fix(release): verify unified archives and reopen changelog

[github-actions]

Summary

• open the next Unreleased changelog section after the verified v0.12.0 release
• accept the unified workflow's canonical ./-prefixed tar member paths while retaining the exact four-member archive allowlist
• exercise that exact archive layout in the release-verifier regression

The public release and shared workflow verification were successful. During independent closeout verification, Discrawl's local make verify-release helper rejected the canonical archive layout before reaching its signature checks because it expected unprefixed tar member names. The verifier now strips only one leading ./ and the root ./ entry before performing the same exact member comparison; traversal, duplicates, unexpected files, and nested paths still fail.

Validation

• GOWORK=off go test ./scripts
• make verify-release VERSION=v0.12.0 ARTIFACT_DIR=/private/tmp/discrawl-v0.12.0-verify.GILQA3
  • both published Darwin archives passed checksum, exact contents, Developer ID requirement, hardened-runtime, architecture, embedded version, and online notarization verification
• AutoReview: clean, no accepted/actionable findings

The downloaded public assets also passed every line of the published checksums.txt; the live arm64 binary reported 0.12.0.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 2:31 PM ET / 18:31 UTC.

ClawSweeper review

What this changes

The PR updates the macOS release verifier to accept canonical ./ archive member prefixes, adjusts its regression fixture, and opens the next changelog section.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

This PR is still necessary: current main at the released v0.12.0 tag compares raw tar member names, so a canonical unified-workflow archive containing ./-prefixed entries is rejected before signature verification. The branch narrowly normalizes one leading prefix and the root entry while retaining the exact four-file allowlist; no correctness or security defect was found in the patch.

Priority: P3
Reviewed head: ed26c7343990bb00ed158a02c7664ac846086fed

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A small, source-supported repair with a matching regression fixture and no actionable review findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored release-maintenance PR is exempt from the external-contributor proof gate; its body nevertheless records a successful verification of the published v0.12.0 Darwin assets.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored release-maintenance PR is exempt from the external-contributor proof gate; its body nevertheless records a successful verification of the published v0.12.0 Darwin assets.
Evidence reviewed	5 items	Current-main defect: Current main sorts raw tar -tzf output and compares it with unprefixed names, so archive output such as ./ and ./README.md cannot equal the required allowlist. Makefile invokes this script for both shipped macOS architectures. Focused branch repair: The proposed change removes only one leading ./ and empty root entries before the existing exact comparison; the regression fixture now creates the canonical dot-prefixed layout. Release-workflow boundary: The repository delegates publishing to the shared unified workflow and supplies the expected archive file list, matching the local verifier’s four-file contract.
Findings	None	None.
Security	None	None.

How this fits together

The unified release workflow produces signed macOS archives and declares the release files that belong in them. make verify-release passes downloaded archives to the local verifier, which checks checksums, exact archive contents, code signatures, notarization, architecture, and embedded version before operators trust a release.

flowchart LR
  A[Unified release workflow] --> B[Signed macOS archive]
  B --> C[Downloaded release artifacts]
  C --> D[make verify-release]
  D --> E[Archive member validation]
  E --> F[Signature and notarization checks]
  F --> G[Verified public release]

Loading

Before merge

• Complete next step (P2) - No repair lane is needed: the branch already contains a narrow implementation and regression test, leaving ordinary maintainer merge handling after the active checks finish.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	3 files affected; 5 additions, 3 deletions	The repair is narrowly confined to release verification, its regression fixture, and the next changelog section.

Technical review

Best possible solution:

Merge the focused normalization and regression coverage after the remaining required checks complete, preserving the strict four-member archive contract for future release verification.

Do we have a high-confidence way to reproduce the issue?

Yes—source inspection gives a high-confidence path: create an otherwise valid archive with root ./ and ./-prefixed allowed members, then run the current verifier; its raw comparison rejects those names before signature checks.

Is this the best way to solve the issue?

Yes—the proposed one-prefix normalization is the narrowest maintainable repair because it accepts the canonical archive spelling without widening the four-file allowlist or weakening checksum, signature, notarization, architecture, or version checks.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 762f10c51f83.

Labels

Label justifications:

• P3: This is a low-blast-radius release-verifier correction that affects operator verification rather than runtime user behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored release-maintenance PR is exempt from the external-contributor proof gate; its body nevertheless records a successful verification of the published v0.12.0 Darwin assets.

Evidence

What I checked:

• Current-main defect: Current main sorts raw tar -tzf output and compares it with unprefixed names, so archive output such as ./ and ./README.md cannot equal the required allowlist. Makefile invokes this script for both shipped macOS architectures. (scripts/verify-macos-release.sh:45, 762f10c51f83)
• Focused branch repair: The proposed change removes only one leading ./ and empty root entries before the existing exact comparison; the regression fixture now creates the canonical dot-prefixed layout. (scripts/verify-macos-release.sh:45, ed26c7343990)
• Release-workflow boundary: The repository delegates publishing to the shared unified workflow and supplies the expected archive file list, matching the local verifier’s four-file contract. (.github/workflows/release-unified.yml:21, 762f10c51f83)
• Feature provenance: Blame attributes the current archive-validation block to the same release-workflow transition, and the relevant verifier history includes the original archive-verification work, later notarization work, and the unified-workflow migration. (scripts/verify-macos-release.sh:45, 762f10c51f83)
• Release provenance: The currently affected main revision is exactly the v0.12.0 release tag, so the verifier mismatch applies to the freshly released verification path rather than an unreleased branch. (CHANGELOG.md:3, 762f10c51f83)

Likely related people:

• steipete: Peter Steinberger authored the original macOS archive verifier, its notarization follow-up, the unified-release migration that introduced the current comparison, and the repair commit on this branch. (role: release-verifier feature owner and recent area contributor; confidence: high; commits: 979f89096ca0, 9ec48920f56e, 762f10c51f83; files: scripts/verify-macos-release.sh, scripts/release_signing_test.go, .github/workflows/release-unified.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Allow the in-progress release-check and test jobs to finish on the reviewed head before merging.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-02T18:24:27.758Z sha 1559411 :: needs maintainer review before merge. :: none