hermes 304709f3ac fix(release): robust publisher fields, WAL-safe copy, installer tag order, pinned actions ... From the full-repo Codex audit: - The publisher read discovery fields one per line, so a report title with newlines shifted every later field and published a manifest without source.publish_date, which every client rejects (blocking all syncs). Read them NUL-separated, and refuse to write a manifest missing a field clients require. - The snapshot builder copied the SQLite file with cp; committed data still in the -wal file of an open database would be missing. Checkpoint first (a no-op for the publisher's closed database, so the bytes and hash are unchanged) and refuse to copy when that cannot complete. - install.sh took the tag from a greedy match, which on a compact single-line releases response picks the last tag, not the newest (it installed v0.2.3 over v0.2.4 in the new test). Split fields first. - scripts/audit-msn-fundamentals.sh read the symbol map from a path that no longer exists and silently checked no stocks. - release.yml granted contents: write to every job; only publish gets it now. Actions in the release and snapshot workflows are pinned to commit SHAs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh		2026-10-18 02:16:18 +00:00
..
workflows	fix(release): robust publisher fields, WAL-safe copy, installer tag order, pinned actions	2026-10-18 02:16:18 +00:00