[AnticsDecoded]

Summary

• bound release publication to a no-checkout default-branch workflow with an exact, pre-existing tag check and fixed asset allowlist
• disable repository-held Apple/Windows signing credentials until an isolated signer exists
• make hidden, over-limit, and over-nested executable calls permanently display-only
• add total transaction, RLP-item, and proposal-JSON resource limits
• move signer output to a trusted display domain and accept Linux test evidence only from trusted producers
• remove inherited x86 COM1 passthrough and support only the tested QEMU AArch64 VMM target
• refresh canonical binary and signer-image hashes, including a corrected locale-variation check

Verification

• cargo test --workspace --release --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo fmt --all -- --check
• 29 Python release/platform tests
• actionlint 1.7.7
• canonical build twice: identical CLI/device hashes
• signer-only image twice in clean volumes: identical kernel/initramfs hashes
• bare-metal three-domain seL4 boot
• Linux-in-seL4 boot, hardened_malloc, prompt-injection refusal, trusted verdict, and blocked tampering
• live Safe replay: 238/238 hash agreement

Release status

This deliberately does not claim a signed stable release. The host has no Apple Developer ID identity and the repository has no Apple/Windows publisher credentials. Signed mode fails closed until a separately administered signing service is available.