[CO-2c-fix] fix release asset paths

[scottconverse]

Summary

• fixes .github/workflows/release.yml to download release artifacts into release-assets/ and publish exact file paths
• adds workflow regression coverage for the downloaded artifact path shape so gh release create cannot receive the artifact directory itself
• records the release publication path fix in CHANGELOG.md

Failure Context

• CO-2c correction run 25363513233 passed preflight, full release verification, build, attestation generation, cosign signing, attestation verification, and artifact upload
• final publication failed because actions/download-artifact restored files as dist/dist/*, and gh release create dist/* attempted to upload the dist/dist directory
• no GitHub Release or release assets are currently visible; v0.22.0 remains Latest

Release-Class Boundary

Workflow repair only. This PR does not move/delete/recreate the v0.22.1 tag, publish a GitHub Release, generate a new real-release attestation, upload release assets, edit published release notes, or modify Latest state.

Review Surface

Copied from git diff --name-only origin/main...HEAD:

• .github/workflows/release.yml
• CHANGELOG.md
• tests/test_github_workflows.py

Verification

• python -m pytest tests/test_github_workflows.py tests/test_release_provenance.py -q -> 4 passed
• python -m pytest --collect-only -q -> 249 tests collected
• bash scripts/verify-release.sh -> 249 pytest passed, ruff passed, version lockstep passed, release-provenance fixtures passed, required docs present, build artifacts generated, clean virtualenv import smoke passed, VERIFY-RELEASE: PASSED
• required docs gate checked: README.md, CHANGELOG.md, CONTRIBUTING.md, LICENSE, .gitignore, docs/index.html all present

[scottconverse]

CO-2c Release-Gate Audit / Sprint Boundary Report

1. Executive Audit

Scope: CivicSuite/civiccore CO-2c first attested baseline release, including corrective PRs #42 and #43 after failed release-publication attempts.

Audit mode: release-gate. Repo under active cleanup: yes, limited to release workflow correction and post-release verification. Local/live parity: main equals origin/main at 46c99854adbce6dc8a056ae5215278bb1eba9a19; v0.22.1 tag points to the same commit; target tree is a8281e693f390e128c30fae0ca6b36aba669cc85.

Overall verdict: CO-2c release artifact gate passes. The live GitHub Release is published, marked Latest, has the expected five assets, and the published attestation verifies locally against the live tag, target commit, target tree, artifact hashes, and Sigstore identity.

Ship posture: v0.22.1 may be treated as CivicCore's first attested baseline. Next sprint is CO-3. Do not start CO-3 release-class retrofits without explicit scope authorization.

Severity summary: Blocker 0, Critical 0, Major 1, Minor 0. Static audit confidence: High for CO-2c release surface. Runtime sign-off confidence: High for release provenance and local verification path; Medium for whole-project runtime because full cleanroom/two-machine reproduction is deferred to CO-6.

CI/workflow posture: release run 25388443635 succeeded for preflight fixtures, build/attest/verify, and GitHub release publication.

