Deployment infrastructure: Docker, Helm, and release pipeline

[jeremymanning]

Description

No containerization or deployment infrastructure exists beyond CI workflows. The project needs:

1. Dockerfile for the worldcompute binary
2. Docker Compose for local multi-node testing
3. Kubernetes manifests or Helm chart for coordinator deployment
4. Release pipeline: reproducible builds, code signing, binary distribution
5. Staged release gates per whitepaper (Phase 0→1→2→3→4)

Requirements

• Multi-stage Dockerfile (build + runtime) with minimal attack surface
• Docker Compose for 3-node local cluster testing
• Helm chart for coordinator nodes on K8s
• Reproducible build configuration (deterministic compilation)
• Code signing for release binaries (per FR-005)
• Release channel enforcement: dev → staging → production (no skip)
• Binary distribution for Linux (x86_64, aarch64), macOS (Apple Silicon), Windows

Success Criteria

• docker build produces minimal container image
• docker compose up creates functional 3-node cluster
• Helm chart deploys coordinator set on K8s
• Release binaries are reproducibly built and code-signed
• Release channels enforce sequential promotion
• Binary downloads available for all target platforms

Testing (Principle V)

• Build and run container → verify agent functionality
• Docker Compose 3-node cluster → verify peer discovery and job execution
• Helm deploy on real K8s → verify coordinator election
• Verify binary reproducibility (two builds produce identical output)

[jeremymanning]

Partially addressed by spec 004 / PR #59 — not closing. Dockerfile + docker-compose.yml + Helm chart files exist. HOWEVER, docker build has not been run to verify; the multi-stage image has not been tested; Helm chart has not been deployed.

Remaining work tracked here.

[jeremymanning]

Spec 005 progress — PR #61

STATUS: Release-pipeline scripts written. Deployment verification deferred.

Done (commit d691751):

• ops/release/build-reproducible.sh — deterministic build via pinned SOURCE_DATE_EPOCH + RUSTFLAGS path-remap + cargo clean
• ops/release/sign-release.sh — offline Ed25519 signing via openssl pkeyutl
• ops/release/verify-release.sh — base64 sig decode + SPKI reconstruction + openssl verify (pins RELEASE_PUBLIC_KEY_HEX, currently zero sentinel until first signed release)
• docs/releases.md — full release-engineering procedure (drift-check gate, reproducible build, evidence requirements per SC, rollback)

Remaining:

• T112 docker build pass in CI — Dockerfile exists from spec 004; no CI run verifies it
• T113 .github/workflows/reproducible-build.yml with two-runner diffoscope comparison — not written
• T115 Helm chart deploy to Kind in CI — not done
• T121 dry-run release tag for validation — not done

See notes/session-2026-04-19-spec-005-kickoff.md.