Generate portable CLI release checksums

[shockbladenull]

Summary

• generate CLI release checksum sidecars from inside the output directory so they record only the asset basename
• validate both the recorded filename and digest before uploading release assets
• add a portable regression test that moves the asset and sidecar to a different directory before running -c

Closes #2971

Testing

• ./Scripts/test_release_checksum.sh — passes
• ./Scripts/lint.sh lint-linux — portable checks (including the new regression test), JavaScript formatting/linting, and TypeScript checks pass; the final SwiftLint invocation is blocked because the downloaded binary requires newer glibc/libstdc++ than the b2 host provides
• make check — blocked on Linux because the existing app-localization check requires macOS plutil
• make test — blocked before discovery because Swift is not installed on the b2 host

Real release-workflow proof

• Workflow run: Release CLI run 31934142399
• Trigger: workflow_dispatch on shockbladenull:agent/fix-cli-checksum-paths
• Reviewed head: 9f7d27b230e4b7d7f650d6e1ce8a7424cfeb184e
• Result: all six real build-cli matrix jobs passed: Linux glibc x86_64/aarch64, Linux musl x86_64/aarch64, and macOS x86_64/arm64.
• Every workflow Package step generated and validated its sidecar; both macOS package jobs also reported : OK.
• I downloaded all six workflow artifacts onto b2, a different host and path from the GitHub runner temporary directories. For every sidecar, I first asserted that its recorded filename exactly matched the archive basename, then ran sha256sum -c from the downloaded artifact directory. All six passed.
• Since this was a manual proof run rather than a release event, the publish-only and Homebrew-update jobs were skipped; no release or tap update was made.

CodexBarCLI-v0.50.0-pr2973-proof-linux-aarch64.tar.gz: OK
CodexBarCLI-v0.50.0-pr2973-proof-linux-musl-aarch64.tar.gz: OK
CodexBarCLI-v0.50.0-pr2973-proof-linux-musl-x86_64.tar.gz: OK
CodexBarCLI-v0.50.0-pr2973-proof-linux-x86_64.tar.gz: OK
CodexBarCLI-v0.50.0-pr2973-proof-macos-arm64.tar.gz: OK
CodexBarCLI-v0.50.0-pr2973-proof-macos-x86_64.tar.gz: OK
Verified 6 portable checksum sidecars

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: found issues before merge. Reviewed August 16, 2026, 4:46 AM ET / 08:46 UTC.

ClawSweeper review

What this changes

The PR adds a portable checksum helper, verifies basename-only CLI checksum sidecars before upload, and adds a relocation regression test.

Regression provenance

Possible regression — probable (reproduction; reviewed change). No predecessor PR is attributed.

Merge readiness

⚠️ Needs maintainer review before merge - 3 items remain

Keep this PR open: it correctly repairs future CLI checksum generation, but it declares the report closed while the currently released v0.50.0 sidecars remain unusable. Likely related people: steipete (high confidence).

Priority: P2
Reviewed head: 9f7d27b230e4b7d7f650d6e1ce8a7424cfeb184e
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Future-release behavior is strongly proven, but the PR needs a release-owner decision before it can close the reported current-release defect.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): The PR records successful after-fix runs across all six real release build variants and relocated-artifact verification; the outstanding concern is release remediation, not proof quality.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR records successful after-fix runs across all six real release build variants and relocated-artifact verification; the outstanding concern is release remediation, not proof quality.
Evidence reviewed	5 items	Current main retains the reported behavior: The release package job hashes the archive through its absolute temporary output path, which checksum tools preserve in the sidecar. The branch repairs future releases: The helper hashes from the archive directory, verifies the recorded basename and digest, and the new test verifies a moved archive/sidecar pair. Release-history ownership: Blame attributes the existing checksum commands to the v0.50.0 release-workflow revision authored by Peter Steinberger.
Findings	1 actionable finding	[P2] Preserve remediation for the current release
Security	None	None.

How this fits together

CodexBar’s release workflow packages standalone CLI archives for multiple platforms and uploads checksum sidecars alongside them. The helper creates and verifies those sidecars before release assets are published.

flowchart LR
  A[CLI archive] --> B[Release package job]
  B --> C[Checksum helper]
  C --> D[Basename-only sidecar]
  D --> E[Checksum verification]
  E --> F[Uploaded release assets]

Loading

Decision needed

Question	Recommendation
Should this PR include a one-time remediation for the six v0.50.0 release checksum sidecars, or leave the linked report open until a corrected release is published?	Backfill the current release sidecars: Recommended: replace the six v0.50.0 sidecars using the exact published archives, then merge this future-release prevention fix.

Why: The patch is proven for future release jobs, but replacing already-published release assets requires release-owner authority and must use checksums for the exact published archives.

Before merge

• Preserve remediation for the current release (P2) - This helper only affects future package jobs. The upload step is release-event-only, and the supplied manual proof explicitly made no release update, so the six v0.50.0 sidecars reported as broken remain broken even though this PR declares the report closed. Backfill sidecars for the exact published archives, or remove the closing declaration and keep the report open.
• Resolve merge risk (P1) - Merging as written closes the linked report even though the latest v0.50.0 release still serves six checksum sidecars with runner-local paths; users of that release remain unable to use normal checksum verification.

