cull-release-verify

Cull Release Verify

Principle

Reconstruct release truth from immutable public evidence. Verification is

read-only by default.

Verify

1. Resolve the Cull checkout and select the explicit version or latest public

release.

1. Run npm run release:cull -- state show --version "$VERSION" --json and parse

exactly one JSON envelope.

1. Bind the annotated Git tag object and peeled commit to the published release,

authenticated workflow run, provenance, and required asset inventory.

1. Download artifacts to an isolated temporary directory. Run Cull's exact

artifact verifier; check updater signature, SHA-256 checksums, DMG contents,

embedded version and architecture, codesign, Gatekeeper, and notarization

staple.

1. Compare Homebrew version and SHA-256 with public provenance and require its

promotion evidence.

1. Report version, commit, tag object, workflow, asset hashes, release URL, tap

commit, installed-version evidence, launch evidence, and mismatches.

Default to no installation. When the user explicitly requests an install smoke,

use an isolated location and preserve any existing app. Never edit release state,

the GitHub release, tags, the tap, system Applications, or cull.db.