }, "expected": "SECURITY_FLOOR_VIOLATION" },
+    { "id": "rollback-missing", "context_mutation": { "rollback_prerequisite_verified": false }, "expected": "ROLLBACK_PREREQUISITE_MISSING" },
+    { "id": "revoked-key", "trust_mutation": { "key_status": "revoked" }, "expected": "KEY_REVOKED" },
+    { "id": "bad-signature", "trust_mutation": { "signature_valid": false }, "expected": "SIGNATURE_INVALID" },
+    { "id": "bad-object", "trust_mutation": { "object_digests_valid": false }, "expected": "OBJECT_DIGEST_MISMATCH" }
+  ]
+}
@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAHExdkCzCGqKqpxeVgRTKNXW+qcemVLaDI3UsFOq5DFA=
+-----END PUBLIC KEY-----
@@ -0,0 +1,11 @@
+{
+  "schema": "com.cezen.nexus-one.artifact-manifest.v1",
+  "artifact": { "id": "test-only.model-pack", "type": "model-pack", "version": "0.0.0-test.1", "created_at": "2000-01-01T00:00:00Z", "architecture": "amd64", "description": "TEST ONLY" },
+  "source": { "repository": "https://example.invalid/test-only.git", "revision": "0000000000000000000000000000000000000000", "builder": "test-only", "build_recipe_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000" },
+  "targets": { "categories": ["workstation"], "tiers": ["workstation"], "platform_versions": ">=0.0.0-test.1 <0.0.0-test.2", "ubuntu_release": "22.04.5", "hardware_profiles": ["test-workstation-amd64"] },
+  "payload": [{ "path": "models/test-only.bin", "bytes": 1, "digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "media_type": "application/octet-stream", "install_scope": "optional", "immutable_source": "test-only@0000000" }],
+  "requirements": { "download_bytes": 1, "unpacked_bytes": 1, "required_free_bytes": 2, "minimum_ram_bytes": 1, "minimum_vram_bytes": 0, "required_capabilities": [] },
+  "lifecycle": { "activation": "import", "reboot": "none", "rollback_class": "operator", "security_floor": "0.0.0-test.1", "health_validation_seconds": 60 },
+  "integrity": { "signature_algorithm": "ed25519", "signing_key_id": "TEST-KEY-DO-NOT-TRUST", "policy_version": "test-only-v1", "revocation_list_version": "test-only-1" },
+  "model": { "provider": "test-only", "model_id": "test/model", "revision": "0000000000000000000000000000000000000000", "runtime": "test-runtime", "activation_name": "test-model" }
+}
@@ -0,0 +1,9 @@
+{
+  "schema": "com.cezen.nexus-one.signature-envelope.v1",
+  "manifest_digest": "sha256:938c330b94d20e712e57595a7c284e1abd2b296cdf62c92fe75cdeaa4c44f2da",
+  "algorithm": "ed25519",
+  "key_id": "TEST-KEY-DO-NOT-TRUST",
+  "signed_at": "2000-01-01T00:00:00Z",
+  "policy_version": "test-only-v1",
+  "signature": "dF1yeH7/yuthI34iayBi5RWZUuOHWQxoYYKBkO2e5/Yi5uHQlOkMUS5+9nlujjpRg706TLVqJl1Xc7Mg2n5zCg=="
+}
@@ -0,0 +1,5 @@
+{
+  "operation_id": "gate2-profile-test-001",
+  "selected_profile": "nvidia-cu128",
+  "state": "installing"
+}
@@ -0,0 +1,15 @@
+{
+  "schema": "com.cezen.nexus-one.profile-membership-verification-receipt.v1",
+  "environment": "test",
+  "result": "verified",
+  "manifest_sha256": "3b1fef9705e8049b28d283383f16fa7fd66e7fc00434315b2cc86163ba8e93ac",
+  "envelope_sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "key_id": "TEST-ONLY-ED25519",
+  "key_fingerprint_sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "trust_snapshot_sha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "policy_version": "structural-test-v1",
