Verify the bytes, then verify the hosted release.

The enriched v0.50.0 source publication candidate is sealed independently from the website.

Current enriched source archive

ruleoak-v0.50.0-public-content-enrichment-r2-source.zip
SHA-256: 867332fa420325d8e58dbdd5ecd6c043397974a1e5458ece128142d0c1ce9052

The archive contains a SOURCE_MANIFEST.sha256 binding governed files to path, mode and SHA-256. Verify the archive checksum before extraction, then run the source-manifest gate from a clean extraction.

Source verification

npm run check:bootstrap
npm run check:source-manifest
npm test
npm run qa:auto

Release verification after GitHub publication

A live GitHub release can add external evidence the source archive cannot provide by itself: public commit/tag identity, workflow execution, artifact attestations, release assets and repository security settings.

gh attestation verify ./ruleoak-*.tgz --repo ruleoak/ruleoak

Use that only after the authoritative public workflow has actually produced attestations. Source configuration is preparation, not proof of a hosted attestation.

npm provenance

Likewise, trusted-publishing configuration can prepare npm provenance, but the provenance record exists only after the real package is published through the configured workflow.