From b05ca72c99a30af5693d836d0ddcf20965dbeb88 Mon Sep 17 00:00:00 2001
From: Danil Silantyev <danilsilantyevwork@gmail.com>
Date: Sun, 12 Jul 2026 01:33:16 +0700
Subject: [PATCH] feat(manifest): declare the minimal runtime_bundle path set

Add build/manifest.json:runtime_bundle.paths -- the install-required tracked
paths (installer, catalogs, build and runtime metadata, license, README) that
form a minimal runtime distribution closure, excluding governance, CI, and
source-level documentation. Regenerate build/release-evidence.json for the new
content digest. Record the runtime_bundle and the previously undocumented
release-evidence bundle under CHANGELOG [Unreleased].
---
 CHANGELOG.md                |  6 ++++++
 build/manifest.json         | 14 ++++++++++++++
 build/release-evidence.json |  8 ++++----
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 16a1227..6aceac2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   general-availability download and Ubuntu is NDDev-supported on top of the
   vendor Linux beta channel, each with an explicit verified/expiry freshness
   window.
+- A tracked `build/release-evidence.json` bundle binding a release to the
+  validated harness commit and a content digest of the exact module setup; the
+  release workflow refuses to publish without a present, consistent bundle.
+- A declared minimal `runtime_bundle` path set in `build/manifest.json`: the
+  install-required tracked paths (installer, catalogs, build and runtime
+  metadata, license) excluding governance, CI, and source-level documentation.
 
 ## [2.1.2] - 2026-07-10
 
diff --git a/build/manifest.json b/build/manifest.json
index df522d3..b8de3d8 100644
--- a/build/manifest.json
+++ b/build/manifest.json
@@ -12,6 +12,20 @@
     "docs/": "public installation, architecture, and secrets documentation",
     ".github/": "public security, release, and repository-automation workflows"
   },
+  "runtime_bundle": {
+    "_comment": "Minimal runtime distribution closure: the tracked paths required to install ZCode from a selected setup, excluding governance, CI, and source-level documentation. A release may publish this as a second, attested bundle distinct from the full source archive.",
+    "paths": [
+      "VERSION",
+      "LICENSE",
+      "NOTICE",
+      "README.md",
+      "build",
+      "cli-tools",
+      "config",
+      "references",
+      "zcode_tools"
+    ]
+  },
   "artifact_integrity_policy": {
     "metadata_source": "build/version.json:zcode_download_artifacts",
     "canonical_cdn_base": "https://cdn-zcode.z.ai/zcode/electron/releases",
diff --git a/build/release-evidence.json b/build/release-evidence.json
index ef3f09c..2511624 100644
--- a/build/release-evidence.json
+++ b/build/release-evidence.json
@@ -2,11 +2,11 @@
   "schema_version": 1,
   "module": {
     "repository": "NDDev-it-com/nddev-zcode-app",
-    "setup_digest": "sha256:a37371e22ca4b4bb711cb5e59a1b017382d5034856c100ed7d273f8c0fcf4a7b"
+    "setup_digest": "sha256:a4338b65f702404e0e2e9b91314063a980f0c803d0d84961839f12c656a2778b"
   },
   "harness": {
     "repository": "NDDev-it-com/nddev-harnesses",
-    "commit": "7d9239d673eaebbbd172a1bb7d906eee82d730e2"
+    "commit": "26f540414bbe6d4e7d0f9776057cac9e4c9d699f"
   },
   "adapter": {
     "id": "zcode",
@@ -37,8 +37,8 @@
     "benchmark:macos",
     "benchmark:ubuntu"
   ],
-  "generated_at_utc": "2026-07-11T18:04:36Z",
-  "expires_at_utc": "2027-01-07T18:04:36Z",
+  "generated_at_utc": "2026-07-11T18:32:54Z",
+  "expires_at_utc": "2027-01-07T18:32:54Z",
   "promotion": {
     "decision": "approved"
   }