\\n>

How can I continue?

\\n> \\n> After more reviews become available, a review can be triggered using the `@coderabbitai review` command as a PR comment. Alternatively, push new commits to this PR.\\n> \\n> To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.\\n> \\n>

\\n> \\n> \\n>

\\n>

How do review limits work?

\\n> \\n> CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.\\n> \\n> For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.\\n> \\n> Please refer [docs](https://docs.coderabbit.ai/management/plans#rate-limits) for additional details.\\n> \\n>

\\n> \\n>

\\n>

Review details

\\n> \\n>

\\n>

⚙️ Run configuration

\\n> \\n> **Configuration used**: Organization UI\\n> \\n> **Review profile**: ASSERTIVE\\n> \\n> **Plan**: Pro Plus\\n> \\n> **Run ID**: `b08ea09d-1c36-4ad2-bf5d-c9f5b1724c39`\\n> \\n>

\\n> \\n>

\\n>

📥 Commits

\\n> \\n> Reviewing files that changed from the base of the PR and between a54884d2f0b2660bd57b301504dce8df7f7cab5e and 52d56676c07cf11b1e9a7d4f0b4b9039253d28d2.\\n> \\n>

\\n> \\n>

\\n>

📒 Files selected for processing (3)

\\n> \\n> * `apps/shiplog/tests/release_candidate_smoke.rs`\\n> * `scripts/release-install-smoke.ps1`\\n> * `scripts/release-install-smoke.sh`\\n> \\n>

\\n> \\n>

\\n\\n\\n\\n\\n\\n\\n\\n## Summary by CodeRabbit\\n\\n* **New Features**\\n * Added comprehensive release-candidate verification across supported platforms before publication.\\n * Added staged-bundle testing for installation, checksums, metadata, and executable startup.\\n * Added release readiness records summarizing validation results.\\n\\n* **Bug Fixes**\\n * Releases are now verified against the exact source revision used to build them.\\n * Invalid, corrupted, incomplete, or non-functional release packages are rejected before publication.\\n\\n* **Documentation**\\n * Updated installation verification guidance and status messages for staged and published releases.\\n\\n\\n## Walkthrough\\n\\nThe release workflow now binds all jobs to an immutable commit, stages a four-platform candidate, validates candidate metadata and binaries, performs first-use acceptance, checks negative controls, and records a readiness receipt before human-authorized publication.\\n\\n### Changes\\n\\n**Release candidate workflow**\\n\\n|Layer / File(s)|Summary|\\n|---|---|\\n|**Immutable source and candidate staging**
`.github/workflows/release.yml`|Preflight resolves and exports the exact release commit. Build and staging jobs verify that commit. The workflow creates deterministic candidate assets, checksums, and manifest metadata.|\\n|**Candidate manifest and smoke validation**
`.github/workflows/release.yml`, `scripts/release-install-smoke.sh`, `scripts/release-install-smoke.ps1`|Validation supports staged candidates and public releases. Candidate manifests, source SHAs, required assets, checksum digests, versions, commands, and receipts are checked.|\\n|**Cross-platform acceptance and negative controls**
`.github/workflows/release.yml`, `apps/shiplog/tests/release_candidate_smoke.rs`|Acceptance jobs test staged candidates on four platforms. Tests and negative controls reject incomplete bundles, corrupted checksums, and executables that fail during use.|\\n|**Readiness receipt and publication gate**
`.github/workflows/release.yml`|The workflow requires all release gates, records candidate and artifact digests in a readiness receipt, and retains the receipt while publication remains human-authorized.|\\n\\n**Estimated code review effort:** 5 (Critical) | ~90 minutes\\n\\n**Possibly related issues**\\n\\n- EffortlessMetrics/shiplog-swarm#245 — The PR implements staged exact-binary, four-platform first-use acceptance and release-readiness gates.\\n- EffortlessMetrics/shiplog-swarm#246 — The PR implements immutable staging, first-use acceptance, negative controls, and terminal readiness gating.\\n\\n**Possibly related PRs**\\n\\n- [EffortlessMetrics/shiplog-swarm#273](https://github.com/EffortlessMetrics/shiplog-swarm/pull/273) — Both changes update the release smoke scripts and receipt validation used during cold-start checks.\\n\\n**Poem**\\n\\n> A rabbit checks each checksum bright, \\n> Four platforms run through the night. \\n> Bad bytes hop out, failed tools flee, \\n> Receipts rest by the release tree. \\n> The final gate waits for human cheer.\\n\\n\\n\\n\\n

