Optional Packslip CLI manifests and release-matched advisor skill

[jdx]

Mise already installs llmfit. Packslip would let each release tell mise exactly which download to use for each platform and how to check it matches what you published. You would keep those download instructions with your releases, including when filenames or layouts change.

It could also point mise to the agent skill from the same release tag, so users can link the matching instructions.

This would add a small, signed file next to the existing downloads through an optional release-workflow step. Your existing downloads and checksums would stay in place. This proposal covers the CLI, with desktop releases kept separate.

Scope decision pending: You noted that Windows signing is being reworked and queued a yes/no decision. This remains a proposal; implementation waits for that decision.

Would you welcome a PR adding this, with disclosed Codex assistance? I’m happy to adapt it to your preferences or leave implementation to you. I’ll wait for your scope and AI-permission decision before code.

Example change: ghorg’s merged PR.

More information: publishing guide · an existing signed release.

Prepared with Codex (GPT-6); AI assistance covered this proposal’s research and wording.

[AlexsJones]

Thanks for the detailed write-up, and for linking shipped examples so it's easy to see what this looks like in practice.

This touches the release workflow and adds a durable trust identity for consumers, and that workflow is mid-change right now (#1128 is reworking how the Windows assets get signed). So it's a call I want to make deliberately rather than quickly. I've queued it, and I'll come back here with a yes or no on the scope before anyone writes code.

[AlexsJones]

Thanks for waiting on this, @jdx. The answer is yes: an optional Packslip step in the CLI release workflow is welcome, and a PR with disclosed Codex assistance is fine.

One timing ask: please hold off until #1128 lands, since it's still reworking how the Windows assets get signed. When you pick it up, keep it to a single job in release.yml that runs after the checksums step, with no changes to the existing asset names, and it should be an easy review.