+  "namespace": "offline-workstation/python-runtime-profiles",
+  "profiles": ["cpu-only", "nvidia-cu128"],
+  "verified_at": "2026-07-14T00:00:00Z",
+  "verifier_build_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
+}
@@ -0,0 +1,11 @@
+{
+  "architecture": "amd64",
+  "nvidia": {
+    "present": true,
+    "supported": true,
+    "driver_ready": true,
+    "device": "NVIDIA GeForce RTX 3050 OEM",
+    "driver": "595.58.03",
+    "memory_bytes": 8222670848
+  }
+}
@@ -0,0 +1,29 @@
+{
+  "schema": "com.cezen.nexus-one.signature-cases.v1",
+  "canonicalization": "jq -cS with one trailing newline",
+  "public_key": "ed25519-test-public.pem",
+  "manifest": "workstation-iso-manifest.valid.json",
+  "cases": [
+    {
+      "id": "valid-signature",
+      "manifest_digest": "sha256:e3c8a7f5ac9c0ad1ebc29c739f32dbd3c533d8ac7378b76cca12f30a5ebd5e10",
+      "signature": "G7o7ANH37c6C7eFdavb5Rviyo0p07DZLU0ISBXvBPLNgauJxNc1EqrEKLTUdhlthOrPMfI9vS/zeZH8lgi3UBg==",
+      "expected": "VALID"
+    },
+    {
+      "id": "tampered-manifest",
+      "mutation": { "artifact.description": "TEST ONLY - tampered" },
+      "expected": "MANIFEST_DIGEST_MISMATCH"
+    },
+    {
+      "id": "tampered-signature",
+      "signature": "A7o7ANH37c6C7eFdavb5Rviyo0p07DZLU0ISBXvBPLNgauJxNc1EqrEKLTUdhlthOrPMfI9vS/zeZH8lgi3UBg==",
+      "expected": "SIGNATURE_INVALID"
+    },
+    {
+      "id": "unknown-key",
+      "key_id": "TEST-UNKNOWN-KEY",
+      "expected": "KEY_UNKNOWN"
+    }
+  ]
+}
@@ -0,0 +1,10 @@
+{
+  "schema": "com.cezen.nexus-one.artifact-manifest.v1",
+  "artifact": { "id": "test-only.trust-bundle", "type": "trust-bundle", "version": "0.0.0-test.2", "created_at": "2000-01-01T00:00:00Z", "architecture": "multi", "description": "TEST ONLY" },
+  "source": { "repository": "https://example.invalid/test-only.git", "revision": "0000000000000000000000000000000000000000", "builder": "test-only", "build_recipe_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000" },
+  "targets": { "categories": ["workstation", "server"], "tiers": ["workstation", "starter", "basic", "pro", "max"], "platform_versions": ">=0.0.0-test.1 <0.0.0-test.3", "ubuntu_release": "22.04.5", "hardware_profiles": [] },
+  "payload": [{ "path": "trust/test-revocations.json", "bytes": 1, "digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "media_type": "application/json", "install_scope": "base", "immutable_source": "test-only" }],
+  "requirements": { "download_bytes": 1, "unpacked_bytes": 1, "required_free_bytes": 2, "minimum_ram_bytes": 0, "minimum_vram_bytes": 0, "required_capabilities": [] },
+  "lifecycle": { "activation": "trust-update", "reboot": "none", "rollback_class": "operator", "security_floor": "0.0.0-test.1", "health_validation_seconds": 60 },
+  "integrity": { "signature_algorithm": "ed25519", "signing_key_id": "TEST-KEY-DO-NOT-TRUST", "policy_version": "test-only-v1", "revocation_list_version": "test-only-2" }
+}
@@ -0,0 +1,9 @@
+{
+  "schema": "com.cezen.nexus-one.signature-envelope.v1",
+  "manifest_digest": "sha256:ebb4f214ba2367ed7d4d8099b9e4892378d068c3dd2699aa2ebd5521a4c4febf",
+  "algorithm": "ed25519",
+  "key_id": "TEST-KEY-DO-NOT-TRUST",
+  "signed_at": "2000-01-01T00:00:00Z",
+  "policy_version": "test-only-v1",
+  "signature": "Cuyu5QvYmzeHMUeoJl6mksPEYpwb0J//QO1hGrUsnT+uz5WAce5O+yoS2TrJDQLi0Ml7wjXw5i/FU3zaxzJcDQ=="