2. Audit Coverage Ledger

• Remote parity: Checked. main, origin/main, and v0.22.1 all resolve to 46c99854adbce6dc8a056ae5215278bb1eba9a19.
• Local-vs-live commit truth: Checked. gh release view v0.22.1 reports the live release exists at tag v0.22.1; tag resolves locally to the same SHA.
• CI/workflow presence: Checked. .github/workflows/ci.yml, release-preflight.yml, and release.yml exist.
• Windows install path: Partially checked. scripts/verify-release.sh performed fresh virtualenv install/import on Windows and passed.
• Linux or Unix install path: Partially checked. Release workflow ran on GitHub Actions and passed; separate local Linux cleanroom remains CO-6.
• Platform parity verdict: Partially checked. Windows local plus GitHub runner evidence are green; two independent-machine parity remains CO-6.
• First boot: Checked for library import smoke in fresh venv.
• Required post-install steps: Checked for release package import path; no app boot path is in CO-2c scope.
• Migrations: Partially checked through test suite; no live DB migration rehearsal in CO-2c scope.
• Seed/bootstrap requirements: Not applicable to CO-2c release artifact gate.
• Runtime dependency/model requirements: Checked at package install/import level.
• First-boot dependency truth: Checked at package import level in fresh venv.
• Secrets and credential handling: Checked for release workflow shape; no secrets printed or embedded in remotes.
• Auth/session handling: Partially checked through test suite only; not release-surface specific.
• Authorization/role boundaries: Partially checked through test suite only; not release-surface specific.
• Sensitive-data exposure: Partially checked through release artifacts and public report surfaces; no sensitive artifact observed.
• Audit/compliance logging: Partially checked through tests; broader lifecycle remains later CivicCore finish work.
• External/admin surfaces: Not applicable to package release gate.
• Connector implementation/docs truth: Partially checked through tests/docs; not the main CO-2c release criterion.
• Background jobs/schedulers: Partially checked through tests only.
• Frontend critical journeys: Checked for staged docs page via existing committed browser QA evidence from PR [CO-2a] chore: stage civiccore v0.22.1 attested baseline #40; no new frontend change in PR [CO-2c-fix] fix release asset paths #43.
• Loading/empty/error/partial states: Not applicable to PR [CO-2c-fix] fix release asset paths #43; existing docs page QA was committed in PR [CO-2a] chore: stage civiccore v0.22.1 attested baseline #40.
• Accessibility cues: Partially checked via existing browser QA evidence; no new frontend surface.
• Docs truthfulness: Partially checked. Major watch item remains for CO-3 README wording now that release exists.
• Version consistency: Checked. pyproject.toml and civiccore/__init__.py are 0.22.1; release asset names match.
• Release artifact consistency: Checked. Live asset list and hashes match SHA256SUMS.txt and release-attestation.json.
• Test realism: Checked for release provenance fixtures and workflow asset-path regression; broader mutation/property goals remain later sprints.
• Runtime/build/test verification: Checked. scripts/verify-release.sh passed.
• Browser verification: Partially checked through committed v0.22.1 docs screenshots; no new browser surface in release workflow fix.
• Prior audit/verification challenge: Checked. Failed release attempts were corrected by PR [CO-2c-fix] fix release workflow notes YAML #42 and PR [CO-2c-fix] fix release asset paths #43, then the live workflow passed.

3. Claim Verification Matrix

• Claim: v0.22.1 is the first attested baseline release. Verdict: True for the live release surface. Evidence: release https://github.com/CivicSuite/civiccore/releases/tag/v0.22.1, workflow run 25388443635, local provenance verification PASS.
• Claim: Published assets include wheel, sdist, SHA256SUMS, attestation JSON, and bundle. Verdict: True. Evidence: gh release view v0.22.1 --json assets listed exactly those five assets.
• Claim: Published wheel/sdist hashes verify. Verdict: True. Evidence: sha256sum -c SHA256SUMS.txt returned OK for wheel and sdist.
• Claim: Sigstore bundle verifies against pinned workflow identity and issuer. Verdict: True. Evidence: release workflow step Verify release attestation before publication succeeded, and local scripts/verify-release-provenance.py returned PASS using cosign v3.0.6.
• Claim: README install/provenance copy fully reflects post-publication truth. Verdict: Partially true. Evidence: README still includes staged/once-published language; CO-3 explicitly requires this correction.
• Claim: Test count is 249. Verdict: True. Evidence: python -m pytest --collect-only -q collected 249 tests; scripts/verify-release.sh collected and ran 249 tests.

4. What The Dev Team Needs To Do Now

Must fix before ship: none for CO-2c artifact publication.

Should fix this sprint:

• DOC-001 README post-publication drift. Why now: CO-3 explicitly requires README install/provenance copy to point at v0.22.1 without correction-window or staged-release language. Owner area: docs/release. Verification: README search for staged, once published, and correction-window language; live release page parity check.

Can defer if consciously accepted:

• Full two-machine cleanroom reproduction. This is not a CO-2c blocker because CO-6 owns the cleanroom harness, but it must not be represented as completed yet.

5. Next-Sprint Watchlist

• Architecture: CO-3 retrofit ledger must avoid implying old tags are attested unless each tag has a real backfill or explicit no-attestation ledger entry.
• Security/compliance debt: historical release trust posture remains incomplete until CO-3/CO-4 ledger work closes.
• UX debt: no new frontend UX in CO-2c; future docs UI changes still require browser evidence.
• Docs debt: README currently has post-release stale wording to fix in CO-3.
• Install/bootstrap debt: cleanroom harness is CO-6.
• Test debt: mutation/property expansion remains later CivicCore finish work.
• Operational/release debt: release failure modes encountered here are now covered by workflow regression tests.

