Release Editions and the Declared Labels

An edition is a technology or support target the platform ships to: the standard Linux edition (AKS and any Kubernetes host), the Mac edition (Apple-silicon hosts such as a Mac Studio or a Mac mini running Colima k3s) and the enterprise edition (installations that follow official releases only). A channel label is the moving image tag that names the build an edition currently offers, for example 3-latest, 3-mac or 3-enterprise.

Release Channels says how proven a build is (latest, stable). An edition says what the build targets. Both are spelled as moving image labels, and both are declared in the same file.

A channel label is a tag, not a version. Versions stay plain SemVer and never carry a channel word (policy platform-semver-versioning). A deployment seeds from a label and then runs a resolved version: a pointer is a seed, never a running pin (ImageLine).

Declared in one place

Every moving label lives in .github/release-channels.json (policy declared-release-channels). Its only reader is .github/scripts/release-channels.py:

The labels

Each label lists its writer bindings. A binding names a workflow, a job, and the repositories and registries that job writes the label to. For example, promote writes latest only to mw-plugin-test, while release.yml writes it to GHCR for every released repository. A pruner protects a label in the union of its bindings' repositories.

declared means the label is reserved and already protected, but no workflow writes it yet. A label is therefore protected before its first write, which is the order Released Artifact Retention requires: protect a set before advertising it.

Mac Studio and Mac mini are host profiles of the one Mac edition, not separate labels. Both run the same linux/arm64 image inside Colima's VM. What differs is the hardware: the VM size and the local language model the host's native Ollama can hold in unified memory. One image under two tags would be one set of bytes protected and rolled twice. If the two ever need different bytes, add a second entry, for example {major}-mac-studio.

How retention reads it

• Excluded by name, never locked. A label moves, so locking the digest it names tonight would pin bytes the label leaves tomorrow. lock-pinned-digests.py classifies every declared label as floating, through the reader. A missing or malformed file raises an error instead of silently classifying fewer labels. A pruner skips each matching tag and the manifest that tag names at the moment of the sweep.
• Every status is protected. written, declared and retired labels are all excluded. Removing an entry is the only way to release a label, and that takes a reviewed pull request.
• Never shaped like a version on a self-update repository. The version-shape rule applies to the repositories a self-updater lists (memex-portal-ai, memex-migration, memex-control). A model-service line tag such as whisper's is never a roll candidate. The self-updater (VersionSelect) selects every tag matching ^\d+\.\d+\.\d+([-+].*)?$ except those ending in -latest. A label such as 3.1.0-mac would be rolled to as if it were a build. check refuses that shape, so a new label is {major}-<word>, {major}.{minor}-<word>, or ends in -latest. This is why only {major}.{minor}-stable is declared. The legacy-shaped 3.0.0-stable that Release Channels uses as an example matches PlatformVersionTag and not MovingPointer. Before anything writes that shape, VersionSelect must exclude -stable as it excludes -latest.
• Held to its publishers. For a written literal label (main, latest, edge), check requires each binding's workflow to have that job, to spell the label, and to name every bound repository. A binding that drifts from what its workflow writes fails the check.
• Held to the writers. check renders sample sets in both notations and requires platform-version.py line-pointers (the speller main-cd uses today) to equal the written main-cd.yml#arm labels. If CD moves a pointer the file does not declare, the check fails.

Not labels, and not in this file: per-version markers such as arm-complete-<version> and staging-<sha>-<run>. They belong to the publication records that Released Artifact Retention inventories.

Activating a declared label

1. {major}.{minor}-stable: the stable promoter described in Release Channels writes it, then flips the entry.
2. {major}-enterprise: wire release.yml to move the label forward only, after the release marker, through release-channels.py tags --writer release.yml. Then flip the entry's status to written in the same pull request. Until then tags hands the writer nothing.
3. {major}-mac: needs the Mac acceptance lane below, then the same flip.

The Mac deployment gap

What exists:

• Multi-arch platform images (linux/amd64 and linux/arm64), which run natively in Colima's arm64 VM.
• The memex-local Homebrew CLI: Colima k3s, the same Helm chart as AKS, ingress-nginx with mkcert TLS, Postgres on a PVC, native Ollama, registry mode, an autoroll launchd watcher and a port-forward LaunchAgent. See LocalColimaMac and MacLocalStack.
• homebrew.yml, which installs and tests the formula on a hosted macOS runner. It tests the CLI under bash 3.2. It does not run a cluster.

What a Mac host still lacks. Everything above is built for a developer's laptop. An always-on Mac Studio or Mac mini that serves an instance needs the following:

Mac hosts and the shared artifact store

The estate's compiled modules and bundles are produced once by the build server and the control instance. They are kept in a control-owned shared artifact store. Portals mount that store read-only, and a client environment's control syncs it one way from the upstream control. A Mac host fits this model as an ordinary portal:

• It consumes, never produces. A Mac host mounts its control's store read-only when the two share a network. Otherwise it syncs one way from that control, the same way a client control syncs from upstream. It never writes into a shared store.
• Its builds need their own key, and that does not exist yet. The Mac edition runs linux/arm64. Today's framework identity is the major/epoch compatibility key, which names no architecture, and the bake refuses to publish a second architecture under a key that already holds one: "One framework identity cannot hold two architectures". So arm64 and amd64 bundles cannot both be published today. The outstanding prerequisite (G10) is architecture-safe publication and addressing: an architecture-qualified key for bundles, published beside the amd64 ones and resolved by architecture. The store's sweep then counts each architecture as a represented identity.
• 3-mac waits for that. Without arm64 bundles, a Mac host refuses adoption and compiles from live source. That works, but slowly. G7 (mac-accept) therefore activates 3-mac only once G10 has landed and requires the set's arm64 bundles to be present.
• The prune job reads the same declaration. It skips every label in .github/release-channels.json across all of a label's repositories, so the image a Mac host seeds from survives while the label names it.

Order of delivery:

1. Declare the labels and make retention read them. This page and its pull request do that.
2. G1 and G4 in memex-local. Add --channel <label> to follow a declared label and pin the resolved version, and add --profile mac-studio|mac-mini. These are repository changes with bash 3.2 tests.
3. G2 and G3. A host-install step: the keychain-held pull token, Colima at boot, and the power settings. These need a maintainer-issued registry token.
4. G10, then G7. Make bundle publication and addressing architecture-safe. Then register a self-hosted Apple-silicon runner, add mac-accept to main-cd.yml, and flip {major}-mac to written.
5. G5, G6, G8 and G9. Write the Mac host's deployment record, tunnel, backups and telemetry when the first host is commissioned.

Steps 3 to 5 change live systems: a registry credential, a runner registration, a live host. A maintainer runs them. The repository changes prepare each one.

See also: Release Channels · Release Strategy · Platform Versioning · Pinned Image Retention · Release Support Policy.