[P0] Define verified-bundle acceptance criteria

[a-a-k]

Context

The current mb3r-stack bundle is marked candidate. It is backed by upstream pins and smoke evidence, but not by a broad stack-level operational compatibility statement.

Scope

Define the evidence required to promote a bundle from candidate to verified.

Definition of Done

• docs/compatibility.md defines candidate vs verified evidence clearly.
• Required evidence covers chart render/lint, live generic OTLP ingest, Bering artifact publication, Sheaft batch report generation, Sheaft serve startup, pinned-image startup, and adapter e2e.
• The compatibility matrix can distinguish contract alignment from operational verification.
• OpenTelemetry Demo is documented as optional showcase evidence, not the core readiness proof.

[a-a-k]

Backlog update (2026-05-01): supporting technical hardening completed on main.

Completed:

• 4e04ad9 fix: avoid leaking registry token in smoke test - live Kubernetes smoke test now passes the GHCR pull secret manifest through stdin instead of exposing the token in argv.
• 454971b fix: validate adapter gate decisions - GitHub/GitLab/Jenkins adapters now validate allowed gate decisions and reject invalid payloads.
• 3665b82 fix: checksum release manifest asset - SHA256SUMS.txt now covers release-manifest.json without creating a circular digest requirement.
• 382c206 fix: harden sheaft stack security context - stack chart Sheaft container now defaults to non-root, read-only root filesystem, and dropped capabilities.

Verification:

• python scripts/tasks.py validate
• python scripts/tasks.py e2e-adapters
• python scripts/tasks.py release-dry-run
• helm template for standalone/co-located Sheaft render paths.

This issue remains open until the verified-bundle acceptance criteria are explicitly published and automated end-to-end.

[a-a-k]

Release update (2026-05-01): mb3r-stack v0.3.1 candidate bundle is published.

Release: https://github.com/MB3R-Lab/mb3r-stack/releases/tag/v0.3.1
Release workflow: https://github.com/MB3R-Lab/mb3r-stack/actions/runs/25205623771

Published packages/artifacts verified:

• GitHub Release assets include mb3r-stack-0.3.1.tgz, mb3r-assets-0.3.1.tgz, stack-manifest.json, compatibility-matrix.json, release-manifest.json, schema, notes, checksums, and SBOM.
• OCI chart oci://ghcr.io/mb3r-lab/charts/mb3r-stack --version 0.3.1 resolves to sha256:3882984077b4285fb23f0382eb9741838f54099807ab73397076c3f1c263e431.
• Stack pins now point to Bering v0.3.2 image sha256:98e443461bf59d92cc19b20f425602de91b22a272ecd9a79df5cc20f96c735a8 and Sheaft v0.2.2 image sha256:df6a7bbf21e4f307d1d33425f4245eeb34f5d051f46b8ad36ad536b33bf2c331.

This keeps the bundle at candidate; verified-bundle acceptance criteria remain open until the end-to-end runtime evidence threshold is explicitly automated and published.

[a-a-k]

Acceptance-criteria update on 2026-05-01: v0.3.2 adds a compatibility-matrix entry backed by the pinned-image generic kind smoke. The bundle remains candidate, not verified/GA, but the generic Bering -> Sheaft handoff now has runtime evidence against published GHCR digests.