6. Engineering Deep Dive

Verdict: Release workflow correction is sound for CO-2c. PR #42 fixed YAML release notes generation. PR #43 fixed asset download/upload pathing and added a regression test for exact downloaded asset paths. No Blocker/Critical engineering findings remain.

7. Security And Authorization Deep Dive

Verdict: Release authorization boundaries were respected after failures. Tag moves/publication corrections happened only after chat authorization. The release attestation identity is pinned to https://github.com/CivicSuite/civiccore/.github/workflows/release.yml@refs/tags/v0.22.1; issuer is https://token.actions.githubusercontent.com.

8. UI/UX Deep Dive

Verdict: No new UI surface was introduced in PR #43. Existing v0.22.1 docs page browser QA artifacts are committed from PR #40: docs/browser-qa-v0221-desktop.png, docs/browser-qa-v0221-mobile.png, and docs/browser-qa-v0221-summary.md.

9. Product/PM Deep Dive

Verdict: Product trust posture improved materially: downstream modules now have a live first attested baseline instead of a staged candidate. Product risk remains if CO-3 README/ledger wording is not corrected promptly.

10. Documentation Deep Dive

[MAJOR] [DOC-001] README still has staged-release language after publication

• Confidence: High
• Evidence type: Static
• Status: Durable defect for CO-3, not CO-2c

Why it matters:

README is the main downstream consumer entry point. After v0.22.1 publication, stale phrases such as staged/once-published/candidate language can make auditors unsure whether v0.22.1 is live or still pending.

Evidence:

• README.md includes v0.22.1 is staged as the first attested baseline release.
• README.md includes install wording v0.22.1, once published.
• README.md includes Treat v0.22.1 as the staged baseline release candidate until the release workflow publishes its attestation.

Blast radius:

• Downstream CivicClerk/CivicCode consumers and outside auditors may follow stale release-state wording.

Fix:

• In CO-3, update README to point at the live v0.22.1 release and remove/replace correction-window and candidate language per the directive.

11. Install / Bootstrap / Seeding Deep Dive

Verdict: Fresh virtualenv install/import passed for CivicCore 0.22.1 as part of scripts/verify-release.sh. No seed/bootstrap app path is in CO-2c scope.

12. Version And Release Consistency Deep Dive

Verdict: Version and release artifact truth are consistent for CO-2c. pyproject.toml and civiccore/__init__.py are 0.22.1. Release assets are:

• civiccore-0.22.1-py3-none-any.whl, sha256 5208b65db0477ec33828c4c61a0800a4b40d8829ddebe81549d3fb5cd3cc04f3
• civiccore-0.22.1.tar.gz, sha256 fb4815a2e7af39a512fb2e615d8b723826356ba6e26a21922a2653ba3ee2c3ab
• SHA256SUMS.txt, sha256 4d2262fef36f45f33350a1fcfd25f4d4d74c476e4005207b06b940737fbc23f6
• release-attestation.json, sha256 153b9ad4450322b56a03a26638f1c2ebcd3d72f4dc6484a810f0da962666003d
• release-attestation.json.bundle, sha256 0862c196dd3c970ef8510b7dde95a54aceeb2481da3466c6cd39644f23578575

13. Test Engineering Deep Dive

Verdict: Test gate is green for CO-2c. python -m pytest --collect-only -q collected 249 tests. scripts/verify-release.sh ran pytest, ruff, version lockstep, release-provenance fixtures, required docs, build artifacts, and fresh virtualenv import; result: VERIFY-RELEASE: PASSED.

14. Runtime QA Deep Dive

Verdict: Runtime release verification is green for the CO-2c release surface. Published artifacts were downloaded into .tmp-release-v0221-published-verify-20260505102412; sha256sum -c SHA256SUMS.txt passed; live provenance verification passed with scratch-local cosign v3.0.6.

15. Cross-Cutting Synthesis

The release gate now has the trust anchor it was designed to create: a tag-bound workflow identity, signed attestation bundle, artifact hashes, and local verifier path all agree on the same target commit. The main remaining risk is not artifact validity; it is documentation drift in README and the still-open historical retrofit ledger. That is exactly why CO-3 exists and should be handled next under explicit retrofit scope authorization.

