tracking: installer implementation after manifest-first foundation

[YoneRai12]

Summary

This is the single parent tracker for installer implementation work after the manifest-first foundation in #313.

#313 is closed as the original definition tracker. This issue keeps the remaining implementation checklist visible without recreating noisy child issues.

Current public repository scope

Allowed in the public repo:

• local manifest verification
• SHA256 and artifact naming validation
• dry-run install/update planning
• deterministic non-production/test trust fixtures
• local verification and docs

Not allowed in the public repo:

• production signing keys
• production trust stores
• production key rotation service
• release signing service
• network download-and-execute installer
• irm ... | iex
• PATH/package/service/registry mutation by default

Remaining public-repo tasks

• PowerShell dry-run installer skeleton that validates local inputs and prints planned actions only.
• Manifest-to-release-asset hash and naming consistency check.
• Safe install, rollback, update, and uninstall docs.
• Future install.yonerai.com / yonerai.com/install onboarding copy that clearly avoids remote-execution claims.
• Keep production signing/trust/key rotation/release signing service documented as private/official future work only.

Acceptance boundary

This tracker is not a production installer completion claim. Close it only when the public-safe installer implementation lane has either shipped the above items or intentionally moved them into a narrower owner-approved tracker.

Related

• Original definition tracker: feat: define installer bootstrap system (manifest-first) #313
• Installer distribution task doc: docs/tasks/installer-distribution.md

[YoneRai12]

PR #452 merged the first local bootstrap implementation step for this tracker: install-local.ps1 is plan-first by default, rejects virtual-environment targets outside the extracted YonerAI folder, and only performs local .venv setup when -Execute is explicit.

It still does not provide a production installer, remote execution, PATH/registry/service mutation, production signing/trust, npm, or winget distribution.

[YoneRai12]

v0.5.1 Distribution Trust Update を完了しました。

Merged PR:

• release: YonerAI v0.5.1 配布信頼性更新を準備する #453 release: YonerAI v0.5.1 配布信頼性更新を準備する

Release:

• https://github.com/YoneRai12/YonerAI/releases/tag/v0.5.1
• stable release, not prerelease
• target: 360d340827695d337cd409ca8f9e36f11569209f
• asset: YonerAI-0.5.1.zip
• sha256: 1cab727e4d8dc03a489031be450762f3dbd813ffe8624c097dd3d09ce2532724
• size: 9047003

Completed for this tracker:

• v0.5.1 release manifest with versioned artifact name and recorded SHA256/size
• deterministic release archive generation using HEAD^{tree} with fixed mtimes
• local install-local.ps1 plan-only validation path documented and tested
• manifest verify / install plan / update plan docs and tests for v0.5.1
• yonerai.com install/release/press content updated for v0.5.1
• source-available/noncommercial license posture remains explicit

Still remaining, so this tracker should stay open:

• production signing key/trust store/key rotation belongs to a future private/official lane
• no production network installer yet
• no npm or winget channel yet
• rollback/update/uninstall integration still needs a dedicated implementation lane
• manifest-to-live GitHub Release asset validation is still local/manual, not a production signing pipeline