[Epic 9] Distribution, governance & release (Core 1.0)

[aquitaine]

Epic: Distribution, governance & release

Sign, notarize, document, and gate the Core 1.0 release. Also tracks the parallel, gated Labs track (VIR-001…008 + HiDPI/EDID/HDR overrides) — which never blocks Core.

Milestone: M3 · PRD: OSS-01…OSS-08, NFR-011/014/016, §16–§18

Scope

• Developer ID sign + notarize + staple: OpenDisplay.app, Rescue, CLI (OSS-04, D-007).
• Public-API-only build path packaged (OSS-03, D-008).
• SBOM, checksums, provenance, signed source tag; reproducible builds (OSS-05, NFR-011).
• Update channel that never replaces the rescue path without a staged health check; signed compatibility/kill-switch dataset (§17).
• Governance: maintainer council, RFC process, DCO, license finalization (GPL-3.0-or-later, D-011), trademark/name (D-012).
• Hardware-lab matrix + certified compatibility table; legal review.

Acceptance (Core 1.0 go/no-go, §16.3)

• All Must/Core-1.0 requirements met; no open P0/P1; full recovery fault suite green; public-API-only build green; signed/notarized artifacts + SBOM ready; accessibility/redaction checks pass; legal review complete.