deploy(installer): publish the verified Assay installer path

[Rul1an]

Summary

• copy scripts/install.sh byte-for-byte from merged Assay commit 125b036c5dfe7d81bd611bc148375292ae48a666
• move the site provenance pin to that immutable source and independently recomputed SHA-256
• leave the existing production live-drift and deployment contracts unchanged

Closes the source-copy and provenance half of #6. Do not close #6 on this PR alone: production deployment plus live default/strict installation proofs remain post-merge.

Provenance

• Assay source PR: fix(installer): verify release integrity before activation assay#2755
• Assay source commit: 125b036c5dfe7d81bd611bc148375292ae48a666
• Assay reviewed head: dc0043311b12d5fca2d1cc8be4d5c8e333c8acd3
• installer SHA-256: 75491d9786c30f89da8e31510d4208215e7ce99e55ab10206c1b054f404aac96

RED -> GREEN

RED after copying the reviewed bytes while retaining the stale pin:

FAIL committed install.sh: SHA-256 mismatch
expected bb23a411d8a48c0adda27e6aeb9d3d02c4c3eea8ebad463545578c3be8e3ab2f
actual   75491d9786c30f89da8e31510d4208215e7ce99e55ab10206c1b054f404aac96

GREEN after moving source commit and digest together:

• bash scripts/test-installer-provenance-contract.sh
• bash scripts/check-installer-provenance.sh
• python3 scripts/test-site-headers-contract.py
• python3 scripts/test-site-contract-workflow.py
• python3 scripts/test-installer-live-drift-workflow.py
• sh -n install.sh
• shellcheck install.sh
• git diff --check
• independent cmp against git show 125b036c...:scripts/install.sh

Post-merge proof

1. wait for the required Cloudflare Pages deployment on the final site commit;
2. dispatch Installer live drift and bind its output to that site commit;
3. fetch the live script and independently confirm its digest;
4. install published v5.5.2 through the live URL in default mode and require checksum_verified plus provenance_not_requested;
5. repeat in strict mode with ASSAY_REQUIRE_PROVENANCE=1 and require both checksum and upstream-defined attestation identity verification;
6. record the selected asset and digest, without turning checksum equality into signer-identity or runtime-safety claims.

Non-claims

• PR tests are not production deployment evidence.
• Cloudflare deployment success is not live-byte equivalence.
• Checksum equality does not establish signer identity.
• Attestation verification does not establish runtime safety or semantic correctness.
• This site-only deployment does not require a new Assay binary release.

Summary by CodeRabbit

• New Features

  • Added optional release provenance verification for installations.
  • Added SHA-256 checksum validation for downloaded archives.
  • Installer now supports safer handling of temporary files and atomic binary installation.

• Bug Fixes

  • Relative installation and temporary-directory paths are now resolved consistently from the invocation directory.
  • Temporary installation files are cleaned up automatically when installation finishes or is interrupted.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 55b051f9-2b77-4cef-b1e3-fa36201ca19e

📥 Commits

Reviewing files that changed from the base of the PR and between 091b124 and 9125f47.

📒 Files selected for processing (2)

• install.provenance.json
• install.sh

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The installer now resolves relative paths, validates downloaded archives with SHA-256 sidecars, optionally verifies GitHub attestations, cleans up on interruption, and atomically replaces installed binaries. Provenance metadata pins the installer source commit and checksum.

Changes

Installer integrity flow

Layer / File(s)	Summary
Path resolution and validation contracts install.sh	Relative INSTALL_DIR and TMP_ROOT values use the invocation directory. ASSAY_REQUIRE_PROVENANCE accepts only unset or 1.
Archive download and checksum verification install.sh	The installer downloads the archive and bounded checksum sidecar, validates the sidecar format and archive name, and compares the archive SHA-256 digest.
Provenance verification and atomic installation install.sh, install.provenance.json	Strict mode resolves the release commit and verifies its attestation. Cleanup traps remove temporary files. Installation uses temporary candidate files before replacement. Provenance metadata records the pinned source commit and checksum.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🔵 Low · up to 9125f

This PR publishes the verified installer bytes and updates their immutable provenance pin. It is mergeable with owner awareness that concurrent installations may be last-writer-wins and replacement behavior is not established on every supported Windows filesystem.

