Brad-Edwards · Oct 16, 2026 · Oct 14, 2026 · Oct 14, 2026 · Oct 15, 2026 · Oct 15, 2026
@@ -1,12 +1,13 @@
 # Verified pack supply-chain rehearsal (issue #191, ADR 0037).
 #
 # Manually triggered end-to-end integration for the distribution workflow. It
-# stands up an ephemeral OCI registry (registry:2), publishes TechVault with its
-# generated SBOM + provenance, signs the validated set-digest subject with
-# keyless Sigstore (the GitHub Actions OIDC identity — the one thing a developer
-# box cannot provide), then pulls, verifies signature + content, installs, and
-# checks update/rollback guidance. Nothing here is standing infrastructure: the
-# registry and the signing identity are spun up per run.
+# stands up an ephemeral OCI registry (registry:2), publishes the pack directory
+# named by the `pack` input (TechVault by default) with its generated SBOM +
+# provenance, signs the validated set-digest subject with keyless Sigstore (the
+# GitHub Actions OIDC identity — the one thing a developer box cannot provide),
+# then pulls, verifies signature + content, installs, and checks update/rollback
+# guidance. Nothing here is standing infrastructure: the registry and the signing
+# identity are spun up per run.
 #
 # The workflow *shape* (triggers, permissions, pinning, step order) is guarded by
 # tests/test_pack_distribution_workflow.py, and the real acceptance criterion —
@@ -68,4 +69,7 @@ jobs:
           python -m pip install --require-hashes -r requirements/runtime.txt
           python -m pip install --no-deps -e .
       - name: Run the pack-distribution rehearsal
+        env:
+          # The dispatch value reaches the script as data, never as shell text.
+          REHEARSAL_PACK: ${{ inputs.pack }}
         run: python tests_integration/distribution_rehearsal.py
@@ -1,3 +1,3 @@
 {
-  ".": "6.3.0"
+  ".": "6.3.1"
 }
@@ -11,6 +11,15 @@ this file at release-prep. See [`changelog.d/README.md`](changelog.d/README.md).
 
 <!-- towncrier release notes start -->
 
+## [6.3.1](https://github.com/OpenRAE/env-packs/compare/v6.3.0...v6.3.1) (2026-10-14)
+
+
+### Bug Fixes
+
+* **ci:** derive the distribution rehearsal's release paths from the pack version ([#453](https://github.com/OpenRAE/env-packs/issues/453)) ([812b8ef](https://github.com/OpenRAE/env-packs/commit/812b8ef37520b2fb3cce02bac0d1f5a26f7ae4b4)), closes [#452](https://github.com/OpenRAE/env-packs/issues/452)
+* correct techvault MISP sync API key fixtures ([#461](https://github.com/OpenRAE/env-packs/issues/461)) ([eb64eef](https://github.com/OpenRAE/env-packs/commit/eb64eefca4f984e2dba8df4102167893d0e98178))
+* **release:** report a pack.yaml contents or profile_bundles value that is not a mapping instead of crashing lint ([#456](https://github.com/OpenRAE/env-packs/issues/456)) ([9a5c065](https://github.com/OpenRAE/env-packs/commit/9a5c06558c168e4cc062b8db69175a78651cc629))
+
 ## [6.3.0](https://github.com/OpenRAE/env-packs/compare/v6.2.1...v6.3.0) (2026-10-13)
 
 

@@ -41,7 +41,8 @@ fails the build.
 Signing and pushing to a registry use established tooling (cosign, oras) and a
 keyless Sigstore identity, so they run in CI, not on a laptop. The
 `Pack distribution rehearsal` workflow does the full publish → sign → install →
-verify pass against an ephemeral registry.
+verify pass against an ephemeral registry, for the pack directory named by its
+`pack` input (default `packs/techvault`).
 
