Distribution: ship signed ROM policies via TrainerOS SOFTWARE updates, including policy-only releases #143

Parents: #140, #136, #153. Depends on software updater #154 and separate release manifest #119. Replaces the older assumption that changing guest ROM policies requires an OS-image OTA.

Updated owner decision

Encrypted/signed guest-ROM prohibition and rights-policy files ship only through the ordinary TrainerOS SOFTWARE update channel, not through an independent policy updater and not tied to updating the Linux image/host OS.

Both distribution routes use the same software policy payload:

• Prepared Armada/TrainerOS image: TrainerOS S→S+1 software update while image base I stays unchanged.
• SteamOS/Bazzite-installed TrainerOS: TrainerOS S→S+1 software update while native host version H stays unchanged and continues to be updated by its own distro.

No separate online denylist polling, hidden ban-list fetch, remote policy endpoint, user-facing list installer or authoring tool in public GitHub.

Explicit policy-only software release

A policy-only TrainerOS software update is valid and must be supported. It may change only:

• one or more encrypted per-platform policy artifacts;
• their cryptographic signatures / policy sequence;
• the signed TrainerOS software release manifest / release notes/version metadata.

Everything else remains unchanged: TrainerOS application binary/QML, kernel, Linux image, emulator/core/patch builds, native packages, installed OddCrate games and user content.

This is an ordinary signed TrainerOS software release from #154. It may be a small urgent update after a rights-holder request, prepared privately in ROM Policy Studio #142. No host-image rebuild, reinstall or device reboot unless the actual verified software loader needs a restart.

Manifest

Attach to the canonical software S release manifest (#119):

• policy schema, identity and monotonic sequence;
• canonical platforms/families and narrower emulator/runtime overlays;
• required verifier version and compatible software release range;
• hashes/signatures and rollback/freshness restrictions;
• updated-content delta entries allowing policy-only payloads.

Keep image I release identity/OTA independent. A newly built image may embed current S/policy snapshot for first boot, but later installed policy updates follow S releases.

Activation and rollback

• Stage/validate signatures and hashes before marking the software policy active.
• New policy takes effect for new guest transfers immediately after successful activation/reload when safe; avoid disrupting unrelated active game/save work.
• The send-side policy must be checked before any game bytes leave, against the effective installed policy, not an untrusted peer claim.
• Missing, stale, tampered, incompatible or rolled-back policy disables guest-content transfer, while ordinary local ROM play remains available.
• Retain a monotonic accepted policy sequence outside replaceable software slots where feasible; rolling back S or I must not silently resurrect removed prohibitions.
• Linux image rollback remains possible, even if temporary guest sharing becomes disabled pending an up-to-date signed policy.
• A device offline or not yet updated cannot be claimed to have instant new takedowns.

Private authoring separation

The ROM Policy Studio editor, its source, unencrypted policy source, private signing keys and rights-holder communications stay entirely outside public GitHub and shipped release assets. Public release contains only signed/encrypted policy files, public verifier and sanitized manifest.

Acceptance

• Same signed policy identity installs via TrainerOS Software on prepared image, SteamOS and Bazzite, independent of any host update.
• One policy-only software release changes no app/emulator/core/base OS files, verified by manifest/hashes.
• The ordinary software updater TrainerOS Software: signed cross-distro updater independent of system image #154 handles it; no independent policy updater exists.
• A rights-holder block shipped in S+1 prevents new guest transfer on updated devices, without deleting local games.
• Rollback/missing/corrupt/outdated policy fails closed for guest transmission but does not stop offline play.
• Software version S and base-image version I may legitimately diverge; policy still remains valid within its declared verifier compatibility.

Related: #71 base-image update, #119 manifests, #136 guest ROM sessions, #140 policy semantics, #142 private editor, #153 update split, #154 software updater, #160 QA.