Delegated release service

[ascorbic]

What does this PR do?

Establishes feat/delegated-release-service as the integration branch for the delegated release service described in RFC #1870 and Discussion #1590.

This PR tracks the complete implementation without sub-issues. Implementation PRs target feat/delegated-release-service; this umbrella PR remains draft until the production launch gates in the implementation plan are complete.

The tracked planning documents are:

• .opencode/plans/delegated-release-service/spec.md
• .opencode/plans/delegated-release-service/implementation-plan.md

Related to #1870 and Discussion #1590.

Implementation tracker

Design and feasibility

• Record RFC implementation acceptance criteria and CLI naming
• Prove public Sigstore provenance verification in workerd
• Gate 0A: prove create-only PDS scope and confidential OAuth custody
• Gate 0B: select verifiable event-specific aggregator history input

Protocol foundation

• Add profile-policy and release-provenance lexicons
• Generate and export typed protocol contracts
• Preserve profile extensions through existing publishing flows
• Add interactive profile-policy editing to the CLI
• Add exact scope contracts and a narrow create-only release publishing helper

Shared verification

• Create the shared registry-verification package
• Implement safe resource fetching and checksum verification
• Implement canonical bundle and manifest validation
• Implement canonical access comparison, diffing, and escalation detection
• Implement Sigstore/SLSA provenance verification (#1951)
• Implement shared profile, release, and policy verification (#1969)
• Implement authoritative direct-PDS profile and release reads (#1969)

Service core

• Scaffold the Workers application, API foundation, D1, Queues, DLQs, and cron (#1971)
• Add required-UV passkey verification and typed challenge contexts (#1970)
• Add the isolated verifier Worker for untrusted artifact, provenance, and webhook egress
• Implement encryption, confidential OAuth metadata, JWKS, and session storage
• Implement D1-coordinated OAuth refresh and revocation
• Implement GitHub Actions OIDC verification and workload policies
• Implement idempotent release-intent submission and validation
• Implement approver enrolment and multiple passkeys
• Implement approval/rejection with bound WebAuthn challenges
• Implement final verification, PDS publication, and ambiguous-write reconciliation
• Implement outbox delivery, expiry, retries, and recovery
• Implement versioned API endpoints and typed client

User surfaces

• Build the publisher console for delegation, packages, policies, intents, and audit
• Build approver enrolment, passkey management, and approval views
• Implement email notifications and signed webhooks
• Add delegation, enrolment, approval, release, and status CLI commands
• Publish the official GitHub Action

Independent enforcement

• Integrate shared verification into the EmDash installer
• Enforce signed provenance policy during installation
• Add minimum current-policy aggregator status and default filtering
• Add event-specific policy history to the aggregator
• Add historical policy reclassification and downgrade cooldown handling

Production readiness

• Add abuse controls, observability, alerts, backup, and key-rotation tooling
• Publish and verify the Workers/D1 self-hosting path
• Complete workerd, browser, adversarial, and end-to-end conformance suites
• Complete external security review
• Pass fresh self-host and production smoke tests

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Documentation
• Translation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs — a workflow extracts catalogs on merge to main.
• I have added a changeset (if this PR changes a published package)
• New features link to an approved Discussion: RFC: Attested Automated Publishing #1590

Runtime tests, test changes, i18n, and a changeset are not applicable to this planning-only update. Implementation PRs complete the checks relevant to their changes.

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: OpenCode with GPT-5.6-terra and GPT-5.6-sol

Screenshots / test output

• Umbrella tracker; no runtime code or UI changes in this PR
• W2.5 post-merge gate at 982cceab: full build, full typecheck, lint, 73 Node tests, 34 workerd tests, packed published-output verification, and publint passed.
• Planning rebaseline at b40f0d60: full build, package typecheck, type-aware lint, formatting, diff checks, and independent architecture review passed.

---

Try this PR

Open a fresh playground →

A full working EmDash site, deployed from this branch. Each visit gets its own session-scoped sandbox: no login needed and no shared state. Try the admin, edit content, hit the public site.

_{Tracks feat/delegated-release-service. Updated automatically when the playground redeploys.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 241659c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 21 packages

Name	Type
@emdash-cms/registry-lexicons	Minor
@emdash-cms/plugin-types	Minor
@emdash-cms/registry-verification	Minor
@emdash-cms/plugin-cli	Minor
emdash	Minor
@emdash-cms/registry-client	Minor
@emdash-cms/auth	Minor
@emdash-cms/admin	Minor
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch
@emdash-cms/cloudflare	Minor
@emdash-cms/sandbox-workerd	Patch
@emdash-cms/fixture-perf-site	Patch
@emdash-cms/auth-atproto	Patch
@emdash-cms/blocks	Minor
@emdash-cms/gutenberg-to-portable-text	Minor
@emdash-cms/x402	Minor
create-emdash	Minor
@emdash-cms/plugin-embeds	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Scope check

This PR changes 2,214 lines across 3 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-cache	241659c	Jul 12 2026, 04:21 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-do	241659c	Jul 12 2026, 04:22 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-playground	241659c	Jul 12 2026, 04:21 PM

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/admin@1908

@emdash-cms/auth

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/auth@1908

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/auth-atproto@1908

@emdash-cms/blocks

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/blocks@1908

@emdash-cms/cloudflare

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/cloudflare@1908

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/contentful-to-portable-text@1908

emdash

npm i https://pkg.pr.new/emdash-cms/emdash@1908

create-emdash

npm i https://pkg.pr.new/emdash-cms/emdash/create-emdash@1908

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/gutenberg-to-portable-text@1908

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-cli@1908

@emdash-cms/plugin-types

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-types@1908

@emdash-cms/registry-client

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/registry-client@1908

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/registry-lexicons@1908

@emdash-cms/registry-verification

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/registry-verification@1908

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/sandbox-workerd@1908

@emdash-cms/x402

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/x402@1908

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-ai-moderation@1908

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-atproto@1908

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-audit-log@1908

@emdash-cms/plugin-color

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-color@1908

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-embeds@1908

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-field-kit@1908

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-forms@1908

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/emdash-cms/emdash/@emdash-cms/plugin-webhook-notifier@1908

commit: 26bcbc6

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	docs	5473b88	Jul 12 2026, 08:34 AM

[github-actions]

Query-count snapshot changes

20 routes changed, total Δ -287 queries.

D1

Route	Before	After	Δ
GET / (cold)	17	—	removed
GET / (warm)	6	—	removed
GET /category/development (cold)	22	—	removed
GET /category/development (warm)	10	—	removed
GET /contributors (cold)	17	—	removed
GET /contributors (warm)	6	—	removed
GET /contributors-naive (cold)	24	—	removed
GET /contributors-naive (warm)	13	—	removed
GET /pages/about (cold)	17	—	removed
GET /pages/about (warm)	6	—	removed
GET /posts (cold)	17	—	removed
GET /posts (warm)	6	—	removed
GET /posts/building-for-the-long-term (cold)	29	—	removed
GET /posts/building-for-the-long-term (warm)	18	—	removed
GET /rss.xml (cold)	12	—	removed
GET /rss.xml (warm)	2	—	removed
GET /search (cold)	22	—	removed
GET /search (warm)	11	—	removed
GET /tag/webdev (cold)	22	—	removed
GET /tag/webdev (warm)	10	—	removed

_{Comparing snapshot files between base and head. Updated automatically on each push.}