feat(source): support verified generated release assets

[vincentkoc]

Summary

Add opt-in transport for one caller-generated release asset while preserving the source-only default.

• generated-asset names one bounded regular file written to the workflow-owned RELEASE_ASSET_PATH.
• Optional generated-input-artifact-id downloads one exact artifact from the current workflow run into a separate RELEASE_ASSET_INPUT_DIR. No cross-run/repository selector or new credential is accepted.
• Validate output before upload and the exact raw marker/file set after download. Require the requested asset in both independent verifier inventories.
• Extend the existing Actions integration test to exercise input download, production generation/assembly, raw artifact download and both verifier blocks.

This is opaque byte transport. A package caller must qualify the exact input bytes, validate its own source/tree/hash/lock contract against the frozen release target, and depend on its producer and platform consumers before publication. A fresh rebuild at the same commit is not equivalent proof. No ClawSweeper caller is enabled here; its package name, version and publication decisions remain separate. The existing source-archive Homebrew handoff is unchanged.

Base: fc49859568b3781af7663bee48c003fd987dc08b. Signed head: 5c3ee0fd825b520603872c1d2d0693c203a15ab5.

Validation

• Focused production-block tests cover legacy/default parity, input validation, file/directory/symlink/size/collision failures, marker integrity, and missing/modified/unrequested verifier assets.
• Seventeen workflow/example YAML documents pass strict Psych parsing; workflow trust-contract validation and JavaScript syntax/diff checks pass. Additional native regression scripts passed through signing and draft-isolation coverage.
• The full local suite was incomplete: its unchanged Sparkle draft fixture combines mapfile (unavailable in system Bash 3.2) with a large heredoc that stalls in installed Bash 5.3. The owned stalled test was stopped; no fixture assertions or host tooling were changed.
• Local actionlint structure/expression checks passed with external linters explicitly disabled. The normal local actionlint invocation stalled in external ShellCheck stdin handling and was stopped; full hosted actionlint remains required.
• Two independent source reviews and one fresh native P0–P3 review passed with no findings on the exact candidate tree 67185d3ec421fd5e775de65eb9bff9f8ed8491e8.
• Hosted CI 39267481614 passed all six jobs on this head: the unmodified full validator (including actionlint/ShellCheck and all regression scripts), action integration, Swift lifecycle, both macOS architectures and Homebrew preflight.
• The actual same-run roundtrip downloaded input artifact 12192733980 (digest 0926172745e5715deb2f70b7c0bf71f8801b72132ee9f33ea421d16a2ff187a9), ran the production builder, uploaded/downloaded raw artifact 12192748802 (digest 74ecbb09c99c776aa7d92656317501865ab604ecb1a99711ed210521fe023647), then passed production assembly and both verifier blocks. Both blocks ran on Ubuntu; this does not claim an independent ARM job or a complete consumer release rehearsal.

Production workflow delta: +91/-2 lines (net +89), implementing the optional input/output boundary. Test/CI proof delta: net +137; docs/example/changelog: net +13.

No tag, release, v1 movement, installation, new permissions or publication workflow dispatch is part of this change.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[vincentkoc]

@clawsweeper review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39268726430
• Updated: 2026-10-19T14:25:11.216Z

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR lets source releases carry one caller-generated file, optionally built from an exact artifact in the same workflow run.

Example: A caller requests fixture-source.txt and supplies same-run input artifact 12192733980.

• Before: The source workflow publishes release notes and optional source archives without transporting caller-generated output.
• After: The build copies the input bytes into fixture-source.txt, and assembly includes that file in the inventory checked by both verifiers.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and source-reviewed without actionable findings; proof covers real artifact transport and production blocks rather than the complete reusable-workflow entry point.
Proof confidence	🦐 gold shrimp (3/6)	The ordinary contributor-proof gate is exempt for this maintainer-authored PR; supplied evidence nevertheless maps the changed production build, assembly and both verifier blocks to a successful Ubuntu Actions round trip using real immutable artifacts, without claiming an independent ARM job or consumer release.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Source-release callers cannot include an already qualified generated package or envelope through the shared verified payload.
Reason: A maintainer and current workflow code owner proposes a bounded additive capability, preserves source-only defaults, and explicitly leaves package semantics and downstream activation with callers.

