feat(release): add deterministic artifact integrity manifest

[seonghobae]

Buyer / acquisition-readiness objective

This bounded release-readiness slice gives operators a deterministic, source-revision-bound SHA-256 manifest for built release artifacts before release/tagging. It is an integrity receipt only: it does not claim signed provenance, SLSA level, SOC 2 status, or certification, and it complements rather than replaces cryptographic provenance/attestation.

Exact current identity

• protected live base: develop@2c328875e00e86537df3e965170be80532571cad;
• exact contributor head: b427cd455f41e7c09ae20fbbf400d42c4f61d4bf;
• branch: feat/release-artifact-manifest;
• Draft and mechanically mergeable at the latest fresh refetch; and
• no qualifying independent current-head approval exists.

Any head or protected-base movement invalidates head/base-sensitive evidence until freshly regenerated. This body is traceability, not merge authority.

Implemented release-integrity slice

The branch implements and tests deterministic artifact ordering, exact 40-hex source-revision binding, logical artifact identities with SHA-256 and byte length, a canonical manifest self-digest, key-order-invariant verification, tamper/source-revision failure, regular-file/symlink safeguards, duplicate/traversal-like name rejection, streaming hashing, bounded non-secret CLI envelopes, malformed-manifest fail-closed behavior, and pathname-identity checks around opened manifest/artifact handles.

The operator contract remains intentionally narrow: unsigned local integrity metadata only, without signing keys, secrets, gate bypasses, or a competing provenance format.

Test-first repair evidence

Earlier RED/GREEN stages established canonical nested artifact digest serialization and safe handle-bound manifest reads. A fresh current-source regression then exposed an analogous artifact-path replacement gap:

• RED contributor head d3018a44d55a8ce6fadda67a6b53315ab289904a: Server Tests run 33072327214, unit-and-api job 98517475339, failed because the realistic release-artifact-path-race hook was never invoked (0 !== 1). The production verifier hashed an already-open inode but neither exposed the artifact-open test seam nor verified that the pathname still resolved to that inode after open/read.
• root-cause production repair ea9472e90bdb9de1365f69e385aeb98bdedb0178 wires afterArtifactOpen through verification, compares opened-handle identity with pathname identity immediately after open and after hashing, and maps artifact_changed_during_read to the actionable rebuild_release_artifacts operator response.
• current head b427cd455f41e7c09ae20fbbf400d42c4f61d4bf changes only the accompanying doctoring/traceability after that production repair; the release-manifest production bytes are unchanged from ea9472e9....
• current-head behavioral GREEN: Server Tests run 33074287282 is terminal success; unit-and-api job 98524314560 and cloud-e2e job 98524314566 are successful. The unit log explicitly records release artifact manifest tests passed and release artifact pathname replacement regression passed. Fuzz 33074287171, Dependency Review 33074287204, OSV 33074287876, Security Scan 33074287182, and SAST Semgrep 33074287175 are also terminal success.

This is behavioral GREEN, not merge-authorizing exact-head provenance: current Server Tests checked out synthetic merge a3d19c4169cb1f2710be288827cb05b0a4031407 (b427cd45... merged into protected base) rather than the immutable contributor SHA. Protected develop still lacks the repository exact-head Server Tests/coverage repair owned by #523, and organization-reusable SAST/Security exact-head integrity remains owned by ContextualWisdomLab/.github#1222 / its canonical owner PR path. Predecessor, synthetic-only, or status-only evidence is non-authorizing.

Standards boundary

The doctoring record cites the approved SLSA v1.2 provenance model and GitHub artifact-attestation guidance. This local manifest is explicitly unsigned integrity metadata; cryptographic provenance remains an independent release gate.

Merge gate

Remain Draft until one unchanged exact head against the then-current protected base simultaneously has repository-owned exact-head deterministic/browser/100%-owned statement-branch-function-line coverage/docstring evidence, corrected central exact-head SAST/Security evidence, every applicable dependency/supply-chain/security/package/provenance gate terminal-passing, zero valid unresolved findings, and the live ruleset's qualifying independent current-head approval.

Pending, queued, skipped-required, cancelled, absent, neutral-required, failed, stale, predecessor, synthetic-only, status-only, author-only, or model-only evidence is non-authorizing.

Refs #523 ContextualWisdomLab/.github#1222

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}