UP-06: Produce the exact signed test candidate #112

Part of #89.

Owner: Anders (@andersalm).

Depends on UP-01 (#107), #186 (new maintainer key), accepted packaging and exact signing approval.

Done means

Release acceptance: Each exposed feature works clearly from start to end, including recovery. Keep unfinished or confusing features hidden until their complete journey passes. Hiding a feature does not complete its task; source checks alone do not establish installed acceptance.

• Platform binaries report the intended version and match the signed artifact receipts. (evidence: UP-07: Accept updates on Mac, Linux and Jetson #113 (comment))
• Rehearsals sign with a disposable fixture key that no installed Home trusts. Test: a Home refuses a fixture-signed release. (evidence: https://github.com/Elacity/elastos-runtime/actions/runs/37068999780, https://github.com/Elacity/elastos-runtime/actions/runs/37086607684)
• Approved test-channel publication is signed only with the new maintainer key from Replace the maintainer release key and keep signing off the public server #186. Proof: a fresh Home accepts it (re-trusted Home moved to 0.8.0: Release 0.8.0 #93 on 7 Oct). (evidence: UP-07: Accept updates on Mac, Linux and Jetson #113 (comment))
• The signed release carries every capsule G3 Community chat: Chat and People with Home #86's journey uses (chat-room, people, inbox, home-gui); the candidate's journey opens Chat once, which installs chat-room over Carrier. (alpha.8: all four in the signed home profile; Linux and Jetson installs fetch chat-room over Carrier, G1 Install and update: Signed update #89 comment 6040804076; Anders's System update opens Chat, 7 Oct.) G3 Community chat: Chat and People with Home #86's own acceptance stays in G3 Community chat: Chat and People with Home #86. The signed Community network file/pin and the complete multi-user Chat journey remain G3 Community chat: Chat and People with Home #86 gates; this checked capsule-delivery result retains its existing scope.
• GitHub and signed distribution referring to the same accepted release inputs moved to 0.8.0: Release 0.8.0 #93 (main and tags change only at the real 0.8.0 release).

Browser plan reconciliation — 2026-10-08

The Browser signed-candidate output for #288 binds Runtime, Browser capsule, selected Engine/Exit role records, image and any chosen profile-template descriptor, matching host helpers/entitlements/dependencies and canonical configuration to one exact source/artifact set. #217 produces the closure; #108 stages it and #287 acquires immutable bytes. Private source-home/test-key composition supplies fixture proof. Approved production signing and publication retain the existing operator/key/review gates. Existing accepted alpha.8 evidence keeps its recorded scope; it does not certify absent Browser payloads.