\\n

🚥 Pre-merge checks | ✅ 5

\\n\\n

\\n

✅ Passed checks (5 passed)

\\n\\n

\\n\\n\\n\\n\\n

\\n

✨ Finishing Touches

\\n\\n

\\n

📝 Generate docstrings

\\n\\n- [ ] Create stacked PR\\n- [ ] Commit on current branch\\n\\n

\\n

🧪 Generate unit tests (beta)

\\n\\n- [ ] Create PR with unit tests\\n- [ ] Commit unit tests in branch `fix/release-staged-candidate-gate`\\n\\n

\\n\\n

\\n\\n\\n\\n\\n---\\n\\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=EffortlessMetrics/shiplog-swarm&utm_content=391)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\\n\\n

\\n

❤️ Share

\\n\\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\\n\\n

\\n\\n\\n_{Comment `@coderabbitai help` to get the list of available commands.}\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"## CI budget acknowledgement\\n\\nThe PR planner selected the release-package, workflow-policy, and CLI-product risk packs: 11 lanes at an estimated ~165 LEM, placing this in the hard band. `ci-budget-override` is applied deliberately.\\n\\nThe spend is justified because this PR changes the exact release artifact trust boundary, platform smoke scripts, workflow policy surface, and cross-platform integration proof together. Splitting the workflow from the scripts/tests would create an intermediate contract that cannot prove the bytes it selects and would run overlapping release/policy lanes multiple times.\\n\\nSkipped nightly, coverage, mutation, and release-only lanes are not claimed as executed proof. A real explicit-tag run remains required before #245 can close.\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"[P1] Make the staged-candidate success path pass receipt validation\\n\\nFailure mode:\\nThe exact-head hosted `Shiplog Rust Small Result` run for this PR fails `staged_candidate_smoke_uses_local_bundle_and_emits_receipts`: `report validate --path \\\"$latest_run/intake.report.json\\\" --receipts` rejects the generated report because `reports.json` points at `.../out/merge_.../out/merge_.../intake.report.json` while the validated file is `.../out/merge_.../intake.report.json`.\\n\\nWhy here:\\nThe new staged-candidate smoke contract makes this validation a required release gate at `scripts/release-install-smoke.sh:258`, so the PR's exact hosted gate is currently red even though the other three new tests pass.\\n\\nFix direction:\\nAlign the receipt path contract used by the cold-start command and `report validate --receipts`—either emit the canonical run-relative path expected by the validator or resolve an already run-rooted path without prepending `out/` again. Keep the regression in `release_candidate_smoke` so this exact candidate path stays green.\\n\\nValidation:\\nRerun `cargo test -p shiplog --test release_candidate_smoke --locked` and the routed `Shiplog Rust Small Result` check on the updated exact head.\\n\\nConfidence:\\nHigh; reproduced in hosted run 30899824202, job 91961327124.\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_📐 Maintainability & Code Quality_ | _🟡 Minor_ | _⚡ Quick win_\\n\\n**Send both handoff lines to the step summary.**\\n\\nLine 229 writes to stdout only. The recorded summary therefore omits the statement that Swarm cannot create a GitHub release, which is the point of this receipt.\\n\\n

\\n

🧹 Proposed fix

\\n\\n```diff\\n run: |\\n- echo \\\"Swarm verifies release inputs but cannot create a GitHub release.\\\"\\n- echo \\\"Promote this exact proven tree to EffortlessMetrics/shiplog for authorized release execution.\\\" >> \\\"$GITHUB_STEP_SUMMARY\\\"\\n+ set -euo pipefail\\n+ {\\n+ echo \\\"Swarm verifies release inputs but cannot create a GitHub release.\\\"\\n+ echo \\\"Promote this exact proven tree to EffortlessMetrics/shiplog for authorized release execution.\\\"\\n+ } >> \\\"$GITHUB_STEP_SUMMARY\\\"\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn @.github/workflows/release.yml around lines 228 - 230, Update the release\\nworkflow step’s shell commands so both handoff messages, including the statement\\nthat Swarm cannot create a GitHub release, are appended to GITHUB_STEP_SUMMARY\\nrather than only printed to stdout. Preserve the existing message text and\\nordering.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":230}{\"type\":\"pull_request_comment\",\"body\":\"_🔒 Security & Privacy_ | _🟠 Major_ | _⚡ Quick win_\\n\\n

