download-artifact@v8 extracts the only pattern-matched artifact directly
into the target path, without the artifact-name directory the resolve
step assumed, so every workflow_run verification died at
"No distributed release identity found" before checking a single
surface. The directory-name attempt check now applies only when the
artifact directory exists; a flat identity is still pinned by the
run-id and attempt-eligibility asserts. The workflow_run path of
5c6588b had never executed: v0.38.0's run failed on later checks and
the surfaces were confirmed by a manual dispatch.
The new test drives the real workflow script against the flat layout
and reproduced the production failure before the fix.
pre-commit: 1) maintain.sh - exit 2 (uv-secure on the documented
lightning/accelerate blocks, unchanged lock; core checks separately:
C2PA sync current, Ruff clean with no rewrites, Pyright src/ 0 errors,
2360 passed 3 skipped); 2) /simplify - single-pass four angles, clean;
3) docs sync - grepped distributed-release over docs/: the one mention
stays accurate; 4) CLAUDE.md - improver grade A earlier this session,
revise: no additions
Repair image and metadata publication contracts, detection routing, research
artifact validation, release verification, and the published agent skill.
Refresh the dependency lock and reconcile documentation with verified behavior.
Add regression coverage and record the completed audit and corrected VideoSeal
measurements. Preserve the existing Accelerate and Lightning versions.
Validation: Ruff and Pyright pass; 2358 tests pass with 3 skipped. The maintenance
gate exits 2 on the documented Accelerate and Lightning security findings.
The check read `latest_version` on the node object, which reports only the
ACTIVE version. The registry reviews an upload before activating it, so for the
length of that review a correctly published version looks exactly like a release
that was never synced -- and 0.37.0 hit precisely that: the node repo bumped to
0.1.37 requiring >=0.37.0, the registry accepted it as
NodeVersionStatusPending, and the check called it missing.
Read the versions list instead and branch on the status: active passes, pending
passes while saying so in the summary rather than claiming the node is live, and
anything else fails. A missing version still fails hard, which is the case this
check exists for. Sort the matches by createdAt rather than trusting the
endpoint's current newest-first ordering.
Verified against the live registry in all three states: 0.37.0 pending, 0.36.0
active, 0.99.0 absent and erroring.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The HF Space step curled the root for HTTP 200 and then emitted a warning
and SUCCEEDED when it never got one. The documented contract was three other
checks entirely: the requirements pin, the runtime stage, and live identify
and visible calls. None was implemented, which is why the demo sat two
releases behind while every verification run stayed green. Implemented all
three; the pin check fails today, correctly, on 0.34.1 against 0.36.0.
The ComfyUI step read the latest run of the node repo's sync workflow. That
workflow also runs on a daily schedule, so a green nightly satisfied it
whether or not this release was ever synced. The registry does publish a JSON
API, contrary to the comment that justified the proxy, so read the node
directly and assert the active version declares this library release.
Both of those steps warned and continued; only Homebrew failed hard. Now all
of them exit non-zero, and the summary is assembled from lines each step
appends as it passes rather than an unconditional block that claimed five
verified surfaces regardless.
No step needs the GitHub token any more, so pin least-privilege permissions
here and in test.yml.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Victor Kuznetsov