 ## Verify
 

@@ -0,0 +1,7 @@
+# SMTP/IMAP mail service
+
+Reusable smtp/imap mail service with domain-specific configuration, declared service surfaces, seeded objects, and pack-local integration material.
+
+The release includes a RAES module, explicit service and identity surfaces, benign seed inventory, planning estimates, component-inventory inputs, integration guidance, and composition tests.
+
+It is authoring content, not a runtime plugin, scenario narrative, backend qualification, or evidence claim.
@@ -0,0 +1,15 @@
+# SMTP/IMAP mail service integration material
+
+Author parameter: `mail_domain` (default `environment.test`).
+
+## Exported RAES declarations
+
+- `nodes.mail`
+- `content.seed_inventory`
+- `accounts.mail_operator`
+
+## Composition notes
+
+- No mandatory external authoring prerequisite; connect exported surfaces at the pack composition root as needed.
+- Keep credentials and runtime-selected endpoints outside kit parameters and seed assets.
+- Validate the completed ordinary pack after adding pack-level relationships.
@@ -0,0 +1,22 @@
+schema_version: environment-kit-seed/v1
+kit: infrastructure.smtp-imap-mail-service
+configuration:
+  mail_domain: environment.test
+  deployment_profile: standard
+  service_label: smtp-imap-mail-service
+declared_objects:
+- id: mail_domain
+  kind: infrastructure-seed
+  sensitivity: non-secret
+- id: mailboxes
+  kind: infrastructure-seed
+  sensitivity: non-secret
+- id: aliases
+  kind: infrastructure-seed
+  sensitivity: non-secret
+- id: seed_messages
+  kind: infrastructure-seed
+  sensitivity: non-secret
+integration_requirements:
+- No mandatory external authoring prerequisite; connect exported surfaces at the pack
+  composition root as needed.
@@ -0,0 +1,113 @@
+{
+  "schema_version": "associated-artifact-manifest/v1",
+  "manifest_id": "infrastructure.smtp-imap-mail-service-associated-artifacts",
+  "manifest_version": "1.2.0",
+  "canonicalization_profile": "associated-artifact-set/v1",
+  "scope": "scenario",
+  "parent_ref": {
+    "ref_kind": "scenario-snapshot",
+    "ref_id": "smtp-imap-mail-service",
+    "ref_version": null,
+    "ref_digest": "sha256:38ad49c3567fb8d6a1ef257d7a26e7a19a906f0e53d66102a04466759a4e5915",
+    "ref_path": null
+  },
+  "artifacts": {
+    "readme": {
+      "artifact_id": "readme",
+      "role": "documentation",
+      "media_type": "text/markdown",
+      "uri": "raes-environment-kit:/README.md",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "d5ca58ea7130283318c6a3b7685dc711ebf805b0e3433b9d37feba90ee513c38"
+      },
+      "size_bytes": 477,
+      "created_at": "2026-10-15T00:00:00Z",
+      "source": "infrastructure.smtp-imap-mail-service@1.2.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "integration-material": {
+      "artifact_id": "integration-material",
+      "role": "operator-guide",
+      "media_type": "text/markdown",
+      "uri": "raes-environment-kit:/assets/integration.md",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "5370704a583607c25e92e340af96d060a8613df9bb2422e09cfce0c9694c237f"
+      },
+      "size_bytes": 515,
+      "created_at": "2026-10-15T00:00:00Z",
+      "source": "infrastructure.smtp-imap-mail-service@1.2.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "seed-profile": {
+      "artifact_id": "seed-profile",
+      "role": "configuration",
+      "media_type": "application/yaml",
+      "uri": "raes-environment-kit:/assets/seed.yaml",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "373971e0ebc64634f4b5c61f6303e7d2d9db6e42c38a59d1342355ac996b0da0"
+      },
+      "size_bytes": 645,
+      "created_at": "2026-10-15T00:00:00Z",
+      "source": "infrastructure.smtp-imap-mail-service@1.2.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "kit-manifest": {
+      "artifact_id": "kit-manifest",
+      "role": "manifest",
+      "media_type": "application/yaml",
+      "uri": "raes-environment-kit:/kit.yaml",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "95983ba6063239f7b2321fb88cd5bbedee6c7d172139b065cd15193c4a0d8812"
+      },
+      "size_bytes": 1678,
+      "created_at": "2026-10-15T00:00:00Z",
+      "source": "infrastructure.smtp-imap-mail-service@1.2.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "module": {
+      "artifact_id": "module",
+      "role": "configuration",
+      "media_type": "application/yaml",
+      "uri": "raes-environment-kit:/module.sdl.yaml",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "4efabb0a668db232bc58e93a87340681b64ebcdfcfc20335f0dc7ea62c179271"
+      },
+      "size_bytes": 3086,
+      "created_at": "2026-10-15T00:00:00Z",
+      "source": "infrastructure.smtp-imap-mail-service@1.2.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "composition-tests": {
+      "artifact_id": "composition-tests",
+      "role": "configuration",
+      "media_type": "application/yaml",
+      "uri": "raes-environment-kit:/tests/composition.yaml",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "d70f4fd395197c38a5b9ffdf68b71a6f9feca59059ed073e3c3fc1409b82d5f6"
+      },
+      "size_bytes": 265,
+      "created_at": "2026-10-15T00:00:00Z",
+      "source": "infrastructure.smtp-imap-mail-service@1.2.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    }
+  },
