From 95529924b777089105fa3b2d5ee8276c8c68b55a Mon Sep 17 00:00:00 2001
From: saladday <1203511142@qq.com>
Date: Thu, 24 Sep 2026 04:02:39 +0800
Subject: [PATCH 1/2] Use legal release tags separate from source identities

---
 .github/workflows/release.yml | 10 ++++++++--
 CONTRIBUTING.md               |  3 +++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 31ac0acb5..1f0b91c5c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,6 +31,7 @@ jobs:
     timeout-minutes: 120
     outputs:
       revision: ${{ steps.source.outputs.revision }}
+      release_tag: ${{ steps.source.outputs.release_tag }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -48,6 +49,9 @@ jobs:
           revision="$(git rev-parse HEAD)"
           if [[ -n "$REQUESTED_REF" && "$REQUESTED_REF" != "$revision" ]]; then exit 1; fi
           echo "revision=$revision" >> "$GITHUB_OUTPUT"
+          release_tag="build-$revision"
+          if [[ "$GITHUB_EVENT_NAME" == push ]]; then release_tag="$GITHUB_REF_NAME"; fi
+          echo "release_tag=$release_tag" >> "$GITHUB_OUTPUT"
       - name: Reserve disk space for distribution archives
         run: |
           # The hosted runner needs room for Docker images, tar exports and the
@@ -82,6 +86,7 @@ jobs:
       - name: Build matched artifacts
         env:
           RELEASE_REVISION: ${{ steps.source.outputs.revision }}
+          RELEASE_TAG: ${{ steps.source.outputs.release_tag }}
           RELEASE_REPOSITORY: ${{ github.repository }}
           CORE_DISTRIBUTION_OFFLINE: ${{ inputs.offline && '1' || '0' }}
         run: |
@@ -89,7 +94,7 @@ jobs:
           AGENTS_RUNTIME_CODEX_PACKAGE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
           MCODE_HARNESS_BUILD_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["mcode"])' "$inputs")"
           export AGENTS_RUNTIME_CODEX_PACKAGE MCODE_HARNESS_BUILD_DIR
-          export CORE_DISTRIBUTION_RELEASE_BASE_URL="https://github.com/$RELEASE_REPOSITORY/releases/download/$RELEASE_REVISION"
+          export CORE_DISTRIBUTION_RELEASE_BASE_URL="https://github.com/$RELEASE_REPOSITORY/releases/download/$RELEASE_TAG"
           bash scripts/build-core-distribution.sh
           mkdir -p "$HOME/.parsar/build/release-upload"
           for asset in "$HOME/.parsar/build/core-distribution/"*; do
@@ -118,7 +123,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
           RELEASE_REVISION: ${{ needs.build.outputs.revision }}
+          RELEASE_TAG: ${{ needs.build.outputs.release_tag }}
         run: |
           printf 'Matched Linux amd64 artifacts from commit %s. Build output is not live execution qualification.\n' "$RELEASE_REVISION" > release-notes.md
-          gh release create "$RELEASE_REVISION" --draft --target "$RELEASE_REVISION" \
+          gh release create "$RELEASE_TAG" --draft --target "$RELEASE_REVISION" \
             --title "Parsar Core $RELEASE_REVISION" --notes-file release-notes.md release-upload/*
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9d5af15d5..60234fc7a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1583,6 +1583,9 @@ execution-only payloads. Python zipapps bundle the shared resolver with each
 remote bootstrap; the console publishes only fixed non-secret files and declared
 artifact names. Release automation builds artifacts and may create an unpublished
 draft, but cannot claim real execution qualification or public availability.
+Manual builds use the legal `build-<full source SHA>` release tag; tag-triggered
+builds use the actual `v*` tag. The manifest download base and draft tag must match,
+while artifact filenames and source provenance retain the full source SHA.
 Qualify the exact downloaded production artifacts before publishing the draft;
 keep the tested asset bytes and source identity unchanged. Never use an acceptance
 image containing a private test CA or model credential as a release input.

From c1b91b2cb1c2cf0e42701e8b200b02a2076f9ebf Mon Sep 17 00:00:00 2001
From: saladday <1203511142@qq.com>
Date: Thu, 24 Sep 2026 04:02:59 +0800
Subject: [PATCH 2/2] Document verified release address metadata repacking

---
 CONTRIBUTING.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 60234fc7a..e7b0513f1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1587,7 +1587,10 @@ Manual builds use the legal `build-<full source SHA>` release tag; tag-triggered
 builds use the actual `v*` tag. The manifest download base and draft tag must match,
 while artifact filenames and source provenance retain the full source SHA.
 Qualify the exact downloaded production artifacts before publishing the draft;
-keep the tested asset bytes and source identity unchanged. Never use an acceptance
+keep qualified executable, image and source payload bytes and source identity
+unchanged. A recorded release-address/checksum-only repack requires proof that
+every other archive member is unchanged and verification of final published asset
+digests and URLs. Never use an acceptance
 image containing a private test CA or model credential as a release input.
 Repository visibility is independent of publication. Do not add repository
 credentials to installed node/Runtime configuration to bypass download access.