#108 · stacks/drone

Drone must consume maintained dependency source releases. Dependency patches and edits to installed package files are prohibited. Refs #42.

The maintained security extension preserves awaited verified-metadata persistence before cache writes/later roles, owned observer bytes and fixed reference time, typed operational phases with exact causes, and persistence failure propagation under cache-preferred refresh.

Progress:

Maintained source retains upstream MIT attribution. Source PRs #1, #2 and #3 are merged. The recurring native Jest/Nock lifecycle failure was fixed at source. Final source 40a7992babc29eb99c3ee18290ef7aa438421c08 passes all 348 tests in all 15 platform/runtime combinations, plus lint/build, conformance and smoke checks.
Native bun run release:patch prepared the explicitly owned @stacksjs/tuf-js 6.0.1 client. Immutable release sdk-v6.0.1 publishes the archive, SHA512SUMS and source.json. Tag release CI passes, all 19 published files match the source build, server digests match, and gh release verify verifies the release attestation. This is GitHub archive publication, not npm publication or upstream endorsement.
BunPress 0.2.25 was released at its source with bun run release:patch. Open Farming already consumes source-released BunPress/STX on main 488c0c9 without patches, with successful CI and production deployment.
Drone PR #107 commit cdc79ddb55e280b703c0fa227240f5cec4a7421e replaces both patches, consumes the immutable SDK archive through the existing tuf-js import key, locks SHA512, preserves attribution and documents the source-release rule. Native forced frozen install passes; installed SDK 19/19 and BunPress 88/88 files match released archives.
Released-boundary regression checks pass: 69 tests, 453 assertions. Six copied executable campaigns pass, including 20 candidate operations with the actual retained format-1-only executable. Nine real process interruption cuts pass. Original failed inputs/receipts remain retained, with corrected successful campaigns recorded separately.
Final local lint/app/runtime/view types, native CLI/docs build, 101-page/8,038-link docs audit and actual desktop/320 px search/navigation pass. Both independent review axes are clean. Exact final Drone CI 40125407306 passed all five jobs (2,174 passing tests, 41 skipped, 0 failures and 522,994 assertions). Full local suite admission was denied below 4 GB, so local focused checks do not claim full-suite coverage.

Acceptance:

Publish and document a maintained SDK source repository and release with retained upstream attribution/license. Identify the owned fork explicitly.
Qualify default verification, observer ordering/copies/rejections, fixed clock ownership, phase classification, opaque causes and cache-preferred refresh at the actual released SDK boundary.
Move reviewed Drone source to the immutable release, remove both patchedDependencies entries and distribution patch files, regenerate the frozen lockfile and update documentation.
Pass SDK, enrollment, persistent store/recovery, interrupted-update and rollback-floor regressions and copied standalone CLI campaigns against the installed release.
Pass exact final full CI and publish reviewed Drone integration to main as Chris without coauthors. Main is cdc79ddb55e280b703c0fa227240f5cec4a7421e, published by normal fast-forward; PR #107 is merged.

This does not qualify physical firmware deployment or establish a trusted hardware clock/store. Existing output inhibition remains in place.