\\n

🧩 Analysis chain

\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\n# Description: List action pinning style in release.yml and resolve the download-artifact v8 commit SHA.\\nset -euo pipefail\\n\\nrg -n 'uses: ' .github/workflows/release.yml\\n\\n# Test: resolve the tag to an immutable commit SHA for pinning.\\ngh api repos/actions/download-artifact/git/ref/tags/v8 --jq '.object'\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 2110\\n\\n---\\n\\n\\n\\n

\\n\\n\\n\\n**Security Misconfiguration (CWE-1357)**\\n\\n**Reachability:** Internal\\n\\n**Pin `actions/download-artifact` to a commit SHA.**\\n\\nThe release workflow pins its Action references to immutable commit SHAs, but `actions/download-artifact@v8` is used at lines 255, 349, 479, and 523. Use the `v8` commit SHA (`3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`) with a `# v8` comment for each reference so the tag cannot be repointed.\\n\\n

\\n

🧰 Tools

\\n\\n

\\n

🪛 zizmor (1.28.0)

\\n\\n[error] 255-255: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)\\n\\n(unpinned-uses)\\n\\n

\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn @.github/workflows/release.yml around lines 254 - 257, Update every\\nactions/download-artifact reference in the release workflow, including the steps\\nnamed “Download all binary artifacts” and the other listed usages, to the\\nimmutable commit SHA 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c and retain a # v8\\ncomment on each reference.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n_Source: Linters/SAST tools_\\n\\n\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":257}{\"type\":\"pull_request_comment\",\"body\":\"_🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\\n\\n**Derive `asset_count` from the `expected` array.**\\n\\nLine 293 hardcodes `asset_count=4` while Lines 266-271 define the real asset list. If a fifth target is added to the matrix and to `expected`, the manifest still reports 4. The validators at Line 361, `scripts/release-install-smoke.sh` Line 131, and `scripts/release-install-smoke.ps1` Line 119 all accept `4`, so the incomplete claim passes silently. Deriving the count makes that mismatch fail loudly.\\n\\n

\\n

♻️ Proposed refactor

\\n\\n```diff\\n- asset_count=4\\n+ asset_count=${`#expected`[@]}\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n

🧰 Tools

\\n\\n

\\n

🪛 zizmor (1.28.0)

\\n\\n[info] 288-288: code injection via template expansion (template-injection): may expand into attacker-controllable code\\n\\n(template-injection)\\n\\n---\\n\\n[info] 289-289: code injection via template expansion (template-injection): may expand into attacker-controllable code\\n\\n(template-injection)\\n\\n---\\n\\n[warning] 290-290: code injection via template expansion (template-injection): may expand into attacker-controllable code\\n\\n(template-injection)\\n\\n---\\n\\n[warning] 291-291: code injection via template expansion (template-injection): may expand into attacker-controllable code\\n\\n(template-injection)\\n\\n---\\n\\n[warning] 292-292: code injection via template expansion (template-injection): may expand into attacker-controllable code\\n\\n(template-injection)\\n\\n

\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn @.github/workflows/release.yml around lines 286 - 296, Update the release\\ncandidate metadata generation around RELEASE_CANDIDATE.txt to derive asset_count\\nfrom the expected asset array defined earlier in the workflow instead of\\nhardcoding 4. Ensure the computed count is written to the asset_count field so\\nvalidators and smoke tests reflect every configured target.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":296}{\"type\":\"pull_request_comment\",\"body\":\"_🗄️ Data Integrity & Integration_ | _🟡 Minor_ | _⚡ Quick win_\\n\\n**Add the exact-commit confirmation to this job.**\\n\\nEvery other job that checks out the tag also asserts `git rev-parse HEAD` equals `needs.release-preflight.outputs.release_sha`: Lines 147, 216, 252, 346, 476, and 622. This job omits that assertion, yet it executes `scripts/release-install-smoke.sh` from the checked-out tree. If the tag is moved between preflight and this job, the negative controls run against different script bytes than the ones the acceptance lane proved, and the readiness gate at Line 656 still reports success.\\n\\n