Findings

• [P2] Preserve remediation for the current release — .github/workflows/release-cli.yml:412

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Release coverage	6 CLI artifact variants	The supplied after-fix workflow proof covers each platform and architecture artifact published by this workflow.
Production and test delta	production +42/-5, tests +30	The code growth is limited to the checksum helper, workflow integration, portable check registration, and one focused regression script.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #2971
Summary: This PR is the focused candidate fix for the CLI checksum portability defect, but does not yet resolve its current-release impact.

Members:

• canonical: CLI release checksum files embed runner-local absolute paths #2971 - The PR directly targets the issue’s absolute-path checksum sidecars and explicitly declares it closed.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Backfill the current release sidecars (recommended)
   Recommended: publish corrected v0.50.0 checksum sidecars for the exact existing archives before allowing this PR to close the report.
2. Keep the current-release report open
   If backfilling is deferred, remove the closing declaration and retain the report until a corrected release is available.

Technical review

Best possible solution:

Backfill basename-only sidecars for the exact v0.50.0 CLI archives, then merge the future-release guard and close the report; otherwise remove the closing declaration and leave the report open until a corrected release ships.

Do we have a high-confidence way to reproduce the issue?

Yes; current main passes an absolute temporary archive path to the checksum tool, and the linked report provides a concrete download-and-verify path for v0.50.0.

Is this the best way to solve the issue?

No; the helper is the narrowest future-release repair, but this PR does not remediate the already-published v0.50.0 sidecars it says are fixed.

Full review comments:

• [P2] Preserve remediation for the current release — .github/workflows/release-cli.yml:412
  This helper only affects future package jobs. The upload step is release-event-only, and the supplied manual proof explicitly made no release update, so the six v0.50.0 sidecars reported as broken remain broken even though this PR declares the report closed. Backfill sidecars for the exact published archives, or remove the closing declaration and keep the report open.
  Confidence: 0.96

Overall correctness: patch is incorrect
Overall confidence: 0.96

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 966bf4a78ee7.

Labels

Label justifications:

• P2: The defect breaks checksum verification for published CLI assets but does not affect normal application operation.
• merge-risk: 🚨 compatibility: The PR intentionally changes the published checksum-sidecar filename field consumed by verification tooling.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The PR records successful after-fix runs across all six real release build variants and relocated-artifact verification; the outstanding concern is release remediation, not proof quality.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR records successful after-fix runs across all six real release build variants and relocated-artifact verification; the outstanding concern is release remediation, not proof quality.

Evidence

What I checked:

• Current main retains the reported behavior: The release package job hashes the archive through its absolute temporary output path, which checksum tools preserve in the sidecar. (.github/workflows/release-cli.yml:413, 966bf4a78ee7)
• The branch repairs future releases: The helper hashes from the archive directory, verifies the recorded basename and digest, and the new test verifies a moved archive/sidecar pair. (Scripts/generate_release_checksum.sh:17, 9f7d27b230e4)
• Release-history ownership: Blame attributes the existing checksum commands to the v0.50.0 release-workflow revision authored by Peter Steinberger. (.github/workflows/release-cli.yml:413, 0e453c4a5b2a)
• Real after-fix proof: The PR body records successful package and relocated-artifact verification for all six release CLI variants; the manual run intentionally skipped publishing or updating the release. (.github/workflows/release-cli.yml:409, 9f7d27b230e4)
• Current release remains unremediated: The checked-out v0.50.0 workflow contains the absolute-path generation commands, while the PR only runs its upload step for a release event and its proof was a non-publishing manual run. (.github/workflows/release-cli.yml:421, 0e453c4a5b2a)

Likely related people:

• steipete: The current checksum commands blame to the v0.50.0 release-workflow revision, and nearby release CLI history shows ongoing work in this workflow. (role: recent release-workflow contributor; confidence: high; commits: 0e453c4a5b2a, 1857e5bdb1f1; files: .github/workflows/release-cli.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Backfill v0.50.0 sidecars for the exact published archives, or remove the closing declaration and keep the issue open.
• Let the remaining required macOS test shards complete before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-08-16T06:52:19.992Z sha 9f7d27b :: needs real behavior proof before merge. :: none
• reviewed 2026-08-16T07:52:31.270Z sha 9f7d27b :: needs maintainer review before merge. :: none

[shockbladenull]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[Copilot]

Pull request overview

This PR fixes non-portable CLI release checksum sidecars by generating and validating .sha256 files from within the asset output directory, ensuring the recorded filename is the asset basename and that the digest validates before publishing. It also adds a portable regression test and wires it into the existing portable lint checks.

Changes:

• Add Scripts/generate_release_checksum.sh to generate checksum sidecars with basename-only filenames and verify them via -c.
• Update .github/workflows/release-cli.yml to use the shared checksum generator during packaging.
• Add Scripts/test_release_checksum.sh and run it as part of lint-linux portable checks via Scripts/lint.sh.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
Scripts/test_release_checksum.sh	Adds a regression test that moves the asset + sidecar and verifies -c still succeeds from a different directory.
Scripts/lint.sh	Runs the new checksum regression test as part of the portable checks suite.
Scripts/generate_release_checksum.sh	Implements portable checksum sidecar generation + filename/digest validation.
.github/workflows/release-cli.yml	Switches CLI packaging to call the new checksum generator script to avoid embedding runner-local paths.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.