Appendix: Release Manifests

Release manifests#

RC.6 has two release manifest contracts with different scope:

Both files are read from the recorded release-source Snapshot. Unknown fields are rejected, paths are normalized repository-relative paths, and declarations are checked against the files actually present in that Snapshot.

Generic adapter: ait-release.json#

{
  "schema": "ait.release.adapter/v1",
  "package": {
    "name": "sample-tool",
    "version": "1.2.0",
    "description": "Portable sample package.",
    "license_files": [
      {"path": "LICENSE", "role": "license"},
      {"path": "NOTICE", "role": "notice"}
    ]
  },
  "components": [
    {
      "id": "cli",
      "ecosystem": "native",
      "working_directory": ".",
      "dependency_files": ["Cargo.toml", "Cargo.lock"],
      "commands": {
        "prepare": [],
        "test": [["cargo", "test", "--locked"]],
        "build": [["cargo", "build", "--release", "--locked"]],
        "smoke": [["target/release/sample-tool", "--version"]]
      },
      "artifacts": [
        {"path": "target/release/sample-tool", "kind": "native-executable"}
      ]
    }
  ]
}

Root and package fields#

Component fields#

Command phases#

Each command is an argv array, not a shell string. test and build are required and each must contain one through 16 commands. prepare and smoke are optional and may contain zero through 16 commands. Every command contains one through 64 string arguments; the executable argument cannot be blank.

Commands run directly without an implicit shell. RC.6 replaces only an exact whole argv value matching one of these tokens:

$AIT_RELEASE_ID
$AIT_RELEASE_VERSION
$AIT_RELEASE_COMPONENT
$AIT_RELEASE_ECOSYSTEM
$AIT_RELEASE_TARGET
$SOURCE_DATE_EPOCH

The tokens are not substring interpolation and do not authorize arbitrary environment expansion. Newlines, carriage returns, and NUL characters are rejected in argv values.

Artifact fields#

The selected build must produce every declared artifact as an exact regular file. A target selection includes matching target artifacts; the portable selection includes only artifacts without a target.

Generic bounds#

The manifest is limited to 1 MiB. Identifiers start with an ASCII letter or digit and then use letters, digits, ., _, or -. Text fields are bounded single-line strings. Relative paths use /, cannot be absolute, and cannot contain empty, ., or .. segments, drive prefixes, colons, or backslashes.

AIT family coordinator: ait-release-family.json#

This is not a generic multi-project manifest. Contract ait.release.family/v3 coordinates the official AIT native components, targets, public-source projection, and distribution identities.

{
  "schema": "ait.release.family/v3",
  "family": {
    "name": "ait-native",
    "version": "1.0.0-rc.6",
    "channel": "rc",
    "tag": "v1.0.0-rc.6"
  },
  "targets": ["aarch64-apple-darwin", "x86_64-unknown-linux-gnu"],
  "public_source": {},
  "components": [],
  "distributions": [],
  "compatibility": {}
}

The empty objects and arrays above show the root shape only; they are not a valid release. A real family manifest must satisfy all relationships below.

Family identity and target matrix#

Components#

components contains one through 64 unique component objects.

The tuple of artifact kind and target must not be duplicated within a component.

Distributions#

distributions contains one through 128 rows. Every component must be covered by at least one distribution.

public_source#

The v3 public-source object is deliberately exact because it produces one reviewable release monorepo.

The current allowlist contains only the sibling-core path projections required by the runner and Python source subtrees. Arbitrary source rewriting is not a manifest extension mechanism. The one GitHub product distribution must use the same public identity and cover every family component and target.

Compatibility map#

compatibility is a required object with at most 64 entries. Each key is an identifier and each value is a nonempty bounded single-line string. It records consumer-facing compatibility facts; it does not replace component versions, Snapshot pins, or the target matrix.

Review boundary#

• Record manifest edits in the same Snapshot as the referenced source and dependency-file changes.
• Never update a component source_snapshot without reviewing its admitted artifacts, license, version, and distribution coverage.
• Keep generated candidate, check, build, frozen, promotion, checksum, mapping, and receipt files out of this authoring reference. They are release outputs, not additional user configuration files.
• Use the complete ait release command reference to create, check, build, and inspect release evidence; do not hand-author output receipts.

Related references#

• Configuration-file map
• Complete CLI reference
• Distribution and release