Record verified Conductor 1.1.0 publication and SLICE11 completion

CODEX.md

@@ -378,3 +378,11 @@ Date: 2026-07-20
 - Local source, browser, visual, Node-RED/PostgreSQL and hardened production container checks pass. Exact publication identity and final external verification are recorded in SLICE11.md and the Gitea v1.1.0 release entry when complete.
 - The source release includes the accepted home/Projects/catalog and SLICE10 identity changes. Preserve the pre-existing documentation reorganization.
 - SLICE12 setup-conductor.sh and SLICE13 customer-VM migration remain separate; no customer deployment or real social post was performed in SLICE11.
+
+
+### 2026-09-13 SLICE11 publication receipt
+
+- SLICE11 is complete. Conductor v1.1.0 source and Linux/AMD64 image are published at https://gitea.skeletonworks.online/vwiebe/conductor/releases/tag/v1.1.0; exact release commit fc73f2672602983bd80fa29ee501886ba64ea5a3.
+- Anonymous source/image/attachment retrieval, checksum and OCI identity verification, and the published image's backup/restore/recreation suite all passed. The compatible Social Scheduler 0.5.0 kit is attached to the release.
+- SLICE11.md records the full receipt and digests. The original source folder was aligned to the release commit after byte-for-byte and empty-index checks; working files were preserved.
+- SLICE12 and SLICE13 remain planned, not started. The customer VM still runs its prior combined image.

ROADMAP.md

@@ -354,7 +354,7 @@ Slice 8 release packaging now depends on completed Slice 7a authentication/RBAC/
 
 The original slices above remain historical. The 2026-09-13 follow-up uses these instructions and progress logs:
 
-- [SLICE10: browser titles and application icons](SLICE10.md) — implemented and locally verified; release/customer VM acceptance pending.
+- [SLICE10: browser titles and application icons](SLICE10.md) — implemented and released in v1.1.0; customer-VM deployment belongs to SLICE13.
-- [SLICE11: independent release and installed-app packages](SLICE11.md) — implemented and locally verified; publication in progress.
+- [SLICE11: independent release and installed-app packages](SLICE11.md) — complete; v1.1.0 published and publicly verified.
 - [SLICE12: fresh-install setup script](SLICE12.md) — planned.
 - [SLICE13: idempotent upgrades](SLICE13.md) — planned.

SLICE10.md

@@ -101,3 +101,7 @@ User-uploaded icons support PNG in this slice; trusted installed-app assets can
 ### Next action
 
 Proceed with SLICE11 when requested: independently release Conductor and replace source-overlay app packaging with the generic installed-app package interface. SLICE12 then updates fresh installation; SLICE13 supplies the repeatable upgrade path. Preserve the completed title/icon behavior and its tests during that work.
+
+### 2026-09-13 — Released through SLICE11
+
+The SLICE10 title/default icon/custom icon changes are included in the publicly verified Conductor v1.1.0 release. See [SLICE11](SLICE11.md) for exact source and image identities, artifacts and final verification. Customer-VM deployment remains SLICE13.

SLICE11.md

@@ -1,6 +1,6 @@
 # SLICE11 — Independent Conductor release and installed application packages
 
-Status: In progress
+Status: Complete — v1.1.0 published and publicly verified
 
 ## Purpose
 
@@ -14,15 +14,15 @@ The user authorized SLICE11 on 2026-09-13. SLICE12 and SLICE13 remain separate.
 
 ## Scope
 
-- [ ] Define a versioned installed-application package containing frontend assets and the metadata needed for discovery and controlled API access.
+- [x] Define a versioned installed-application package containing frontend assets and the metadata needed for discovery and controlled API access.
-- [ ] Keep installed application files in persistent storage separate from the core Conductor image.
+- [x] Keep installed application files in persistent storage separate from the core Conductor image.
-- [ ] Provide a generic host/integration mechanism that preserves Conductor authentication and backend authorization; do not allow arbitrary user-supplied backend code.
+- [x] Provide a generic host/integration mechanism that preserves Conductor authentication and backend authorization; do not allow arbitrary user-supplied backend code.
-- [ ] Adapt Social Scheduler to install/register its own application package without editing Conductor source or rebuilding a special Conductor image.
+- [x] Adapt Social Scheduler to install/register its own application package without editing Conductor source or rebuilding a special Conductor image.
-- [ ] Maintain the customer-domain behavior and existing /social-scheduler links where practical.
+- [x] Maintain the customer-domain behavior and existing /social-scheduler links where practical.
-- [ ] Prove the interface with a small second test application; do not implement the future customer control panel yet.
+- [x] Prove the interface with a small second test application; do not implement the future customer control panel yet.
-- [ ] Verify a fresh core installation has an empty Included with Skeleton Works list and no Social Scheduler dependency.
+- [x] Verify a fresh core installation has an empty Included with Skeleton Works list and no Social Scheduler dependency.
-- [ ] Build a versioned release, publish source/artifacts/container image using the existing release conventions, record digests and verify the published artifacts.
+- [x] Build a versioned release, publish source/artifacts/container image using the existing release conventions, record digests and verify the published artifacts.
-- [ ] Document compatibility and migration from the current combined Conductor/Social Scheduler image.
+- [x] Document compatibility and migration from the current combined Conductor/Social Scheduler image.
 
