Expand description
Stateless distributor for the signed fleet.resolved.json artifact.
Serves the canonical signed bytes from state.verified_fleet (the
cp_manifest_poll worker’s in-memory snapshot). The bytes returned
are exactly the bytes CP fetched from the channel-refs source and
verified against the trust roots; signature verification + the
rollout-anchored fleet_resolved_hash discriminator happen at the
consumer (per RFC-0004 §1 invariant #1 — single signed source of
truth + defense-in-depth at the verification gate).