R16 — Sources, SBOM, licenses and reproducibility

Status: NOT EXECUTED as a complete hardware procedure — T2B1 and T3B1.

Use the shared acceptance record, with a separate result for every required model/OS. Host and emulator output remains separate evidence.

Preconditions

Identified clean source commit; pinned upstream/patches; reference Linux/Nix environment; both hardware images and reviewed notices.

Steps

1. Follow ../developer/release.md to build T2B1/T3B1 and collect binaries/version/SHA-256. Retain logs, ELF/maps and flash/RAM budgets.
2. Run tools/ci/reproducible.sh T2B1, then T3B1 without competing builds; retain both hashes per model. Repeat on an independent builder and compare, or explicitly mark independent evidence unexecuted.
3. Generate python3 tools/sbom.py --output dist/feuristic.spdx.json --firmware dist/*.bin. Review linked dependencies/licenses, compute SHA256SUMS and verify every file.
4. Check LICENSE, NOTICE, embedded licenses, corresponding sources, submodule revisions, full patch series and build scripts in the source package. An SBOM alone does not satisfy source obligations.
5. Verify candidate provenance, signing/vendor policy and actual PID. Public development keys and test PID remain stable-release blockers pending review. On physical devices, verify the tested image is the manifest’s image.
6. Check ../release-checklist.md and R01–R15 evidence for both models. The tag workflow creates a draft pre-release; it does not imply stable publication.

Expected result

Complete buildable sources, documented repeatable firmware hashes, consistent SBOM/checksums/notices, accurate provenance/third-party classification. Only actual campaign results permit qualification.

Evidence to retain

Source/license archives, commit and patch hashes, Nix/independent-builder logs, two hashes per model, reviewed SBOM, verified manifests, signed campaign decision and hardware matrix.