Public release artifacts for the HazeX Controller: manifest.json + hazex-firmware.bin per release, published by the private source repo's release CI. Devices poll releases/latest/download/manifest.json, verify the image SHA-256, and flash with automatic rollback.