Establish release-candidate platform foundation

.gitea/workflows/build-images.yaml

@@ -11,30 +11,42 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  plan:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+    steps:
+      - name: Check out repository
+        uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+      - name: Install manifest dependency
+        run: apt-get update && apt-get install -y python3-yaml
+      - name: Check generated platform files
+        run: python3 scripts/generate-platform.py --check
+      - name: Generate build matrix
+        id: matrix
+        run: printf 'matrix=%s\n' "$(python3 scripts/generate-platform.py --matrix gitea)" >> "$GITHUB_OUTPUT"
+
   build:
+    needs: plan
     runs-on: incus
     timeout-minutes: 240
     strategy:
       fail-fast: false
       max-parallel: 1
-      matrix:
-        variant: [base, php, python, cpp, typescript, full]
+      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
     steps:
       - name: Check out repository
         uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-
       - name: Validate repository
         run: ./tests/validate-repository.sh
-
       - name: Verify Incus build runner
-        run: ./scripts/ci/check-incus-runner.sh
-
+        run: |
+          ./scripts/ci/check-incus-runner.sh
+          ./scripts/ci/check-architecture.sh "${{ matrix.architecture }}"
       - name: Build image
         run: ./scripts/build-image.sh "${{ matrix.variant }}"
-
       - name: Package image
         run: ./scripts/package-image.sh "${{ matrix.variant }}"
-
       - name: Publish Gitea Generic Package
         if: ${{ startsWith(gitea.ref, 'refs/tags/v') }}
         env:

.gitea/workflows/validate.yaml

@@ -18,7 +18,7 @@ jobs:
       - name: Install validation dependencies
         run: |
           apt-get update
-          apt-get install -y jq shellcheck yamllint
+          apt-get install -y jq python3-yaml shellcheck yamllint
 
       - name: Validate repository
         run: ./tests/validate-repository.sh

.github/workflows/build-images.yaml

@@ -14,39 +14,50 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  plan:
+    runs-on: ubuntu-24.04
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Install manifest dependency
+        run: sudo apt-get update && sudo apt-get install -y python3-yaml
+      - name: Check generated platform files
+        run: python3 scripts/generate-platform.py --check
+      - name: Generate build matrix
+        id: matrix
+        run: printf 'matrix=%s\n' "$(python3 scripts/generate-platform.py --matrix github)" >> "$GITHUB_OUTPUT"
+
   build:
+    needs: plan
     runs-on: [self-hosted, linux, incus]
     timeout-minutes: 240
     strategy:
       fail-fast: false
       max-parallel: 1
-      matrix:
-        variant: [base, php, python, cpp, typescript, full]
+      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-
       - name: Validate repository
         run: ./tests/validate-repository.sh
-
       - name: Verify Incus build runner
-        run: ./scripts/ci/check-incus-runner.sh
-
+        run: |
+          ./scripts/ci/check-incus-runner.sh
+          ./scripts/ci/check-architecture.sh "${{ matrix.architecture }}"
       - name: Build image
         run: ./scripts/build-image.sh "${{ matrix.variant }}"
-
       - name: Package image
         run: ./scripts/package-image.sh "${{ matrix.variant }}"
-
       - name: Upload downloadable image package
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
-          name: vdm-opencode-${{ matrix.variant }}-${{ github.ref_name }}
-          path: build/packages/*/${{ matrix.variant }}/
+          name: vdm-opencode-${{ matrix.variant }}-${{ matrix.architecture }}-${{ github.ref_name }}
+          path: build/packages/*/${{ matrix.architecture }}/${{ matrix.variant }}/
           if-no-files-found: error
           compression-level: 0
           retention-days: 30
-
       - name: Publish Gitea Generic Package
         if: ${{ startsWith(github.ref, 'refs/tags/v') && vars.GITEA_PUBLISH_ENABLED == 'true' }}
         env:

.github/workflows/validate.yaml

@@ -25,7 +25,7 @@ jobs:
       - name: Install validation dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y jq shellcheck yamllint
+          sudo apt-get install -y jq python3-yaml shellcheck yamllint
 
       - name: Validate repository
         run: ./tests/validate-repository.sh

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.3.0-rc.1 - 2026-07-22
+
+- Made `manifest/images.yaml` the schema-validated authority for composition,
+  architectures, policies, sizes, profiles and GitHub/Gitea matrices.
+- Added GPL-3.0-only licensing and Vast Development Method copyright ownership.
+- Added restricted Incus projects, public-only connected egress, offline and
+  fail-closed gateway policies, enforced session TTLs and VM expiry reaping.
+- Removed Java and split browser/database provisioning into reusable components.
+- Added architecture-safe artifacts, provenance, SBOM/Grype release gates,
+  OpenBao-backed Cosign hooks and upload-last Gitea completion markers.
+- Added OpenAI, Claude, Gemini, Grok and local gateway routes plus Git/VPS
+  capability-path documentation.
+- Added static manifest, security, drift, matrix and artifact tamper tests.
+
 ## 0.2.0 - 2026-07-22
 
 - Split GitHub and Gitea workflows so each uses its own expression context and runner model.

COPYRIGHT

@@ -0,0 +1,8 @@
+VDM OpenCode Platform
+
+Copyright (C) 2026 Vast Development Method
+
+Vast Development Method is the copyright holder for the original source code,
+configuration, documentation, and other original works in this repository.
+
+SPDX-License-Identifier: GPL-3.0-only