opschain admin agent-release create

packs:agentspacks:agent-governance

opschain admin agent-release create --name <release> --version <semver> \
    --artifact <sha/digest> --manifest <file> --key-id <id> \
    (--signature-file <file> | --key-file <file>) [--type service|ai]

Registers one immutable signed release at the dev stage. The server verifies the signature against the named signing key before the row lands: an unsigned submission, a signature that does not verify over the manifest and artifact (tampered), or a non-active key refuse by name — and the refusal is itself audited (warn:agent_release:refused). A (name, version) pair is unique forever: ship a fix as a new version, never an edit.

--type freezes the declared agent type into the signed release; an agent enrolling from the release must declare the same type (a signed release cannot be misdeclared without breaking its signature).

Flags

Flag	Meaning
--name / --version	The release identity (<name>@<version> everywhere else).
--artifact <id>	Content-addressed artifact identity: a git sha or image digest.
--manifest <file>	The manifest JSON document the signature covers.
--key-id <id>	Registered signing key the signature verifies against.
--signature-file <file>	A sign output file.
--key-file <file>	Sign inline with a keygen private key instead.
--type <type>	Declared agent type: service or ai (optional).