SSPACEAGEDOCUMENTATION/
Release and Assurance

Packaging And Identity Audit

Updated Aug 11, 2026   |   5.8 KB   |   docs/Packaging_And_Identity_Audit.md

Packaging And Identity Audit

Updated: 2026-08-11

Customer-Facing Identity

  • Product: SPACEAGE by Sample Squad
  • Company: Sample Squad
  • Bundle ID: com.samplesquad.spaceage
  • Version: 0.9.89

The historical CMake target and C++ class names retain CinematicDrums as internal implementation identifiers. They are not customer-facing and are deliberately left unchanged to avoid a broad, low-value code rename during beta convergence.

Package Contents

Every timestamped release archive is required to contain:

  • Standalone Windows executable
  • VST3 bundle
  • Project README
  • Third-party code and licensing ledger
  • Inter SIL Open Font License notice
  • TinySoundFont MIT license notice
  • Hash-locked dependency and embedded-asset manifests
  • Factory-preset provenance record
  • Machine-readable factory-preset inventory and content fingerprint
  • A generated release manifest naming the exact source commit, product identity, runtime requirements, and SHA-256 fingerprints for customer binaries and release evidence

Automated Proof

tools/test-release-hygiene.ps1 validates product metadata, offline JUCE boundaries, required legal files, ledger entries, exact JUCE fallback commit, hash-locked dependencies and embedded assets, and package-script coverage. Release convergence runs it as gate R02-A.

The gate also validates Resources/DependencyLicenseManifest.json: eleven integrated dependency families, fourteen hash-locked repository artifacts, complete shipping notices, the JUCE 8.0.8 pin, and full registration of the Source/ThirdParty tree. Public packages include this manifest. Human decisions are recorded separately in docs/Release_Legal_Signoff.md.

tools/package_release.ps1 additionally refuses a dirty or uncommitted source tree, incomplete human legal signoff, blocked embedded asset, stale executable identity, failed copied-standalone launch, or mismatched VST3 metadata. The staged archive is therefore tied to one exact clean commit and to the exact binary bytes described by Documentation/ReleaseManifest.json.

Packaging also requires the detached clean-checkout convergence receipt for that same source commit. The receipt is copied into the customer archive, SHA-256-bound by the release manifest, and rechecked after extraction. A clean current worktree cannot substitute for the detached exact-SHA proof.

Public packaging has no -NoBuild mode: every archive performs a fresh Release build after proving the source tree is clean. It also inspects PE imports for the standalone and VST3, rejects unreviewed runtime DLLs, requires the expected Visual C++/Universal CRT imports, and records that exact import inventory in the release manifest.

After compression, tools/test-release-archive.ps1 treats the ZIP as untrusted input. It rejects unsafe or duplicate entry paths, excessive expansion, unknown top-level content, source-identity drift, missing runtime evidence, and every artifact or legal-evidence hash mismatch. Only a verified archive receives the adjacent .sha256 publication sidecar. A synthetic contract test proves both the accepted-package path and rejection of a tampered executable.

Staging uses a new private random directory with terminating error semantics. The package is first written under a .partial.zip name; only after complete validation is it atomically promoted to the public filename. The build cache is bound to the current repository source path, packaging rejects build-directory overrides, and the build runs clean-first. Extracted customer binaries undergo identity, runtime-import, VST3-structure, and standalone-launch checks again.

The release JUCE source is no longer trusted merely because its folder is named JUCE-8.0.8. tools/verify-juce-source-against-upstream.ps1 compared all 4,249 local files with official commit d6181bde38d858c283c3b7bf699ce6340c050b5d. The resulting fingerprint f10e738b0d374847daba65784a9739b199b0a801dc8bf9fcc26cff73f02cac67 is stored in Resources/JuceSourceFingerprint.json; public packaging recomputes it offline before compilation and ships the evidence in the archive.

Pre-build legal approval and post-build archive approval are separate. The legal record has twelve fixed mandatory decision IDs and requires exactly one TG55 provenance path. The finished ZIP receives a generated attestation bound to its exact filename, SHA-256, and source commit. Public distribution remains blocked until that record is completed and validated.

The 619 factory presets are separately identity-locked by Resources/FactoryPresetInventory.json. A deterministic runtime sweep hashes each bank identity, ordered preset identity, and sorted normalized parameter state. Release hygiene requires fingerprint 4d2ddc400437c5d6, and the package manifest records the exact inventory-file SHA-256 beside its human provenance record.

The currently available development executable is intentionally rejected by the binary-identity gate because its Windows metadata still reports historical company name Immor Audio. A fresh release build must report Sample Squad before packaging can proceed.

Human Work Still Required

  • Confirm the commercial JUCE license held by the shipping entity.
  • Confirm the Steinberg VST3 proprietary-license path before public VST3 distribution.
  • Confirm ownership or redistribution permission for every bundled sound, image, preset, and marketing asset.
  • Complete the factory-preset provenance attestation for the release-candidate collection.
  • Test the archive on a clean Windows account or machine.
  • Complete and validate the generated exact-ZIP archive attestation.
  • Add installer, Authenticode signing, timestamping, and checksum publication before a commercial public release.
  • Verify or bundle the Microsoft Visual C++ runtime requirements on a clean supported Windows machine.