release-train: staging -> main

[LukasWodka]

Automated promotion by the release train (RFC-0008 D14). Head is the train-managed release-train/to-main branch (a mirror of staging), so it never collides with a human PR. Merged only when the fr-gate is green.

---

Note

Low Risk
Documentation and terminology only; no runtime, auth, or API behavior changes in this diff.

Overview
Terminology: TERMINOLOGY.md makes peers the canonical user-facing word for invited data scientists who train on your data (replacing collaborators, decided 2026-09-08 per RFC-0081). Related rows and the “words to retire” list now point vendor → peers; code/API identifiers are explicitly out of scope for this rename.

Security docs: environment-setup/security.mdx adds signed images to the enforcement list and a new Verify a training image section: digest-first cosign verify against tracebloc-engine GitHub Actions workflows, warnings about trusting only the digest from your own docker pull, plus how to export SBOM and SLSA provenance via docker buildx imagetools.

^{Reviewed by Cursor Bugbot for commit 2cfe42f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2cfe42f. Configure here.}

[cursor]

Cosign identity omits pre-rename repo

High Severity

The certificate-identity-regexp matches only tracebloc/tracebloc-engine, so images still signed under the pre-rename tracebloc-client subject fail cosign verify. Failure copy then treats no matching signatures as meaning the image is tampered, unsigned, or differently signed.

Additional Locations (2)

• environment-setup/security.mdx#L78-L81
• environment-setup/security.mdx#L103-L104

 

^{Triggered by learned rule: cosign verify identity regexp must cover pre-rename repo}

^{Reviewed by Cursor Bugbot for commit 2cfe42f. Configure here.}

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Cosign identity omits pre-rename repo, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Cosign identity omits pre-rename repo (high) - filed as https://github.com/tracebloc/backend/issues/3424, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Cosign identity omits pre-rename repo, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Cosign identity omits pre-rename repo (high) - filed as https://github.com/tracebloc/backend/issues/3424, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Cosign identity omits pre-rename repo, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Glossary retirement left stale people-nouns - filed as https://github.com/tracebloc/backend/issues/3427, thread resolved by the train.
• Cosign identity omits pre-rename repo (high) - filed as https://github.com/tracebloc/backend/issues/3424, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Cosign identity omits pre-rename repo, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Cosign identity omits pre-rename repo (high) - filed as https://github.com/tracebloc/backend/issues/3424, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Cosign identity omits pre-rename repo, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Cosign identity omits pre-rename repo (high) - filed as https://github.com/tracebloc/backend/issues/3424, thread left UNRESOLVED so it keeps blocking.