FrameBridge 0.3.4 corresponding-source release

Snapshot assembled only from the signed corresponding-source archive.
Source archive SHA-256: db91a270cdefc4be79056ed38a0b4a16747e1ab130592645eac40fa3809809df

README-SOURCE-ARCHIVE.md

@@ -1,37 +1,37 @@
-# FrameBridge 0.3.1 source archive
+# FrameBridge 0.3.4 corresponding source
 
-This archive preserves the repository layout needed by the offline builder.
-From this directory, run python3 source/packaging/build_expanded.py to build
-FrameBridge-0.3.1.deb. The builder writes source/build and source/release;
-it does not install or start FrameBridge. Debian's dpkg-deb and the documented
-build prerequisites must already be available.
+This archive supplies the project source and the reviewed cp313 and cp312 vendor
+inputs for Debian 13, Ubuntu 24.04 and Linux Mint 22.x on amd64. Keep its matching
+SOURCE-ARCHIVE-MANIFEST.json sidecar beside the archive. Signatures, publication
+and actual OS lifecycle acceptance are recorded separately; assembly alone does
+not certify them. Historical signed assets retain their immutable identities.
 
-Original FrameBridge material is GNU GPL version 3 only. Read LICENSE,
-LICENSING.md, COPYRIGHT.md, LICENSE-STATUS.md and OFFICIAL-RELEASES.md for
-scope, attribution, third-party terms and the official-release trust model.
+The offline builder needs Python 3, dpkg/dpkg-deb and the documented host build
+prerequisites. It never fetches dependencies, installs packages or starts services.
+Extract the archive beside its matching sidecar and run from the extracted root:
 
-The project source asset is accompanied by these separate dependency assets:
+    python3 source/packaging/build_expanded.py --target debian13-amd64-py313 --public-release --source-manifest ../SOURCE-ARCHIVE-MANIFEST.json
+    python3 source/packaging/build_expanded.py --target ubuntu24.04-amd64-py312 --vendor-dir source/target-vendors/cp312 --public-release --source-manifest ../SOURCE-ARCHIVE-MANIFEST.json
+    python3 source/packaging/build_expanded.py --target mint22-amd64-py312 --vendor-dir source/target-vendors/cp312 --public-release --source-manifest ../SOURCE-ARCHIVE-MANIFEST.json
+
+Public-release mode verifies the archive hash, every current project source file
+and the selected reviewed vendor identity before assembling a package. It does
+not assert an independent rebuild of third-party native wheels or tunnel-client.
+--check-vendor validates inputs without staging a package.
+
+Original FrameBridge material is GNU GPL version 3 only. Third-party material
+retains its applicable terms. Read LICENSE, LICENSING.md, COPYRIGHT.md and the
+source-delivery records. Distribute these separate, unchanged dependency assets
+with the release; their historical names do not identify the installer version:
 
 - FrameBridge-0.3.1-Community-Preview1-dependency-sources.tar.gz
-  82,606,998 bytes
-  SHA-256 64540a85bd65eac3f394d8c0a967cacbc00e112676d57d644dcd1bb691c1926a
+  Bytes: 82606998
+  SHA-256: 64540a85bd65eac3f394d8c0a967cacbc00e112676d57d644dcd1bb691c1926a
 - FrameBridge-0.3.1-tunnel-client-dependency-sources.tar.gz
-  26,941,745 bytes
-  SHA-256 6445d4f0e773aba833fe5c610fbae54102b92de2ce636438f769f21e890c2bd9
+  Bytes: 26941745
+  SHA-256: 6445d4f0e773aba833fe5c610fbae54102b92de2ce636438f769f21e890c2bd9
 
-The Preview1 filename deliberately preserves the identity of an immutable
-shared asset. Retain licensing/third-party/R2-SUPPLEMENTS.json and its referenced
-source notices with the dependency sources. The source indices and
-SOURCE-AVAILABILITY.md there record scope and provenance. Do not substitute
-unrelated archives. The retained tunnel executable is not claimed to have been
-independently rebuilt from an identified own-source revision.
-
-The blog directory contains licensing policies and the post template.
-Editorial article drafts are omitted because they are not source build inputs.
-
-Only source/evidence/BASELINE.json is included from technical evidence. Runtime
-profiles, private QA logs, generated build/release files and Git history are
-outside the source archive allowlist.
-
-A completed archive or builder run is not a declaration of public readiness.
-Release checksums, signatures and publication status are recorded separately.
+The exact own-source revision of the retained tunnel executable is not asserted.
+Retain the R2 source-notice supplements, both dependency indices and original
+notices. Private profiles, credentials, QA logs, build outputs, Git history and
+unpublished blog drafts are excluded from the archive allowlist.