16. Verification Gaps And Sign-Off Limits

• Fresh clone on a second independent machine: not performed in CO-2c; scheduled by CO-6 cleanroom harness.
• Historical tag ledger: not closed in CO-2c; scheduled by CO-3.
• Cross-module historical retrofits: not closed in CO-2c; scheduled by CO-4.
• README post-publication wording: known Major watch item for CO-3.

Verification commands run:

git status --short --branch
# ## main...origin/main, untracked scratch only

git rev-parse HEAD; git rev-parse origin/main; git rev-parse v0.22.1; git rev-parse v0.22.1^{tree}
# HEAD/origin/main/tag: 46c99854adbce6dc8a056ae5215278bb1eba9a19
# tree: a8281e693f390e128c30fae0ca6b36aba669cc85

gh run view 25388443635 --json status,conclusion,workflowName,url,event,headSha,createdAt,updatedAt,jobs
# conclusion: success; workflowName: Release; headSha: 46c99854adbce6dc8a056ae5215278bb1eba9a19

gh release view v0.22.1 --json name,tagName,url,isDraft,isPrerelease,publishedAt,targetCommitish,assets
# release is published, non-draft, non-prerelease, with exactly five expected assets

cd .tmp-release-v0221-published-verify-20260505102412 && sha256sum -c SHA256SUMS.txt
# civiccore-0.22.1-py3-none-any.whl: OK
# civiccore-0.22.1.tar.gz: OK

gh release download v3.0.6 --repo sigstore/cosign -p cosign-windows-amd64.exe -p cosign_checksums.txt -D .tmp-cosign-20260505
Get-FileHash .tmp-cosign-20260505\cosign-windows-amd64.exe -Algorithm SHA256
# 9B85A88EBFF2D9DD30FF4984A6F61F2CEDC232DD87D81FA7F2FF3C0ED96C241C, matching cosign_checksums.txt

python scripts/verify-release-provenance.py v0.22.1 --repo CivicSuite/civiccore --attestation .tmp-release-v0221-published-verify-20260505102412\release-attestation.json --bundle .tmp-release-v0221-published-verify-20260505102412\release-attestation.json.bundle --artifacts-dir .tmp-release-v0221-published-verify-20260505102412 --expected-target 46c99854adbce6dc8a056ae5215278bb1eba9a19 --expected-tree a8281e693f390e128c30fae0ca6b36aba669cc85
# PASS: release provenance verified tag=v0.22.1 tag_ref=46c99854adbce6dc8a056ae5215278bb1eba9a19 target_commit=46c99854adbce6dc8a056ae5215278bb1eba9a19

python -m pytest --collect-only -q
# 249 tests collected

bash scripts/verify-release.sh
# VERIFY-RELEASE: PASSED

Sprint-boundary facts:

• Repos touched: CivicSuite/civiccore only.
• Branches/PRs used: [CO-2a] chore: stage civiccore v0.22.1 attested baseline #40 [CO-2a], [CO-2b] docs: rename historical provenance disclosure #41 [CO-2b], [CO-2c-fix] fix release workflow notes YAML #42 [CO-2c-fix], [CO-2c-fix] fix release asset paths #43 [CO-2c-fix].
• Commits merged: 3971af6, 021aa08, b69b488, 46c9985.
• Release artifacts created: GitHub Release v0.22.1 with wheel, sdist, SHA256SUMS, attestation JSON, and Sigstore bundle.
• Evidence artifacts published: live release, successful release workflow run 25388443635, this PR closeout comment.
• Spec/ADR changes landed: none in CO-2c correction PRs.

[scottconverse]

CO-2c Release-Gate Audit Addendum

Direct release-note Sigstore command was also run against the downloaded live v0.22.1 assets after the closeout comment:

..\.tmp-cosign-20260505\cosign.exe verify-blob release-attestation.json --bundle release-attestation.json.bundle --certificate-identity https://github.com/CivicSuite/civiccore/.github/workflows/release.yml@refs/tags/v0.22.1 --certificate-oidc-issuer https://token.actions.githubusercontent.com
# Verified OK

This closes the specific CO-2c worked-command reproduction check in addition to the stricter scripts/verify-release-provenance.py run recorded above.