[Pepps233]

Summary

Pin manual self-update installation targets to the local @diffexai/diffex identity and add opt-in publication-to-HTTP verification against the deployed staging Worker.

Foreign or missing identities and unsafe versions are rejected before any package-manager operation, including with --force.

Paired with diffexai/diffex-cloud#145.

Reasoning

The source CLI reproduced an untrusted response causing removal of Diffex followed by a foreign-package installation attempt.

Independent target validation protects the installer, while real staging publication and HTTP checks verify that the serving layer implements the shared contract.

The fixture writer remains in the CLI repository with its own bucket-scoped credentials, separate from Worker deployment.

Changes

• Validate canonical identity and stable version before constructing installation targets from the local package constant.
• Replace vulnerable characterization expectations with rejection regressions and canonical installation assertions.
• Preserve offline behavior, automatic opt-out, bounded retries, and update-note rendering.
• Add --staging --public-api and the manual workflow's optional check_public_api input for real HTTP checks against fixed staging storage and Worker targets.
• Verify malformed records, missing releases, query selectors, unsupported paths/methods, unchanged objects, and publication advancement through the deployed service.
• Track owned malformed fixtures, restore conditionally, and release the shared lock after successful storage cleanup even if the final HTTP check fails.
• Record live evidence and remaining migration requirements in the release runbooks.

The shared checker still targets Pi until the authority migration.
Strict consumer parsing, redirects, no-release messaging, and installed-client canaries remain separate work.

Testing

• Original controlled source-CLI reproduction captured foreign-package attempts without executing them.
• Updated source-CLI and package-command tests: 49 cases passed.
• npm run check and isolated ./test.sh: passed.
• node scripts/verify-release-publication.mjs --staging --public-api: passed using controlled npm responses for all 11 packages, actual R2, and the deployed Worker.
• All synthetic release keys and the staging lock were confirmed absent after cleanup; production latest remained absent.
• Exact supplied-credential scan found no values in tracked or proposed files.

No installed software or npm release was changed.
The manual verification workflow becomes dispatchable when it reaches main; the recorded live verification ran locally.