An update needs two independent yeses.
Key confirms the customer and site are entitled. Delivery confirms the release, package, checksum and channel are valid. WordPress only receives the offer when both authorities agree.
Leadstrium Key
Canonical authority · single writer
Offer an update only when rights and release safety agree.
Key and Delivery each keep their own authority; WordPress gets the update only when both checks pass.
Production bridge
Provider endpoint not configured.
Key owns entitlement decisions; Delivery still owns release packages and signing.
What must agree
Customer rights
The license and plan must allow this software update.
Release safety
Delivery must attest that the release and package are ready.
Package integrity
The package must use HTTPS and carry a valid SHA-256 identity.
Version direction
The offered version must actually be newer than what WordPress has installed.