+  "set_digest": "sha256:fd64f338c30e66354aef2f7b7de0afd5ed9e9defa60e0bbcc4227b239a9aa71f"
+}
@@ -0,0 +1,49 @@
+schema_version: environment-pack-kit/v1
+id: infrastructure.smtp-imap-mail-service
+version: 1.2.0
+title: SMTP/IMAP mail service
+summary: Reusable smtp/imap mail service with domain-specific configuration, declared
+  service surfaces, seeded objects, and pack-local integration material.
+concern: network-shared
+released_at: '2026-10-15T00:00:00Z'
+module:
+  path: module.sdl.yaml
+assets:
+- source: assets/integration.md
+  target: assets/kits/smtp-imap-mail-service/integration.md
+  visibility: operator
+  artifact_id: integration-material
+- source: assets/seed.yaml
+  target: assets/kits/smtp-imap-mail-service/seed.yaml
+  visibility: operator
+  artifact_id: seed-profile
+resources:
+  cpu_cores: 2
+  memory_mib: 2048
+  storage_mib: 4096
+  notes: Planning estimates only; realization sizing remains backend-owned.
+prerequisites: []
+limitations:
+- Declares static infrastructure, seeded state, and integration surfaces only.
+- Does not claim launch, readiness, traffic attachment, credential delivery, or runtime
+  evidence.
+- No mandatory external authoring prerequisite; connect exported surfaces at the pack
+  composition root as needed.
+license:
+  expression: MIT
+  redistribution: open
+  attribution: OpenRAE contributors
+tests:
+- path: tests/composition.yaml
+  kind: validate
+- path: tests/composition.yaml
+  kind: parameter-variation
+- path: tests/composition.yaml
+  kind: multi-kit
+component_inventory:
+- scope: unresolved
+  authority: raes-source
+  ref: /nodes/mail/source
+  description: RAES carries the declared mail-server stable source; immutable artifact
+    selection remains unresolved until pack publication.
+associated_artifact_manifest: associated-artifacts.json
@@ -0,0 +1,117 @@
+name: smtp-imap-mail-service
+version: 1.2.0
+description: Reusable static infrastructure for SMTP/IMAP mail service. Configures
+  mail_domain through the kit parameter contract.
+module:
+  id: infrastructure/smtp-imap-mail-service
+  version: 1.2.0
+  parameters:
+  - deployment_profile
+  - service_label
+  - mail_domain
+  exports:
+    nodes:
+    - mail
+    content:
+    - seed_inventory
+    accounts:
+    - mail_operator
+  description: Composable SMTP/IMAP mail service infrastructure module.
+variables:
+  deployment_profile:
+    type: string
+    default: standard
+    allowed_values:
+    - compact
+    - standard
+  service_label:
+    type: string
+    default: smtp-imap-mail-service
+  mail_domain:
+    type: string
+    default: environment.test
+nodes:
+  mail:
+    type: compute
+    description: '${deployment_profile} profile for ${service_label} (SMTP/IMAP mail
+      service). Configuration: ${mail_domain}.'
+    source:
+      name: mail-server
+      version: stable
+    resources:
+      cpu: 2
+      ram: 2 GiB
+    services:
+    - port: 25
+      protocol: tcp
+      name: smtp
+      description: Declared smtp service surface.
+    - port: 143
+      protocol: tcp
+      name: imap
+      description: Declared imap service surface.
+    runtime:
+      mail_services:
+      - mail_service_id: environment_mail
+        service: smtp
+        engine: postfix-dovecot
+        listeners:
+        - listener_id: smtp_listener
+          service: smtp
+          protocol: smtp
+          tls_mode: starttls-available
+        - listener_id: imap_listener
+          service: imap
+          protocol: imap
+          tls_mode: starttls-available
+        domains:
+        - domain_id: primary_domain
+          name: ${mail_domain}
+        mailboxes:
+        - mailbox_id: operator_mailbox
+          address: operator@${mail_domain}
+          domain_ref: primary_domain
+        - mailbox_id: service_mailbox
+          address: service@${mail_domain}
+          domain_ref: primary_domain
+content:
+  seed_inventory:
+    type: dataset
+    target: mail
+    description: Benign infrastructure seed inventory for ${mail_domain}.
+    items:
+    - name: mail_domain
+      display_name: Mail Domain
+      tags:
+      - infrastructure
+      - seed
+      description: Declared mail domain for this reusable service.
+    - name: mailboxes
+      display_name: Mailboxes
+      tags:
+      - infrastructure
+      - seed
+      description: Declared mailboxes for this reusable service.
+    - name: aliases
+      display_name: Aliases
+      tags:
+      - infrastructure
+      - seed
+      description: Declared aliases for this reusable service.
+    - name: seed_messages
+      display_name: Seed Messages
+      tags:
+      - infrastructure
+      - seed
+      description: Declared seed messages for this reusable service.
+accounts:
+  mail_operator:
+    username: mail-operator
+    node: mail
+    password_strength: strong
+    description: Declared environment account; credential delivery remains backend-owned.
+realization:
+  constraints:
+  - field_pointer: /nodes/mail
+    concern: compute-substrate
+    posture: open
@@ -0,0 +1,9 @@
+default:
+  deployment_profile: standard
+  service_label: smtp-imap-mail-service
+  mail_domain: environment.test
+variation:
+  deployment_profile: compact
+  service_label: smtp-imap-mail-service-alternate
+  mail_domain: alternate.test
+multi_kit_group: network-shared