Pack catalog
A Business Pack is the versioned, signed unit that turns the generic OS into one industry. This lists what this deployment can load.
Releases
Provenance. Every event in the log carries a soul hash; a release is what lets you take that hash and find the manifest, the version and the date it was published.
Release history needs Postgres and a platform sign-in.
Not built yet
Signature verification, and rolling a workspace back to an earlier version of the same pack. The signature seam exists in the loader (verifyPackSignature) and returns true for unsigned development packs — enforcement belongs in the publish pipeline, which is where a signature can actually be required. Version rollback needs the pack artifact store: today a pack is read from a mounted directory, so an older version is not on disk to roll back to.