BUS Core v1.0.4 — Update Chain Hardening Bridge

BUS Core v1.0.4 is a security and release-governance hardening release focused on the manual update-check chain.

This release prepares BUS Core for future artifact verification while preserving backward compatibility with existing deployed clients. Existing clients can still read the top-level latest.version and latest.download.url manifest fields and open the Lighthouse-provided download link. Newer clients can also consume channel-aware and additive manifest metadata.

What changed

Update-check behavior

• Update checks are now default-on / opt-out.
• Startup update checks run once when:
• updates.enabled !== false
• updates.check_on_startup !== false
• Manual Check now remains available regardless of startup-check settings.
• Removed hidden 15-minute background polling.
• Removed update-check localStorage stale/success timestamp tracking.

Channel-aware update hardening

BUS Core now has explicit update channel handling for:

• stable
• test
• partner-3dque
• lts-1.1
• security-hotfix

Non-stable channels now require explicit channel-specific manifest entries and no longer silently fall back to public stable/latest metadata.

Manifest validation hardening

The update manifest parser now validates supported manifest shapes, including:

• legacy direct stable manifests
• canonical top-level latest
• channels.<channel>
• top-level channel-keyed entries

Stable manifests remain backward compatible with existing latest.version and latest.download.url clients.

Optional manifest metadata is now shape-validated when present, including:

• sha256
• size_bytes
• release_notes_url
• signature_url
• artifact kind/type/platform
• publisher
• signer

Declared artifact metadata groundwork

Added internal ManifestRelease metadata carry-forward so BUS Core can retain declared, manifest-provided artifact metadata for future verification work.

This metadata is not yet trusted or verified. It is retained as declared manifest data only.

Release and governance hardening

• Added/update release governance validation around canonical version authority.
• Confirmed release tags must match core/version.py::VERSION.
• Preserved the canonical artifact naming rule:
• TGC-BUS-Core-<VERSION>.zip
• Clarified documentation around the current limits of the update system.

What this release does not do

This release does not add automatic updating.

BUS Core still does not:

• auto-download updates
• auto-install updates
• stage update artifacts
• execute update packages
• verify artifact hashes
• verify artifact signatures
• verify publisher identity
• verify artifact size before surfacing the download URL

Windows code signing remains a manual post-build release step.

Security posture

This is a bridge release. It strengthens the update-check and manifest-handling foundation so a future release can enforce artifact verification properly.

The next update-security phase is expected to focus on:

• artifact hash verification
• signature verification
• publisher/certificate validation
• trusted update rejection behavior
• DB ownership / single-instance control before any staged/apply update flow

Testing

Focused update-policy, manifest-validation, and API update-check tests passed in the clean test environment:

97 passed

The signed Windows EXE was also verified successfully with the True Good Craft code-signing certificate.

Notes for existing users

No migration action is required.

BUS Core remains local-first and manual-update controlled. If an update is available, the app will surface the download link, but it will not install or run anything automatically.