+}
@@ -0,0 +1,11 @@
+{
+  "schema": "com.cezen.nexus-one.artifact-manifest.v1",
+  "artifact": { "id": "test-only.update-bundle", "type": "update-bundle", "version": "0.0.0-test.2", "created_at": "2000-01-01T00:00:00Z", "architecture": "multi", "description": "TEST ONLY" },
+  "source": { "repository": "https://example.invalid/test-only.git", "revision": "0000000000000000000000000000000000000000", "builder": "test-only", "build_recipe_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000" },
+  "targets": { "categories": ["workstation", "server"], "tiers": ["workstation", "starter", "basic", "pro", "max"], "platform_versions": ">=0.0.0-test.1 <0.0.0-test.3", "ubuntu_release": "22.04.5", "hardware_profiles": [] },
+  "payload": [{ "path": "updates/test-only.bin", "bytes": 1, "digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "media_type": "application/octet-stream", "install_scope": "base", "immutable_source": "test-only@0000000" }],
+  "requirements": { "download_bytes": 1, "unpacked_bytes": 1, "required_free_bytes": 2, "minimum_ram_bytes": 0, "minimum_vram_bytes": 0, "required_capabilities": [] },
+  "lifecycle": { "from_versions": ">=0.0.0-test.1 <0.0.0-test.2", "to_version": "0.0.0-test.2", "activation": "staged-switch", "reboot": "may-require", "rollback_class": "automatic", "security_floor": "0.0.0-test.1", "health_validation_seconds": 600 },
+  "integrity": { "signature_algorithm": "ed25519", "signing_key_id": "TEST-KEY-DO-NOT-TRUST", "policy_version": "test-only-v1", "revocation_list_version": "test-only-1" },
+  "actions": [{ "order": 1, "kind": "replace", "object": "updates/test-only.bin", "failure_action": "rollback" }, { "order": 2, "kind": "validate", "object": "platform-health", "failure_action": "rollback" }]
+}
@@ -0,0 +1,9 @@
+{
+  "schema": "com.cezen.nexus-one.signature-envelope.v1",
+  "manifest_digest": "sha256:179cde97d373c6a7abef8d9ce205534cb8c3f7ef61d05f186e3b30b9ce587fbb",
+  "algorithm": "ed25519",
+  "key_id": "TEST-KEY-DO-NOT-TRUST",
+  "signed_at": "2000-01-01T00:00:00Z",
+  "policy_version": "test-only-v1",
+  "signature": "Y04SAyj+yu1miC3b4ER8yjECsS4Uio1J6dhtvw3ByZAKdHDO2qx7qBGBOP4tR4cdic2XsPJCETgwjItZLxrKDw=="
+}
@@ -0,0 +1,162 @@
+#!/usr/bin/env python3
+"""Validate Nexus One AI specification fixtures; never validates production artifacts."""
+
+from __future__ import annotations
+
+import base64
+import copy
+import hashlib
+import json
+import re
+from pathlib import Path
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.exceptions import InvalidSignature
+from jsonschema import Draft202012Validator
+
+
+ROOT = Path(__file__).resolve().parent
+SCHEMAS = ROOT.parent / "schemas"
+MANIFEST_SCHEMA = json.loads((SCHEMAS / "artifact-manifest.schema.json").read_text())
+SIGNATURE_SCHEMA = json.loads((SCHEMAS / "signature-envelope.schema.json").read_text())
+PROFILE_RECEIPT_SCHEMA = json.loads(
+    (SCHEMAS / "profile-membership-verification-receipt.schema.json").read_text()
+)
+
+
+def load(name: str):
+    return json.loads((ROOT / name).read_text())
+
+
+def canonical(value) -> bytes:
+    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()
+
+
+def mutate(value, changes):
+    result = copy.deepcopy(value)
+    for dotted, replacement in changes.items():
+        target = result
+        parts = dotted.split(".")
