BillyOutlastandClaude Opus 5.5 5131080a66 Release: per-OS checksum files; no persisted checkout credentials ...

Raised in review:
- A run-wide SHA256SUMS.txt went stale as soon as one OS was published
  into an existing release. Each build job now writes SHA256SUMS-<os>.txt
  for exactly the files it uploads; the publish job re-verifies them.
- Workflows that run repository code no longer leave the checkout token
  on disk, and seam-tests/e2e get an explicit read-only token.
- docs/release-signing.md claimed signing needed no workflow change. For
  macOS that is wrong: the ad-hoc step would replace a Developer ID
  signature. Corrected.
- AUDIT_REPORT.md: say up front that it is append-only and §9 is current.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-11 16:51:37 -04:00

..

upstream-drafts

Docs: rebase runbook (#13) and a ready-to-review upstream draft (#7)

2026-10-11 15:53:59 -04:00

release-signing.md

Release: per-OS checksum files; no persisted checkout credentials

2026-10-11 16:51:37 -04:00

upstream-ai-provider-rfc.md

Adversarial audit + Tier-2 remediation + 07/08/11 forward-port rebase

2026-10-10 22:03:11 -04:00