Merge readiness

✅ Ready for maintainer review

Keep this maintainer-authored draft open: it adds a distinct capability absent from main, preserves existing defaults, and introduces no concrete correctness defect found in review.

Priority: P2
Reviewed head: 5c3ee0fd825b520603872c1d2d0693c203a15ab5

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The supplied evidence does not exercise the complete reusable workflow on protected main or generated-asset publication; it exercises real Actions transport and extracted production blocks.

Agent review details

How this fits together

The reusable source-release workflow accepts caller inputs and a frozen protected commit, builds without write credentials, assembles immutable artifacts, verifies their inventory on two runners, and publishes only attested bytes.

flowchart LR
  A[Protected release target] --> C[Read only build]
  B[Same run input artifact] --> C
  C --> D[Immutable raw artifact]
  D --> E[Assembly and inventory]
  E --> F[Two independent verifiers]
  F --> G[Attested release publication]

Loading

Technical review

Best possible solution:

Retain the opt-in transport in the existing source-release owners, with package qualification enforced by each caller.

Do we have a high-confidence way to reproduce the issue?

This is a feature addition; source inspection establishes the missing baseline capability, and the supplied hosted run exercises its generated-byte transport.

Is this the best way to solve the issue?

The change fits the existing source archetype: it adds opaque transport while retaining artifact-ID binding, verifier ownership and publication checks instead of creating a second release path.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against fc49859568b3.

Provenance checked

• Source build, assembly and independent inventory verification keeps the original intent (feat: add npm package and source release archetypes #67: Keep caller execution read-only, freeze immutable producer artifacts, and publish independently verified bytes from a protected source target.)
• Real Actions artifact integration keeps the original intent (chore(deps): refresh release workflow dependencies #26: Exercise pinned artifact actions and the GitHub REST client using a byte-for-byte round trip.)
• Protected-main no-publish rehearsal keeps the original intent (fix: prove protected main in npm and source dry runs #69: Dry-run dispatches must exercise current protected main without reading or moving historical release tags.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned introduction and main behavior: The introduced diff adds optional generated-asset transport; the base source workflow uploads only a test marker from its caller-test job and does not assemble caller-generated files. (.github/workflows/release-source.yml:827, 5c3ee0fd825b)
• Bounded output and publication boundary: Output must be one nonempty regular file under 2 GiB; assembly validates the exact marker/file set, both verifiers require the requested inventory, and the existing publisher binds both attestations and rechecks the frozen tag before publication. (.github/workflows/release-source.yml:915, 5c3ee0fd825b)
• Executed dependency contract: The patch directly executes this pinned action. Its source lists current-run artifacts when no github-token is supplied, filters exact IDs, rejects an absent ID, and fails digest mismatches; a single matched artifact extracts directly into the requested directory. The pinned tree contains no AGENTS.md. (src/download-artifact.ts, 3e5f45b2cfb9)
• Hosted transport evidence: https://github.com/openclaw/release-workflows/actions/runs/39267481614 succeeded on the reviewed head. Job 118110737218 completed actual artifact downloads/uploads and the production build, assembly, and both verifier blocks. Artifact metadata independently confirms input 12192733980 and output 12192748802 with the reported digests. (.github/workflows/ci.yml:95, 5c3ee0fd825b)
• Original design and ownership: feat: add npm package and source release archetypes #67 introduced the protected-source, immutable-artifact and independently verified publication design. This PR retains that design; current CODEOWNERS names vincentkoc and steipete for workflows. (.github/CODEOWNERS:3, fc49859568b3)
• Released baseline: v1.11.8 targets the pinned base commit and does not contain this feature; searches for generated assets, envelopes and the new artifact-ID input found no competing item owning this work. (fc49859568b3)

Likely related people:

• Peter Steinberger: Raw commit fd0fb7d adds .github/workflows/release-source.yml:779 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: fd0fb7d25e69; files: .github/workflows/release-source.yml)

Review metrics

Metric	Value	Why it matters
Production versus validation growth	Production workflow +91/-2; test and CI changes +143/-6	The production additions cover input selection, isolated output transport and inventory enforcement; validation exercises those boundaries without adding a production module or alternate publisher.

Labels

Label changes:

• add P2: This is an opt-in release capability with unchanged existing defaults and no demonstrated urgent user regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: This is an opt-in release capability with unchanged existing defaults and no demonstrated urgent user regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 10:23 AM ET / 14:23 UTC.