+        for part in parts[:-1]:
+            target = target[part]
+        target[parts[-1]] = replacement
+    return result
+
+
+def semver(value: str):
+    match = re.fullmatch(r"(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?", value)
+    if not match:
+        raise AssertionError(f"unsupported semantic version: {value}")
+    major, minor, patch = map(int, match.group(1, 2, 3))
+    prerelease = match.group(4)
+    return major, minor, patch, (0, prerelease) if prerelease is not None else (1, "")
+
+
+def validate_schemas():
+    Draft202012Validator.check_schema(MANIFEST_SCHEMA)
+    Draft202012Validator.check_schema(SIGNATURE_SCHEMA)
+    Draft202012Validator.check_schema(PROFILE_RECEIPT_SCHEMA)
+    manifest_validator = Draft202012Validator(MANIFEST_SCHEMA)
+    for name in (
+        "workstation-iso-manifest.valid.json",
+        "model-pack-manifest.valid.json",
+        "update-bundle-manifest.valid.json",
+        "trust-bundle-manifest.valid.json",
+    ):
+        errors = sorted(manifest_validator.iter_errors(load(name)), key=lambda error: list(error.path))
+        if errors:
+            raise AssertionError(f"{name}: {errors[0].message}")
+    Draft202012Validator(SIGNATURE_SCHEMA).validate(load("workstation-iso-signature.valid.json"))
+    Draft202012Validator(PROFILE_RECEIPT_SCHEMA).validate(
+        load("python-profile-membership-receipt.structural-test.json")
+    )
+
+
+def validate_signature_cases():
+    manifest = load("workstation-iso-manifest.valid.json")
+    envelope = load("workstation-iso-signature.valid.json")
+    public_key = serialization.load_pem_public_key((ROOT / "ed25519-test-public.pem").read_bytes())
+    cases = load("signature-cases.json")["cases"]
+    for case in cases:
+        candidate = mutate(manifest, case.get("mutation", {}))
+        body = canonical(candidate)
+        digest = "sha256:" + hashlib.sha256(body).hexdigest()
+        key_id = case.get("key_id", envelope["key_id"])
+        if key_id != envelope["key_id"]:
+            actual = "KEY_UNKNOWN"
+        elif digest != envelope["manifest_digest"]:
+            actual = "MANIFEST_DIGEST_MISMATCH"
+        else:
+            signature = base64.b64decode(case.get("signature", envelope["signature"]), validate=True)
+            try:
+                public_key.verify(signature, body)
+                actual = "VALID"
+            except InvalidSignature:
+                actual = "SIGNATURE_INVALID"
+        assert actual == case["expected"], f"{case['id']}: expected {case['expected']}, got {actual}"
+
+
+def validate_artifact_signatures():
+    public_key = serialization.load_pem_public_key((ROOT / "ed25519-test-public.pem").read_bytes())
+    for prefix in ("workstation-iso", "model-pack", "update-bundle", "trust-bundle"):
+        manifest = load(f"{prefix}-manifest.valid.json")
+        envelope = load(f"{prefix}-signature.valid.json")
+        Draft202012Validator(SIGNATURE_SCHEMA).validate(envelope)
+        body = canonical(manifest)
+        digest = "sha256:" + hashlib.sha256(body).hexdigest()
+        assert digest == envelope["manifest_digest"], f"{prefix}: digest mismatch"
+        signature = base64.b64decode(envelope["signature"], validate=True)
+        public_key.verify(signature, body)
+        tampered = copy.deepcopy(manifest)
+        tampered["artifact"]["description"] = "TEST ONLY - tampered"
+        assert "sha256:" + hashlib.sha256(canonical(tampered)).hexdigest() != envelope["manifest_digest"]
+
+
+def validate_compatibility_cases():
+    manifest = load("workstation-iso-manifest.valid.json")
+    suite = load("compatibility-cases.json")
+    for case in suite["cases"]:
+        candidate = mutate(manifest, case.get("mutation", {}))
+        context = mutate(suite["base_context"], case.get("context_mutation", {}))
+        trust = case.get("trust_mutation", {})
+        targets = candidate["targets"]
+        lifecycle = candidate["lifecycle"]
+        requirements = candidate["requirements"]
+        if trust.get("key_status") == "revoked":
+            actual = "KEY_REVOKED"
+        elif trust.get("signature_valid") is False:
+            actual = "SIGNATURE_INVALID"
+        elif trust.get("object_digests_valid") is False:
+            actual = "OBJECT_DIGEST_MISMATCH"
+        elif candidate["artifact"]["architecture"] not in ("multi", context["architecture"]):
+            actual = "ARCHITECTURE_INCOMPATIBLE"
+        elif context["category"] not in targets["categories"]:
+            actual = "CATEGORY_INCOMPATIBLE"
+        elif context["tier"] not in targets["tiers"]:
+            actual = "TIER_INCOMPATIBLE"
+        elif semver(lifecycle.get("to_version", context["platform_version"])) < semver(context["security_floor"]):
+            actual = "SECURITY_FLOOR_VIOLATION"
+        elif context["ubuntu_release"] != targets["ubuntu_release"]:
+            actual = "UBUNTU_RELEASE_INCOMPATIBLE"
+        elif targets.get("hardware_profiles") and context["hardware_profile"] not in targets["hardware_profiles"]:
+            actual = "HARDWARE_PROFILE_INCOMPATIBLE"
+        elif not set(requirements.get("required_capabilities", [])).issubset(context["capabilities"]):
+            actual = "CAPABILITY_MISSING"
+        elif context["available_bytes"] < requirements["required_free_bytes"]:
+            actual = "SPACE_INSUFFICIENT"
+        elif lifecycle["rollback_class"] != "none" and not context["rollback_prerequisite_verified"]:
+            actual = "ROLLBACK_PREREQUISITE_MISSING"
+        else:
+            actual = "COMPATIBLE"
+        assert actual == case["expected"], f"{case['id']}: expected {case['expected']}, got {actual}"
+
+
+if __name__ == "__main__":
+    validate_schemas()
+    validate_artifact_signatures()
+    validate_signature_cases()
+    validate_compatibility_cases()
+    print("Schema fixtures: PASS (Draft 2020-12)")
+    print("Artifact signatures: PASS (4/4)")
+    print("Signature negative cases: PASS (4/4)")
+    print("Compatibility cases: PASS (12/12)")
@@ -0,0 +1,18 @@
+# Test-Vector Verification Evidence
+
+**Date**: 2026-07-14  
+**Scope**: Specification fixtures only; not release evidence.
