[iHow1]

Summary

• make every checksums.txt path resolve from the Release workflow working directory
• remove sha256sum --ignore-missing, so a missing tarball or evidence manifest fails the publish gate
• lock the contract with a test that requires exactly six entries, resolves every target, recomputes every SHA-256, and forbids the ignore option

Root cause

release-evidence/checksums.txt previously named the tarball and manifest without their release-evidence/ prefix, while the workflow ran sha256sum from the repository root with --ignore-missing. The command could therefore skip the two artifacts it was meant to protect and still succeed after checking only root-level legal files.

Verification

• RED before fix: checksum target exists from the release workflow cwd: ihow-memory-0.1.0.tgz
• node --test tests/release-evidence.test.mjs — 2/2 pass
• generated development evidence followed by sha256sum --check /tmp/ihow-release-evidence-green/checksums.txt from repository root — 6/6 pass
• npm run typecheck — pass
• git diff --check — pass

Release boundary

The previous main object a088dc83f3d5c2c5068fb46fe640078e88d444dc was invalidated as a release candidate and its in-progress CI run was cancelled. No tag or npm publication occurred. A new immutable RC and full gate are required after this repair merges.