RIVERWORKS RELEASE BULLETIN RW-26-09
Issued: 2026-08-28                         Classification: Customer advisory
Applies to: RW-EDGE controllers, bootloader 2.3 and later

SUBJECT: Package authorization requirements for field and stable channels

RiverWorks release packages use an RWPK container. Before installation, the
controller must verify the package digest, target model, rollback index, and
detached digital signature. Authorized production packages are signed by the
certificate subject "RiverWorks Release" and chain to the RiverWorks Device
Release Root provisioned with the controller.

A published SHA-256 value supports transfer-integrity troubleshooting: it can
show that a retrieved package has the expected bytes. A digest is not evidence
of publisher identity and must not replace signature verification. Mirrors and
field caches may reproduce a digest without being authorized to issue code.

Temporary field-hotfix policy RW-FH-1 expired on 2026-07-31. Sites that still
permit unsigned packages under that policy must disable the exception, review
install history, and restore from a signed release where provenance cannot be
established.

Expected verification record for an authorized package:
  signature_block=present
  signer_subject=RiverWorks Release
  chain_status=trusted
  package_policy=production

Operators should preserve package, verification, and install records before
remediation.