Provider regeneration is manual and its digests are hand-edited #822

Audit finding 20 of 27 (2026-10-13, main at f8cd4d68).

Finding

Regeneration is an eight-command sequence with three assets --write passes and no wrapper (crates/echo-wesley-gen/README.md:239-250). The two component SHA-256s appear on 18 lines in 9 files, with byte sizes in four READMEs that no test reads. Wasm and generated files are checked in up to five times, enforced by three unrelated checkers. Provenance binds the root Cargo.lock, so unrelated dependency changes force a refresh.

Where

xtask/src/provider_lowerer_component.rs:56,65; crates/echo-wesley-gen/tests/provider_package.rs:63-69; schemas/edict-provider/

Why it matters

The 2026-10-13 re-integration of #775 took two rebuild rounds and hand edits in about eight places.

Acceptance

• One command regenerates everything and one command checks everything, including README digests.
• Digests are derived or verified, not edited.
• Copies that can be derived at build or package time are not checked in.

Verification status

This finding is reported by one reviewer from reading; not independently checked. Nothing was compiled or run for the audit. Confirm against current main before starting.