Fix #662: Immutable .sha256 sidecars for pinned release verification - #663

Merged

logbie merged 5 commits into

mainfrom

claude/generate-missing-checksums-ugk6rp

Jul 31, 2026

Commits on Jul 31, 2026

test(release): red - pinned artifacts have no immutable checksum
claude
committed
987f3a7
fix(release): publish an immutable .sha256 beside every artifact (#662)
claude
committed
14b4e9d
docs: record the scope of the one-time checksum backfill
claude
committed
ba6cdbc
test(release): red - overwrite, retry and race gaps found in review
claude
committed
e2091e3
fix(release): never replace a published key; retry CDN reads; serialize writers
claude
committed
6877ac4