Skip to content

HotM 2026.7.0

Choose a tag to compare

View all tags
@jmagly jmagly released this 24 Jul 23:12
· 0 commits to main since this release
v2026.7.0
2bea753

HotM 2026.7.0

Release date: 2026-07-24

Type: Signed, profile-scoped suite-contract baseline

Recovery claim: core-v1 only

This release makes HotM's exact Fortemi API, event, compatibility, recovery,
sidecar, and container receipts discoverable. It deliberately does not claim
full-v1 interoperability, complete backup, suite-wide portability, or schema
parity.

Install

Bundled Docker deployment

cat > .env <<'ENV'
POSTGRES_PASSWORD=replace-with-a-long-random-local-password
ENV
docker compose -f docker-compose.prod.yml pull
docker compose -f docker-compose.prod.yml up -d

The supported hotm-bundle:2026.7.0 image contains the HotM UI plus the
digest-pinned Fortemi PostgreSQL/API/MCP runtime. The UI-only
hotm-ui:2026.7.0 image remains available for externally managed Fortemi
deployments.

Desktop

The numbered Gitea release publishes the signed-tag desktop artifacts and
checksum files. The GitHub mirror now resolves to the exact same signed tag
object and release commit and carries the same six byte-verified assets. Gitea
remains the release and signing authority; the correction receipt is tracked
in HotM issue #274.

Contract scope

Released core-v1 recovery

HotM accepts the registered core-v1 migration window: exact schemas 1.0.0,
1.1.0, and 1.2.0. Before upload it validates the TAR inventory, component
digests, JSON records, counts, profile, schema, and minimum-reader boundary.
Recovery suppresses post-import inference so the restored snapshot is not
immediately changed.

The immutable authority is Fortemi commit
81fbeaf065df3818edd046ed8a744f10eeb00e6f, Knowledge Shard contract revision
19. The HotM consumer commits are b394e5160780ac8a752ca0891d7a3686394d2bd0,
b174b3a1b75129fdcaddc7be6afb612056433e53, and
90c7c3c7a475fd6c5ff86ecfbb02c7088d60a263.

Guarded full-v1 boundary

HotM includes a bounded, streaming consumer for exact 2.0.0/full-v1 and
requires dry_run=true&verify_signature=require to pass before it sends a
mutating recovery request. The authority is Fortemi commit
6343bd899958445bbc7e7e87b0dc92a8429d5a06, contract revision 20; the HotM
consumer is b43c65f044381e5af7e4131f2d96ad02173f2db9.

The live clean-destination test stopped before mutation because the current
Fortemi exporter emitted no signature.json. Fortemi issue #1088 owns that
producer defect. Therefore full-v1 interoperability and complete-backup claims
remain false in this release.

Other contract gates

  • Compatibility schema 1, revision 2026-07-06, and
    minimum_hotm_enterprise_client are enforced before capability
    normalization (3e0b6b826454fd710fff82cfad2ba61a224fd513).
  • OpenAPI authority: Fortemi commit
    ec14e0447711c45a8d5c5445ce47a35f26d4346a, artifact SHA-256
    4d1f9655c60ed6f97f86c790cab64ea9826ac9ca61084250a3b242fd10a7e30c.
  • Event/AsyncAPI authority: Fortemi commit
    98c9b29deee43b9c5bd96278f1f96837595882cd, generated AsyncAPI SHA-256
    f6a6fbc39af52b713b6f5c40dbb6e46baeb8a1b352a19288e79073863766bdf4.
  • Desktop sidecar: sidecar-45aff7e6f439, with exact per-platform hashes in
    release/sidecar-provenance.json.
  • Bundle base: Fortemi runtime
    c93742d7c75b481621b821f4584304289eb364d5 at immutable image index
    sha256:7d014c5580e62526069a0fc0d7ad994ed70fa73a8810d2b07476b1dfe5a99ae4.

Verification

  • Full UI suite: 1,588 tests passed.
  • TypeScript production build: passed.
  • Exact core-v1/full-v1 authority and receipt verifier: passed.
  • Bundle build and live smoke: UI /healthz, Fortemi API /livez,
    compatibility metadata, and MCP health passed.
  • Compose resolution, shell syntax, YAML/JSON parsing, sidecar download and
    SHA-256 verification, and provenance coverage passed.

Container issue #241 tracks the immutable image publication receipt. Recovery
issue #272 remains open until a signed producer export completes the live
full-v1 clean-destination cell.

Assets 8
Loading