Sequence Diagram(s)

sequenceDiagram
  participant Installer
  participant ReleaseServer
  participant HashTool
  participant GitHubAPI
  participant gh
  participant InstallDirectory

  Installer->>ReleaseServer: Download archive and checksum sidecar
  Installer->>HashTool: Compute archive SHA-256
  HashTool-->>Installer: Return archive digest
  Installer->>Installer: Validate checksum record
  opt ASSAY_REQUIRE_PROVENANCE=1
    Installer->>GitHubAPI: Resolve release tag to commit
    Installer->>gh: Verify archive attestation
    gh-->>Installer: Return verification result
  end
  Installer->>InstallDirectory: Write temporary binary candidate
  Installer->>InstallDirectory: Atomically move candidate into place

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 1 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the deployment change and the publication of the verified Assay installer path.
Linked Issues check	✅ Passed	The PR addresses the coding requirements in issue #6 by pinning the installer source, updating provenance metadata, and publishing the installer copy. Production deployment and live installation proof…
Out of Scope Changes check	✅ Passed	The changes are limited to the installer source copy and its provenance metadata. These changes support the linked deployment objective, and no unrelated code changes are identified.

Full details: Linked Issues check

Explanation

The PR addresses the coding requirements in issue #6 by pinning the installer source, updating provenance metadata, and publishing the installer copy. Production deployment and live installation proofs remain post-merge requirements and are non-coding tasks.

Full details: Docstring Coverage

Explanation

Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/6-installer-deploy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The installer script and provenance pin move together consistently, and no correctness issues were identified in the updated installer flow.

Pull request overview

This PR updates the published install.sh on getassay.dev to a byte-identical copy of the upstream Assay installer at a pinned immutable commit, and updates the site’s provenance pin (commit + SHA-256) to match those exact bytes.

Changes:

• Update install.sh to the upstream Assay installer version that adds checksum verification and opt-in provenance verification via gh attestation verify.
• Move the provenance pin in install.provenance.json to Assay commit 125b036c... and the independently recomputed installer SHA-256.
• Preserve existing site deployment/live-drift contract flow while making the source+digest pin consistent.

File summaries

File	Description
install.sh	Refreshes the published installer script to the pinned upstream version (adds checksum + optional provenance verification and safer temp/install handling).
install.provenance.json	Updates the pinned upstream commit and SHA-256 digest to match the new installer bytes.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Rul1an]

READY at exact head 9125f47f5f604f897db9b401fc39ddbf9c8f5f63 (base 091b124ebdb090232f6360e924b07a4e5b9eb329).

Independent read-only review from fresh temporary clones. I did not write or edit this change, its issue contract, or its implementation plan.

Findings: none.

Evidence:

• three-dot diff changes exactly install.provenance.json (100644) and install.sh (100755);
• fresh Assay clone resolves source commit 125b036c5dfe7d81bd611bc148375292ae48a666;
• source and site installer are byte-identical (cmp exit 0; shared Git blob ae5fc574cb73b4872e67436bb6b51248c27a21db);
• independent OpenSSL SHA-256 for both is 75491d9786c30f89da8e31510d4208215e7ce99e55ab10206c1b054f404aac96;
• every provenance field matches the immutable repo/commit/path/target/digest;
• focused provenance, workflow, header, shell syntax, ShellCheck and diff checks all exit 0;
• hosted Site contract run 33674889766 succeeds on this exact head;
• disposable mutations pair stale bytes with the new digest and new bytes with the stale digest; both fail closed, while the no-op control passes.

Non-claims: this review does not establish production deployment or live getassay.dev bytes. Cloudflare PR deployment was not treated as production-domain evidence. Digest equality establishes byte identity, not signer identity, runtime safety or semantic correctness. No new Assay binary release is implied.