# Immutable AppPackage delivery envelope

`releaseartifact` is the R1b delivery codec for the existing neutral
`appauthority.Package`. It does not define App identity, release identity,
Catalog state, installation state, or a serving pointer.

The canonical package file has one closed JSON shape:

```json
{"schema_version":"nexuscrm.app-package-artifact/v1","app_release_digest":"sha256:<64 lowercase hex>","canonical_manifest":{},"canonical_metadata_bundle":{},"component_blobs":[{"component_id":"sha256:<64 lowercase hex>","canonical_behavior":"<base64>"}]}
```

`canonical_manifest` and `canonical_metadata_bundle` are the RFC 8785 bytes
owned by `nexuscrm-contract/pkg/appauthority`. Component blobs are ordered by
component ID. `AppReleaseDigest` remains the package root; a SHA-256 of the
transport file may be recorded by a registry or BOM only as an integrity fact.

Publisher proof is detached so provenance does not change release identity:

```json
{"schema_version":"nexuscrm.publisher-attestation/v1","publisher_id":"io.example","key_id":"release-key-1","app_id":"io.example.work","semantic_version":"1.0.0","app_release_digest":"sha256:<64 lowercase hex>","canonicalization_profile":"rfc8785","artifact_media_type":"application/vnd.nexuscrm.app-package.v1+json","issued_at":"2026-01-01T00:00:00Z","provenance":{"schema_version":"nexuscrm.app-package-provenance/v1","source_repository":"example/work-app","source_revision":"<immutable revision>","source_path":"metadata","source_tree_digest":"sha256:<64 lowercase hex>","builder_id":"example/app-release-builder/v1","contract_module_version":"v0.1.8"},"signature_algorithm":"ed25519","signature":"<base64>"}
```

The Ed25519 signature binds the complete AppRelease tuple and provenance.
Catalog resolves the key only from its operator-owned publisher trust registry,
verifies protocol, engine-capability, and every component kind/format
compatibility, and then commits through the sole durable
`ImportReleaseArtifact` command. Catalog re-locks and compares the exact key
used for signature verification before that commit. Neither an artifact nor a
deployment BOM can reserve an AppID or create an AppInstallation.

Validation:

```bash
GOWORK=off go test ./releaseartifact ./catalogapp -count=1
GOWORK=off go test -race ./releaseartifact ./catalogapp -count=1
GOWORK=off go vet ./releaseartifact ./catalogapp
```