[immakermatty]

Why

Decision F20 (#62, merged): the first installation is one command served from https://lazurio.ai/install. The website redirects to releases/latest/download/install.sh, so every release must carry the script of its own tag, attested like the executables. The Principal also decided that the documented one-liner is the strict form curl --proto '=https' --tlsv1.2 -fsSL https://lazurio.ai/install | sh, which holds the first hop to HTTPS as well.

What changes

• .github/workflows/release.yml: copies install.sh of the tag into the release directory, adds it to the subjects of the one attestation, attaches it to the draft release with the other assets.
• README, docs/update.md, docs/decisions.md (F20) and the header of install.sh: the strict one-liner; the sentences that said the asset was a separate pending change now say the asset is attached from this release on and that releases up to v0.1.7 carry none.

What does not change

Secrets, environments, permissions, the name of the workflow file, the manifest (targets stay executables only), the ordering gate and the single publication. Installed clients require their own digests to be among the attested subjects, so an added subject changes nothing for them; the Machines preflight looks for the pinned executable among the subjects.

Verification

bun run check on this head after merging main (760 pass, 4 skip, 0 fail; public guard and standalone smoke pass). The workflow cannot run before a tag: the first real proof is the next release candidate.

Refs #50

🤖 Generated with Claude Code

Note

Publish and attest install.sh as a release asset

• Adds the repository's install.sh to the release directory in release.yml and passes it to the GitHub release command alongside the existing assets. The Sigstore attestation subject paths now cover the manifest, executables, and install.sh.
• Updates documented installer commands in README.md, docs/update.md, and install.sh so curl requires HTTPS and TLS 1.2 or newer before piping to sh.
• Behavioral Change: releases through v0.1.7 do not contain the install.sh asset; tagged releases after this change do.

^{Macroscope summarized b55ffcf.}

[agentrozjedemeai]

@immakermatty — exact-head review of b55ffcf.

Changes requested (README.md:13): The documented fallback first-install command still uses curl -fsSL https://raw.githubusercontent.com/Lazurio/LazurioPlatform/main/install.sh | sh. With -L and no --proto '=https', curl may follow an HTTP redirect and pipe those bytes into sh. The new strict command in README:6 and F20 is not the only supported first-install entry until the website route and release asset are live. Please apply the Principal's strict --proto '=https' --tlsv1.2 form to that fallback command too.

The release-workflow diff otherwise only copies this tag's script, includes it in the single attestation and draft assets; no changes to workflow identity, permissions, environment, manifest targets, ordering or single publish. Client verifier requires manifest+selected executable digests among subjects; Machines preflight matches the pinned executable name+digest with any, so the extra subject is accepted (also reproduced with a signed fixture). v0.1.7 has no install.sh asset, and the route docs defer availability to a future qualifying release.

Checks on this exact SHA: ubuntu-24.04 and macos-14 SUCCESS; Macroscope SKIPPED. Local focused verifier/install tests passed after increasing the installer-test timeout from 5s to 30s for the host (initial 5s timeout); no tag-release workflow execution is claimed. No merge performed.

[agentrozjedemeai]

@immakermatty — exact-head re-review of 28e30ee. The sole b55ffcf..28e30ee change makes the README interim raw-GitHub install pipeline use the strict curl --proto "=https" --tlsv1.2 form, matching the primary one-command install and the install.sh header. The remaining curl -fsSL mention in docs/update.md:364 describes redirect handling; it is not an executable recommendation. The release workflow still copies the tagged install.sh into the release assets and includes it in the single attestation. Required checks on this exact SHA: ubuntu-24.04 SUCCESS and macos-14 SUCCESS; optional Macroscope SKIPPED. In an isolated detached checkout, sh -n and 22 focused installer/attestation tests passed; git diff --check was clean. No tag-triggered release workflow was run, no website-route deployment is claimed, and no merge was performed. APPROVED for this SHA.