[abruption]

Summary

Closes #27. First dependency in the v0.4.0 milestone; #28–#30 remain separate work.

• Add offline dots-ts version [--json] with package version, source integrity and separate bounded Tailscale binary version.
• Preserve unknown package/revision information for legacy installations; never infer the package from the Tailscale version.
• Validate the fixed four-file source manifest before installation and refuse existing code/manifest conflicts before payload placement. Reinstallation uses the verified installed layout.
• Add package integrity to doctor while retaining the existing execution-context access contract.
• Add manifest generation/check tooling and CI freshness checks. Document the development feature in English, Korean, Simplified Chinese and Japanese. Published v0.3.1 examples remain explicitly separate.

Validation

• 10 package version/integrity tests passed locally, including modified/mixed/missing files, metadata absence, unsafe file types, bounded binary output and code/manifest rollback.
• 29 doctor tests passed; affected context tests rechecked after preserving the existing enum.
• Bash syntax, ShellCheck, manifest check and git diff checks passed.
• Linux CI passed all 192 tests on both Python 3.11 and 3.13, including all 7 installer tests; ShellCheck and manifest freshness also passed. CI run.
• The existing usage-guide suite passed 7 tests locally; the remaining test required Linux timeout and passed in CI.

Limits and operations

• Version is 0.4.0-dev, not a published release. No live Dots deployment or restart was performed for this PR.
• Manifest match proves consistency with the supplied manifest, not publisher authentication. Source revision remains null rather than being guessed.
• Missing/invalid metadata reports unknown; exit 0 alone is not proof of integrity. Mismatch/incomplete return exit 1.
• New source installs need source-manifest.json alongside all four source files. Future release assets must include it; existing v0.3.1 assets are unchanged.
• Reads are confined to package metadata/code and the local Tailscale version command; package verification does not read/hash node state or private keys.

Preceding recovery research

The bounded watchdog recovery/resume verification is recorded separately in #20: #20 (comment). That research does not establish VM replacement recovery and is not included as production watchdog code in this PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T02:12:05.195241Z	9feb27a	PR opened
🔒 Security Review	✅ Completed 2026-10-21T02:14:58.808421Z	9feb27a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.