 ## Acceptance checks
 
@@ -49,7 +49,7 @@ The customer control panel and other SaaS backlog items remain outside these fou
 
 ## Current handoff
 
-Implementation and local validation are complete. Preparing the exact source commit and published artifacts; customer-VM migration remains SLICE13.
+SLICE11 is complete. Proceed with SLICE12 only when the user requests it, then SLICE13 for the existing VM. The current VM continues running its existing combined installation.
 
 ### 2026-09-13 — Implementation started
 
@@ -72,3 +72,19 @@ Implementation and local validation are complete. Preparing the exact source com
 - Docker was initially unavailable; the user restarted it. Production checks then found that docker cp cannot target /tmp in the read-only container. Changed installer transfer to private stdin-fed files created by the running non-root process, and the lifecycle fixture to stream tar into its writable temporary area.
 - Real hardened-container checks now pass: package installation twice leaves the image unchanged; recreation retains the app; backup/restore recovers the database and deliberately removed package assets.
 - No customer VM, social credential, scheduler queue, setup-conductor.sh or upgrade script was changed.
+
+
+### 2026-09-13 — Publication and final verification complete
+
+- Published [Conductor v1.1.0](https://gitea.skeletonworks.online/vwiebe/conductor/releases/tag/v1.1.0), including the exact source archive, compatible Social Scheduler 0.5.0 portable kit, SHA256SUMS and SLICE11-VERIFICATION.json.
+- Release source commit: fc73f2672602983bd80fa29ee501886ba64ea5a3. Annotated source tag: v1.1.0. The 283 files in the anonymously downloaded Gitea source archive match this commit byte for byte.
+- Published Linux/AMD64 image: gitea.skeletonworks.online/vwiebe/conductor:v1.1.0; matching immutable source identity: git-fc73f2672602.
+- OCI index digest: sha256:ab5e7dcaed065a304660af31e53ffada290b22dc9176ffeb5817f2e7f07ac313.
+- Linux/AMD64 manifest digest: sha256:87a31b370eab199af96c6592799645c98492314eaabdde8e21f2922a414c8d51.
+- Both image tags point to the same tested artifact. Anonymous pull passed; OCI revision/version and architecture matched the source/tag. The anonymously retrieved image passed the production lifecycle suite, including backup/restore of deliberately removed app assets and container recreation.
+- The actual Social Scheduler installer passed repeated installation and recreation checks against this final image. Shellcheck passed. The final browser suite also rejects an upstream response that reflects the private connection token.
+- All four release attachments were fetched without authentication and matched their SHA256 checksums; the public release page and metadata were read back successfully.
+- Publication used one controlled manual image path. Tag-triggered image builds are disabled; the existing workflow is opt-in. Version/source image tags were checked absent and were never overwritten.
+- Built and committed in an isolated release checkout. After publication, proved the original source files were identical and the index was empty, then advanced its branch/index to the release commit without changing working file bytes. The original source folder is ready for the next slice.
+- Local publication evidence and archives are under release/ (ignored by Git); browser screenshots remain under test-results/slice11. The public release entry is the durable artifact receipt.
+- SLICE12 and SLICE13 remain planned. No customer VM was contacted or upgraded, and no customer credentials, Node-RED flows or PostgreSQL schedules were changed.

docs/RELEASE_NOTES_v1.1.0.md

@@ -12,4 +12,4 @@ Production dependency audit is clean after compatible runtime updates and a patc
 
 Read [Application packages](APP_PACKAGES.md) for the installer and API contract, and [Operations](OPERATIONS.md) for recovery. Current combined Conductor/Social Scheduler installations require the migration sequence in that guide. The old setup-conductor.sh is not an upgrade tool. SLICE12 and SLICE13 deliver the setup and existing-VM upgrade procedures.
 
-Release publication details, exact commit and artifact digests are recorded in the release entry after verification. A local build or an attached archive alone does not prove image publication.
+Published release: [Conductor v1.1.0](https://gitea.skeletonworks.online/vwiebe/conductor/releases/tag/v1.1.0). Its entry records the exact source commit, image digests, artifact checksums and verified anonymous downloads. See [SLICE11](../SLICE11.md) for the completed work log. Customer-VM deployment remains a separate SLICE13 step.