GAL-2 Time Contract RC5.8 / 1.2.0-rc.3 Public Evaluator Preview

Artifacts:

mac/GAL2_TimeContract_RC58_1_2_0_RC3_macOS_PersonalSigned_LiveIXOYE_VerifierFix_NOTARIZED_STAPLED.pkg
SHA256: d54df56b5a32429f932ca6063cae9173510f7ac067614f54c250edcb391c04bc

linux/GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip
SHA256: db0a651439ccda3a0686f05d18512e15059363bd39599d9a95c4c9cb5974571c

linux/GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip.asc
SHA256: dd967a87c7ab2ff34c9815e3605d9d4cfd6001423ce29249fa7facae9f060952

keys/GAL2_RELEASE_SIGNING_PUBLIC_KEY_2F9528A0EE6D77170B6947FF9CAB67A8AFA08B75.asc

Validation summary:

- macOS package hash verified.
- macOS package is signed with Apple Developer ID Installer certificate.
- macOS notarization is trusted by Apple notary service via pkgutil/spctl.
- Linux Docker ARM64 evaluator bundle hash verified.
- Linux detached GPG signature verified.
- Linux internal SHA256SUMS verified clean.
- Linux real API LIVE witness proof present and verified in bundle.
- Secret scan passed.

Product boundary:

- GAL-2 governs application-facing Time Contracts.
- IXOYE is advisory-only.
- IXOYE is not a time source.
- IXOYE is not a fallback time source.
- IXOYE does not decide safe_to_consume.
- safe_to_consume authority remains GAL2_Time_Contract_policy_only.

Release boundary:

- Public evaluator preview / enterprise pilot candidate.
- Not final enterprise production certification.
- macOS remains PersonalSigned, not Corp-signed.
- No API key or literal secret is included.

Compatibility note:

The Linux public filename is retained for website compatibility:
linux/GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip

That file now contains the corrected SHAFIX payload with internal SHA256SUMS verified clean.