[JC-000]

#155 phase 2, L3 part 2. Stacked on the trust-policy PR (base feat/p2-l3-policy).

Merge order: #268 → #269 (base stays feat/p2-l3-policy until #268 merges).

• Packaging (DECISIONS 11, Q1). uci-onchip and uci-comb now build with TRUST_STORE=1. The signed bundle stays out of packages until a production key exists.
• Release guard (DECISIONS 10, from adv-l4). build_prgs.sh builds every product with TRUST_RELEASE=1, via variant_make_args in _common.sh.
  • It records that in build-info, so verify_release.py rebuilds identically.
  • With TRUST_BUNDLE=1, the TEST-ONLY key is refused three ways:
    1. a parse-time $(error) on its 64 key bytes;
    2. an .assert in trust_bundle.s on the flag;
    3. (adv-269) a link-time check, tools/check_release_key.py. It derives the test key from its PEM, so no .inc is parsed, and searches the whole PRG for it, the comb cold image included. On a hit it deletes the PRG.
  • Before (3), an .inc that spelled byte 0 in decimal and claimed IS_TEST_ONLY = 0 linked a release carrying the test key. It is now refused, and a non-test key still builds.
  • Without the bundle, TRUST_RELEASE adds no flag and changes no byte.
• adv-269 also:
  • make -n on a fresh tree no longer fails on build/https_host.inc.
  • tools/trust_bundle.py documents the production-key path.
  • make package-verify gives the VICE boot 600 s (it was 240 s, which failed 2 of 3 runs on a loaded host), and a failed boot check prints the budget it used.

Red-green

tools/test_trust_release_guard.py uses make -n plus direct ca65 and link checks: no VICE. Result: 24/24.

Red, by removing each layer in turn:

layer removed	result
Makefile byte guard	red
source assert	red
TRUST_RELEASE=1 in variant_make_args	red
the link-time check_release_key.py recipe line	red

Controls that must still pass:

• a dev build with the test key;
• a release with a throwaway non-test key;
• TRUST_RELEASE=2 refused.

Products

These are the "ship" rows of #268's margins table, from tools/measure_margins.py on master c26e268 + #268 + this branch (8fdebe7):

product	PRG	LOADER	NET	OVERLAY	HOT (free B)
uci-onchip TS rel	da4d607e	588	184	333	166
uci-comb TS rel	e6750100	78	38	47	1,237

ip65-onchip (78a10748) is unchanged.

Restack only

This branch was only restacked onto #268 011209b. git range-diff 04af8b9..e0b118d 011209b..8fdebe7, where e0b118d is the version adv-269 cleared, shows all three commits as = (identical patches):

cleared	now	commit
da127f4	21570f2	package
6ada951	b35dd07	release guard
e0b118d	8fdebe7	package-verify

On 8fdebe7: test_trust_release_guard 24/24, test_build_flags_stamp 17/17.

Hardware

The products are #268's hardware rows: local comb TS PASS 28/28 and onchip TS PASS 28/28 on U64E fw 3.15 3a1ff9ff, FPGA 126, core 1.50. Those rig builds add only TRUST_STORE_DIR / HTTPS_PORT. The shipped TRUST_RELEASE=1 images are da4d607e / e6750100.

🤖 Generated with Claude Code