fix(release): robust publisher fields, WAL-safe copy, installer tag order, pinned actions

From the full-repo Codex audit:
- The publisher read discovery fields one per line, so a report title
  with newlines shifted every later field and published a manifest
  without source.publish_date, which every client rejects (blocking all
  syncs). Read them NUL-separated, and refuse to write a manifest missing
  a field clients require.
- The snapshot builder copied the SQLite file with cp; committed data
  still in the -wal file of an open database would be missing. Checkpoint
  first (a no-op for the publisher's closed database, so the bytes and
  hash are unchanged) and refuse to copy when that cannot complete.
- install.sh took the tag from a greedy match, which on a compact
  single-line releases response picks the last tag, not the newest (it
  installed v0.2.3 over v0.2.4 in the new test). Split fields first.
- scripts/audit-msn-fundamentals.sh read the symbol map from a path that
  no longer exists and silently checked no stocks.
- release.yml granted contents: write to every job; only publish gets it
  now. Actions in the release and snapshot workflows are pinned to commit
  SHAs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

scripts/audit-msn-fundamentals.sh

@@ -130,7 +130,9 @@ resolve_tickers() {
         done
         IFS="$old_ifs"
     else
-        mapfile -t TICKER_LIST < <(cut -f1 "$ROOT_DIR/src/api/msn/symbol_ids.tsv")
+        symbol_map="$ROOT_DIR/crates/idx-core/src/api/msn/symbol_ids.tsv"
+        [[ -f "$symbol_map" ]] || { echo "symbol map not found: $symbol_map" >&2; exit 1; }
+        mapfile -t TICKER_LIST < <(cut -f1 "$symbol_map")
     fi
 
     if [[ ${#TICKER_LIST[@]} -eq 0 ]]; then

scripts/build-latest-ownership-snapshot.sh

@@ -163,8 +163,11 @@ DB_PATH="$XDG_DATA_HOME/idx/ownership.db"
 printf 'Discovering latest supported IDX/KSEI above-1%% report...\n'
 "$IDX_BIN" -o json ownership discover --family above1 --limit 50 > "$DISCOVERY_JSON"
 
-discovery_payload="$(
-    jq -r '
+# NUL-separated, so a field containing newlines (a report title) cannot
+# shift the fields after it. Written to a file: command substitution drops
+# NULs, and a jq failure must still stop the script under set -e.
+DISCOVERY_FIELDS="$WORKDIR/discovery-fields"
+jq --raw-output0 '
         if type != "array" or length == 0 then
             error("ownership discover returned no reports")
         else
@@ -184,9 +187,8 @@ discovery_payload="$(
               ]
             | .[]
         end
-    ' "$DISCOVERY_JSON"
-)"
-mapfile -t discovery_fields <<< "$discovery_payload"
+    ' "$DISCOVERY_JSON" > "$DISCOVERY_FIELDS"
+mapfile -d '' -t discovery_fields < "$DISCOVERY_FIELDS"
 
 DISCOVERED_FAMILY="${discovery_fields[0]:-}"
 DISCOVERED_LISTING_PAGE_URL="${discovery_fields[1]:-}"
@@ -308,6 +310,14 @@ jq \
             original_filename: ($original_filename | if . == "" then null else . end)
         }
     ' "$MANIFEST_PATH" > "$TMP_MANIFEST_PATH"
+# Clients reject a manifest missing any of these, so a bad one would block
+# every `idx ownership sync`; refuse to produce it.
+if ! jq -e '[.source.pdf_url, .source.title, .source.publish_date, .snapshot.version]
+        | all(type == "string" and (gsub("^\\s+|\\s+$"; "") | length > 0))' \
+        "$TMP_MANIFEST_PATH" > /dev/null; then
+    echo "built manifest is missing source.pdf_url, source.title, source.publish_date, or snapshot.version" >&2
+    exit 1
+fi
 mv "$TMP_MANIFEST_PATH" "$MANIFEST_PATH"
 
 printf 'Prepared release-ready snapshot from %s (%s)\n' \

scripts/build-ownership-snapshot.sh

@@ -94,6 +94,15 @@ MANIFEST_PATH="$OUTPUT_DIR/ownership-snapshot-manifest.json"
 TMP_ARTIFACT_PATH="$OUTPUT_DIR/.ownership-snapshot-${LATEST_AS_OF}.sqlite.tmp.$$"
 # Remove a partial copy if the script fails before the atomic rename below.
 trap 'rm -f "$TMP_ARTIFACT_PATH"' EXIT
+# Committed data can still sit in the -wal file while another connection has
+# the database open; checkpoint it into the main file first (a no-op for a
+# closed database, so its bytes and hash are unchanged), and refuse to copy
+# when that cannot complete.
+checkpoint="$(sqlite3 "$DB_PATH" "PRAGMA wal_checkpoint(TRUNCATE);")"
+if [[ "${checkpoint%%|*}" != "0" ]]; then
+    echo "ownership database is busy; could not checkpoint its WAL before copying: $DB_PATH" >&2
+    exit 1
+fi
 cp "$DB_PATH" "$TMP_ARTIFACT_PATH"
 
 # Immutable, content-addressed name. The publisher relies on this to upload and

scripts/install-sh-test.sh

@@ -191,6 +191,17 @@ else
   fail "expands quoted ~ and tolerates trailing slashes"; cat "${work}/out9" >&2
 fi
 
+# 10. a compact single-line releases response still resolves the newest tag.
+printf '%s' '[{"tag_name":"ownership-snapshot-current"},{"tag_name":"v0.2.4","name":"v0.2.4"},{"tag_name":"v0.2.3"}]' \
+  >"${api_dir}/releases"
+dir="${work}/compact"
+if run_installer "$test_shell" "$installer" --dir "$dir" >"${work}/out10" 2>&1 &&
+  [[ "$("${dir}/idx")" == "idx fake v0.2.4" ]]; then
+  pass "resolves the newest tag from a compact releases response"
+else
+  fail "resolves the newest tag from a compact releases response"; cat "${work}/out10" >&2
+fi
+
 if ((failures > 0)); then
   echo "install.sh tests: ${failures} failure(s) with ${test_shell}" >&2
   exit 1