Complete OSS launch gate

[vishr]

OSS launch gate

Important

This issue owns public OSS release readiness for labstack/fanout.
The OSS/Enterprise boundary remains tracked in
labstack/fanout-enterprise#1.
LabStack's production deployment is not part of the OSS release gate.

Completed on 2026-08-22 against main at ece67b4a and release
v2026.8.3.

Completed launch work

Public distribution

• The GitHub repository and ghcr.io/labstack/fanout package are public.
• CalVer releases produce native Linux/macOS archives for amd64 and arm64,
  SHA-256 checksums, GitHub build-provenance attestations, and a Linux
  amd64/arm64 image.
• The release workflow verifies the repository state, full race suite,
  native binaries, image vulnerability/secret scans, anonymous image pull,
  anonymous release downloads, every checksum and legal payload, the public
  installer, embedded version, and every archive's provenance.
• The first fully green release workflow is
  v2026.8.3.
• The deployable image is
  ghcr.io/labstack/fanout:2026.8.3@sha256:3af6481c54408aa3337f7571ea223d23c74bdf897f1e10e0847a90c9d924ceff
  and contains both linux/amd64 and linux/arm64 manifests.

Frictionless OSS use

• One authentication secret is sufficient to boot; AI and SMTP are
  optional.
• First-administrator setup, the one-time ingest token, and
  fanout login-link <email> recovery are documented.
• OTLP/gRPC and OTLP/HTTP onboarding, ingest authentication, Collector
  configuration, and an authenticated benchmark command are documented.
• A released container was exercised locally from first boot through admin
  setup, authenticated OTLP traces/logs/metrics over gRPC and HTTP, health and
  readiness, UI rendering, and a sustained benchmark run with zero ingest
  errors.

Licensing and public claims

• THIRD_PARTY_NOTICES is deterministically generated from the shipped Go
  and browser dependency graphs and CI rejects drift.
• Native archives and the final container carry LICENSE, NOTICE,
  THIRD_PARTY_NOTICES, and TRADEMARK.md.
• The unverifiable historical performance headline and orphaned benchmark
  artifacts were removed. New performance claims must include sanitized raw
  output, exact server image digest, exact driver revision, configuration, and
  reproducible commands.

Security and repository governance

• main is protected by ruleset Protect main: pull requests, resolved
  review threads, Gate, Container scan, and CLA are required; deletion and
  non-fast-forward updates are blocked; there is no bypass.
• Vulnerability alerts, Dependabot security updates, secret scanning, push
  protection, and CodeQL default setup are enabled.
• All workflow actions are pinned to full commit SHAs.
• The current Go and Bun dependency graphs have no known actionable
  vulnerabilities: govulncheck ./... reports no reachable vulnerabilities,
  OSV reports zero known vulnerabilities, and both Bun audits are clean.
• Trivy reports no HIGH/CRITICAL vulnerability or secret finding in the
  final runtime image; repository and history secret review found no real
  credential or private Enterprise source disclosure.
• Code of Conduct, support policy, issue forms, and pull-request template
  are present.

Supply-chain policy

• Native archives and SHA256SUMS receive GitHub build-provenance
  attestations, and the public verifier checks every archive.
• Release images are built natively per architecture, scanned before their
  digests are assembled into the public manifest, and are intended to be
  deployed by immutable digest.
• Image SBOM publication, image signing, and image provenance are deferred;
  they are not represented as guarantees. The accepted first-release minimum is
  archive provenance plus checksums, native image builds, mandatory scanning,
  and digest-pinned deployment.

Acceptance criteria

• A new user can install Fanout anonymously, create the first administrator,
  ingest authenticated OTLP, and use the UI from the public documentation.
• Release archives and images carry reviewed first- and third-party license
  material.
• Dependency and security checks are clean or have reviewed, documented
  exceptions.
• main is protected and privileged workflows remain immutable by SHA.
• No unsupported benchmark headline is published; the publication standard
  requires raw evidence and exact server/driver versions.
• just check, just test-race, govulncheck ./..., container scanning,
  CodeQL, and the complete release workflow pass.

Follow-on work that does not block this gate

#95 retains optional package
distribution such as Homebrew, .deb/.rpm, and macOS notarization. LabStack's
fanout.labstack.com Onebox manifest and secrets belong in the private
Enterprise/deployment repository and are intentionally not shipped here.

[vishr]

Read-only readiness recheck on 2026-08-21: the repository is still private; there are no GitHub Releases; main has neither branch protection nor a ruleset; GitHub code security, Dependabot security updates, secret scanning, and push protection are disabled; and Actions do not require SHA pinning. #167 did improve the runtime configuration model and operator-facing examples, but the release/supply-chain gates in this checklist remain active.

[vishr]

Housekeeping recheck — 2026-08-22

Rechecked against main at 3fde331c and current GitHub repository/package settings.

Completed since the issue body was written

• Evaluating Fanout should not require an LLM key or an SMTP relay #168 reduced evaluation to one required secret. AI and SMTP are optional, the first-administrator setup URL is documented, and fanout login-link provides login and recovery without SMTP.
• The current Go dependency graph has 0 reachable vulnerabilities under govulncheck ./... (one required module contains an unreachable advisory).
• The operator configuration surface and one-secret Docker quickstart are materially better than the original body describes.

Still blocking a public release

• The repository and GHCR package are still private; there are no GitHub Releases and therefore no real latest release path to test anonymously.
• main has no branch protection/ruleset. Code security, Dependabot security updates, secret scanning, and push protection are disabled.
• There are no issue/PR templates or Code of Conduct.
• The README benchmark command still omits -token, while cmd/bench rejects a run without it. The first-admin response returns the ingest token, but the README still does not show capturing it, storing it, using the OTLP authentication header, or passing it to the benchmark.
• Current bun audit results are worse than the original snapshot:
  • ui/host: 11 advisories — 3 high, 7 moderate, 1 low.
  • ui/apps: 10 advisories — 3 high, 6 moderate, 1 low.
  • Most arrive through @modelcontextprotocol/sdk; the Vite/PostCSS toolchain contributes additional findings. Reachability still needs review, but this cannot be called clean.
• NOTICE remains a generic statement rather than generated/reviewed third-party licensing material.
• Release artifacts are not on main; Ship native binaries: goreleaser + multi-arch Docker + install.sh + Homebrew tap #95 remains open.
• The OpenSpec/canonical-spec claim remains inconsistent with the repository contents and should be removed or made true before launch.

Recommended execution order

Do not implement this umbrella as one PR. The smallest coherent launch sequence is:

1. Standardise configuration, settings, and environment variable naming before the first public release #170 — settle breaking configuration names while changes are still free.
2. Ship native binaries: goreleaser + multi-arch Docker + install.sh + Homebrew tap #95 — finish and validate release artifacts against the settled configuration.
3. Resolve the JavaScript advisories and add the audit policy/gate.
4. Correct the ingest-token/benchmark onboarding path and licensing material.
5. Enable repository/package protections, publish a test CalVer release, and exercise the quickstart anonymously.

Keeping this checklist open as the launch gate.