\\n

🔒️ Proposed fix

\\n\\n```diff\\n persist-credentials: false\\n ref: ${{ needs.release-preflight.outputs.release_tag }}\\n \\n+ - name: Confirm exact release commit\\n+ shell: bash\\n+ run: test \\\"$(git rev-parse HEAD)\\\" = \\\"${{ needs.release-preflight.outputs.release_sha }}\\\"\\n+\\n - name: Download exact staged candidate set\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n> ‼️ **IMPORTANT**\\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\\n\\n```suggestion\\n - name: Checkout release scripts\\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\\n with:\\n persist-credentials: false\\n ref: ${{ needs.release-preflight.outputs.release_tag }}\\n\\n - name: Confirm exact release commit\\n shell: bash\\n run: test \\\"$(git rev-parse HEAD)\\\" = \\\"${{ needs.release-preflight.outputs.release_sha }}\\\"\\n\\n - name: Download exact staged candidate set\\n uses: actions/download-artifact@v8\\n with:\\n name: verified-release-candidates\\n path: ${{ runner.temp }}/release-candidate\\n```\\n\\n

\\n\\n\\n\\n

\\n

🧰 Tools

\\n\\n

\\n

🪛 zizmor (1.28.0)

\\n\\n[error] 523-523: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)\\n\\n(unpinned-uses)\\n\\n

\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn @.github/workflows/release.yml around lines 516 - 526, Add an exact-commit\\nverification step immediately after the checkout step in the job containing\\n“Checkout release scripts,” comparing git rev-parse HEAD with\\nneeds.release-preflight.outputs.release_sha and failing on mismatch. Keep the\\nexisting artifact download and release-install-smoke.sh flow unchanged.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":526}{\"type\":\"pull_request_comment\",\"body\":\"_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\\n\\n

\\n

🧩 Analysis chain

\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\n# Description: Inspect shiplog-testkit for existing fixture and bdd helpers reusable by this test.\\nset -euo pipefail\\n\\nfd -t d 'shiplog-testkit' . | head\\nfd -t f -e rs . --full-path shiplog-testkit --exec ast-grep outline {} --items all\\n\\n# Test: check whether apps/shiplog declares shiplog-testkit as a dev-dependency.\\nrg -n -C6 'shiplog-testkit' --glob 'Cargo.toml'\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 298\\n\\n---\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\n# Inspect the smoke test, the shiplog-testkit crate tree, published/declared APIs,\\n# and Cargo dependency declarations without running repository code.\\nset -e\\n\\necho \\\"== candidate smoke outline ==\\\"\\nast-grep outline apps/shiplog/tests/release_candidate_smoke.rs --view expanded || true\\n\\necho \\\"== candidate smoke relevant lines ==\\\"\\nnl -ba apps/shiplog/tests/release_candidate_smoke.rs | sed -n '1,220p'\\n\\necho \\\"== shiplog-testkit files ==\\\"\\nfind crates/shiplog-testkit -maxdepth 5 -type f -name '*.rs' -o -type d -print | sort\\n\\necho \\\"== shiplog-testkit outlines for relevant.rs/files ==\\\"\\nfor f in $(find crates/shiplog-testkit -maxdepth 4 \\\$ -name '*.rs' -type f \\\$); do\\n echo \\\"--- $f\\\"\\n ast-grep outline \\\"$f\\\" --view expanded || true\\ndone\\n\\necho \\\"== tests using fixtures/bdd in apps/shiplog tests ==\\\"\\nrg -n 'use shiplog-testkit|shiplog-testkit::fixtures|shiplog-testkit::bdd|fixtures::|bdd::|CandidateFixture|candidate_fixture' apps/shiplog -S || true\\n\\necho \\\"== Cargo dependency declarations ==\\\"\\nrg -n -C4 'shiplog-testkit' --glob 'Cargo.toml' . || true\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 32080\\n\\n---\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\n# Read the key implementation slices needed to assess whether CandidateFixture can be moved/shared.\\nset -euo pipefail\\n\\necho \\\"== release_candidate_smoke.rs with line numbers ==\\\"\\npython3 - <<'PY'\\nfrom pathlib import Path\\np=Path('apps/shiplog/tests/release_candidate_smoke.rs')\\nfor i,line in enumerate(p.read_text().splitlines(),1):\\n print(f'{i:4d}\\\\t{line}')\\nPY\\n\\necho \\\"== shiplog-testkit src/lib.rs tail around fixtures ==\\\"\\nsed -n '120,236p' crates/shiplog-testkit/src/lib.rs | nl -ba -v120\\n\\necho \\\"== bdd ScenarioContext/cleanup behavior ==\\\"\\nsed -n '20,90p' crates/shiplog-testkit/src/bdd.rs | nl -ba -v20\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 10696\\n\\n---\\n\\n\\n\\n