+
+- Every JSON Schema, manifest, envelope, and case file parsed successfully with `jq`.
+- Canonical Workstation bytes were produced with `jq -cS`, including its single trailing newline.
+- Canonical SHA-256: `e3c8a7f5ac9c0ad1ebc29c739f32dbd3c533d8ac7378b76cca12f30a5ebd5e10`.
+- The 64-byte detached signature verified successfully with the committed Ed25519 test public key.
+- The private test key was generated only for this vector and deleted after signing.
+- `git diff --check` passed after the fixture additions.
+- Automated validation using `jsonschema` Draft 2020-12 and `cryptography` passed:
+  `Schema fixtures: PASS (Draft 2020-12)`, `Artifact signatures: PASS (4/4)`,
+  `Signature negative cases: PASS (4/4)`, and `Compatibility cases: PASS (12/12)`.
+
+This proves the current structural schemas, all four test-only artifact signatures, negative signature
+cases, and compatibility cases are internally consistent. It does not approve the signing policy,
+exercise real payload objects, or validate any production artifact.
@@ -0,0 +1,55 @@
+{
+  "schema": "com.cezen.nexus-one.artifact-manifest.v1",
+  "artifact": {
+    "id": "test-only.offline-workstation",
+    "type": "iso-payload",
+    "version": "0.0.0-test.1",
+    "created_at": "2000-01-01T00:00:00Z",
+    "architecture": "amd64",
+    "description": "TEST ONLY - not a release artifact"
+  },
+  "source": {
+    "repository": "https://example.invalid/test-only.git",
+    "revision": "0000000000000000000000000000000000000000",
+    "builder": "test-only",
+    "build_recipe_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  },
+  "targets": {
+    "categories": ["workstation"],
+    "tiers": ["workstation"],
+    "platform_versions": ">=0.0.0-test.1 <0.0.0-test.2",
+    "ubuntu_release": "22.04.5",
+    "hardware_profiles": ["test-workstation-amd64"]
+  },
+  "payload": [
+    {
+      "path": "payload/test-only.bin",
+      "bytes": 1,
+      "digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "media_type": "application/octet-stream",
+      "install_scope": "base",
+      "immutable_source": "test-only"
+    }
+  ],
+  "requirements": {
+    "download_bytes": 1,
+    "unpacked_bytes": 1,
+    "required_free_bytes": 2,
+    "minimum_ram_bytes": 1,
+    "minimum_vram_bytes": 0,
+    "required_capabilities": []
+  },
+  "lifecycle": {
+    "activation": "install",
+    "reboot": "required",
+    "rollback_class": "restore",
+    "security_floor": "0.0.0-test.1",
+    "health_validation_seconds": 60
+  },
+  "integrity": {
+    "signature_algorithm": "ed25519",
+    "signing_key_id": "TEST-KEY-DO-NOT-TRUST",
+    "policy_version": "test-only-v1",
+    "revocation_list_version": "test-only-1"
+  }
+}
@@ -0,0 +1,9 @@
+{
+  "schema": "com.cezen.nexus-one.signature-envelope.v1",
+  "manifest_digest": "sha256:e3c8a7f5ac9c0ad1ebc29c739f32dbd3c533d8ac7378b76cca12f30a5ebd5e10",
+  "algorithm": "ed25519",
+  "key_id": "TEST-KEY-DO-NOT-TRUST",
+  "signed_at": "2000-01-01T00:00:00Z",
+  "policy_version": "test-only-v1",
+  "signature": "G7o7ANH37c6C7eFdavb5Rviyo0p07DZLU0ISBXvBPLNgauJxNc1EqrEKLTUdhlthOrPMfI9vS/zeZH8lgi3UBg=="
+}