Add SHA-256 checksums to pack version entries

[breferrari]

Summary

• Add compute_checksum() to generate.py using the same canonical form as Weave's checksum::compute()
• Each version entry in packs/{name}.json now includes a checksum: "sha256:..." field
• Cross-language compatibility verified against Weave's pinned test vectors (cross_language_checksum_matches_python)
• Depends on Replace regex TOML parsing with stdlib tomllib #10 (tomllib), Add pack validation to generate.py and CI #11 (validation), Add pack deprecation and removal workflow #13 (deprecation)

Weave compatibility

• PackRelease already has pub checksum: Option<String> with #[serde(default)]
• Weave's checksum::verify() activates when the field is present; warns and skips when None
• No Weave code changes needed — checksums start working immediately once this registry change is merged

Related

• Weave roadmap issue #175 (Milestone 6 — security hardening)
• Weave docs PR: docs: add schema_version to REGISTRY.md JSON schemas breferrari/weave#241 (adds schema_version to REGISTRY.md JSON schemas)

Test plan

• All 13 packs generate successfully with checksums
• index.json unchanged (checksums are only in packs/*.json)
• Python checksum output matches Weave's Rust pinned test vectors
• CI passes

Closes #9

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the registry generation pipeline to add SHA-256 integrity checksums to each pack release entry, ensuring consumers (e.g., Weave) can verify pack content integrity based on a canonicalized representation of embedded pack files.

Changes:

• Add checksum: "sha256:..." to each generated pack version entry (computed from a canonical JSON form of the embedded files map).
• Switch pack manifest parsing/validation to tomllib and add a --validate-only CI validation workflow.
• Update publishing workflow to use Python 3.12 and extend contributor docs with deprecation/removal guidance.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
scripts/generate.py	Adds checksum computation and integrates TOML parsing + validation + generation flow updates.
CONTRIBUTING.md	Documents pack deprecation and removal workflow.
.github/workflows/validate.yml	Adds PR-time validation job running generate.py --validate-only on Python 3.12.
.github/workflows/publish.yml	Ensures publish job runs with Python 3.12 (needed for tomllib).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

validate_pack() can raise TypeError when name/version are not strings (e.g., name = 123 in TOML). _NAME_RE.match(name) and _SEMVER_RE.match(version) expect str, so this should explicitly validate types and emit a readable validation error instead of crashing.

[Copilot]

In validate_pack(), the loop assumes each [[servers]] entry is a dict (server.get(...)). If servers contains a non-table value (or a TOML parser returns a non-dict item), this will raise AttributeError and abort validation. Consider checking isinstance(server, dict) and reporting an error like "server #N must be a table" before accessing keys.

[Copilot]

main() runs validate_unique_server_names() even when earlier per-pack validation has already produced errors. Since validate_unique_server_names() assumes data["servers"] is a list of dicts, an invalid pack (e.g. [servers] table) can cause a crash before you reach the if all_errors: sys.exit(1) block. Either (a) skip cross-pack checks when all_errors is non-empty, or (b) make validate_unique_server_names() robust to non-list / non-dict servers values.

Suggested change

	cross_errors = validate_unique_server_names(src_dir)
	all_errors.extend(cross_errors)
	for err in cross_errors:
	print(f" ERROR: {err}", file=sys.stderr)
	if all_errors:
	print(f"\nValidation failed with {len(all_errors)} error(s).", file=sys.stderr)
	sys.exit(1)
	if not all_errors:
	cross_errors = validate_unique_server_names(src_dir)
	all_errors.extend(cross_errors)
	for err in cross_errors:
	print(f" ERROR: {err}", file=sys.stderr)
	if all_errors:
	print(f"\nValidation failed with {len(all_errors)} error(s).", file=sys.stderr)
	sys.exit(1)

[Copilot]

publish.yml is still configured to run on pushes to main only when src/** changes. This PR changes scripts/generate.py (checksum generation), so after merge the publish workflow won’t run to regenerate/commit packs/*.json with the new checksum field unless someone also changes src/** or manually dispatches the workflow. Consider adding scripts/generate.py (and possibly .github/workflows/publish.yml) to the on.push.paths list, or removing the paths filter so generator/schema changes get published automatically.