Publish and serve frozen releases with separate signing custody

README.md

@@ -12,6 +12,12 @@ separate artifact identities and verification records.
 
 The public installer looks up signed releases for Linux x86_64/aarch64 and macOS Apple silicon. Intel Mac and other OS families fail closed.
 
+The staged release root DID is
+`did:key:z6MkgwHd2BCWe1jHMXPiR6H1q1RFPcv1YzhMbK5G1kBarbfe`. Before a staged
+install, compare this DID with the `MAINTAINER_DID` value in the frozen installer.
+Promotion to the live installer requires staged install and update acceptance
+and operator approval.
+
 ```bash
 curl -fsSL https://elastos.elacitylabs.com/install.sh | bash
 ```

docs/COMMAND_MATRIX.md

@@ -87,7 +87,7 @@ bootstrap omits the Runtime DID. The default bootstrap requires caller authority
 | `elastos verify` | Self-contained | Verifies a local capsule signature. With `--cid`, it fetches and verifies provenance through the content provider. |
 | `elastos sign-payload` | Self-contained | Reads bytes from stdin and writes a domain-separated Ed25519 signature and signer DID as JSON. |
 | `elastos publish <path>` | Self-contained | Validates the manifest, checks that the resolved entrypoint path exists, then publishes through the content provider. A microVM uses the explicitly installed local `ipfs-provider`. [Capsule authoring](CAPSULE_AUTHORING.md#publish-with-the-right-gate) owns the exact validation limits. |
-| `elastos publish-release` | Self-contained | Runs the signed release pipeline. Dry-run and preflight modes do not publish. Public URL options may start their own gateway and tunnel step. |
+| `elastos publish-release` | Self-contained | Prepares unsigned native inputs or imports a frozen signed set against an operator-approved public DID. The separate custodian tool owns signing. Dry-run and preflight modes keep publication unchanged. |
 | `elastos share <path>` | Self-contained | Publishes a file or directory, provenance, and a signed channel head unless disabled by flags. |
 | `elastos share <path> --public` | Self-contained | Adds an immediate tunnel and remains active until interrupted. It is not a Runtime host. |
 | `elastos content publish-object`, `elastos content repair-worker`, `elastos content status` | Self-contained | Each command starts the installed content and IPFS provider path directly. |

docs/INSTALL.md

@@ -178,6 +178,26 @@ elastos update --no-p2p --gateway GATEWAY_URL
 
 Replace `CID` and `GATEWAY_URL` with the source values.
 
+## Compare and change the release signer
+
+Compare an announced release DID with the staged root DID in the repository
+[README](../README.md#install-from-the-publisher) before installing or changing
+a source. The source owner can re-trust an existing source explicitly:
+
+```sh
+elastos source add --name EXISTING_SOURCE --publisher NEW_DID
+```
+
+Runtime asks for the complete new DID. Entering another value cancels the
+change. This step keeps the source's channel, install path, Carrier ticket and
+gateways. After confirmation, Runtime accepts release signatures from the new
+DID and refuses signatures from the former DID.
+
+An existing Home that keeps its old source pin refuses a release signed by the
+new maintainer with a signer-mismatch error. That Home continues to trust the
+old key and remains exposed if a copy of that key exists. The owner must compare
+the public DID and complete the explicit re-trust step before its next update.
+
 ## Installed files
 
 When XDG variables are unset, the default paths are:

elastos/crates/elastos-server/src/api/gateway.rs

@@ -30,9 +30,8 @@ use axum::Extension;
 use axum::Json;
 use axum::Router;
 use elastos_common::localhost::{
-    edge_binding_path, edge_site_head_path, my_website_root_path, publisher_artifacts_path,
-    publisher_install_script_path, publisher_release_head_path, publisher_release_manifest_path,
-    publisher_site_releases_dir, rooted_localhost_fs_path, MY_WEBSITE_URI,
+    edge_binding_path, edge_site_head_path, my_website_root_path, publisher_site_releases_dir,
+    rooted_localhost_fs_path, MY_WEBSITE_URI,
 };
 use elastos_common::{CapsuleRole, CapsuleType};
 use elastos_identity::IdentityManager;
@@ -1214,6 +1213,7 @@ fn gateway_router_with_api_url(state: GatewayState, gateway_api_url: String) ->
         )
         .with_state(state.clone())
         .layer(Extension(TrustedGatewayApiUrl(Arc::from(gateway_api_url))))
+        .layer(Extension(ReleaseReadGate::new()))
         .layer(axum::middleware::from_fn(refuse_content_api_resources))
         .layer(axum::middleware::from_fn_with_state(
             admission_state,