\\n\\n**Move `CandidateFixture` and `candidate_fixture()` into reusable shared fixtures.**\\n\\n`shiplog-testkit` already declares a `fixtures` module, and `apps/shiplog` depends on it. This setup builds release-candidate metadata and bundles; keep it in `shiplog-testkit::fixtures` or a release-scenario module rather than duplicating it in `release_candidate_smoke.rs`.\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@apps/shiplog/tests/release_candidate_smoke.rs` around lines 16 - 21, Move\\nCandidateFixture and candidate_fixture() out of release_candidate_smoke.rs into\\nthe reusable shiplog-testkit::fixtures module or an appropriate release-scenario\\nsubmodule. Preserve the existing release-candidate metadata and bundle setup,\\nthen update the smoke test imports and usages to reference the shared fixture\\nimplementation.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n_Source: Coding guidelines_\\n\\n\",\"path\":\"apps/shiplog/tests/release_candidate_smoke.rs\",\"side\":\"RIGHT\",\"line\":28}{\"type\":\"pull_request_comment\",\"body\":\"_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\\n\\n**Add error context to the bare `?` propagations.**\\n\\nThe file uses `.with_context(|| ...)` for most filesystem operations. These sites propagate `std::io::Error` with no context: Lines 104, 106, 209, 229, 231, 253, and 255. A failure reports only `Permission denied` with no path or operation, which is hard to diagnose in CI.\\n\\n

\\n

♻️ Proposed refactor for one site

\\n\\n```diff\\n #[cfg(unix)]\\n {\\n use std::os::unix::fs::PermissionsExt;\\n- let mut permissions = fs::metadata(&asset_path)?.permissions();\\n+ let mut permissions = fs::metadata(&asset_path)\\n+ .with_context(|| format!(\\\"read metadata for {}\\\", asset_path.display()))?\\n+ .permissions();\\n permissions.set_mode(0o755);\\n- fs::set_permissions(&asset_path, permissions)?;\\n+ fs::set_permissions(&asset_path, permissions)\\n+ .with_context(|| format!(\\\"set mode 0o755 on {}\\\", asset_path.display()))?;\\n }\\n```\\n

\\n\\nApply the same pattern at Lines 209, 229, 231, 253, and 255.\\n\\nAs per coding guidelines: \\\"Use `anyhow::Result` with `.context(\\\"description\\\")?` for error propagation\\\" and \\\"Add contextual messages with `.with_context(|| format!(...))` for dynamic error information\\\".\\n\\n\\n\\n\\n\\n\\nAlso applies to: 229-231, 252-256\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@apps/shiplog/tests/release_candidate_smoke.rs` around lines 101 - 107, In the\\nrelease-candidate smoke test, update the filesystem operations around the Unix\\npermission setup and the additional sites near lines 209, 229, 231, 253, and 255\\nto attach context before propagating errors. Use static .context descriptions\\nfor fixed operations and .with_context closures with the relevant path for\\ndynamic operations, covering metadata, set_permissions, and other bare\\nfilesystem ? calls while preserving the existing behavior.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n_Source: Coding guidelines_\\n\\n\",\"path\":\"apps/shiplog/tests/release_candidate_smoke.rs\",\"side\":\"RIGHT\",\"line\":114}{\"type\":\"pull_request_comment\",\"body\":\"_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\\n\\n**The Windows broken-executable path has no equivalent proof.**\\n\\nThis test is gated to unix because `scripts/release-install-smoke.ps1` reports execution failure and version mismatch under one message, `unexpected version output`. The Bash script separates them and emits `candidate binary failed --version`. The negative control at `.github/workflows/release.yml` Lines 551-594 also runs on `ubuntu-latest` only. The result is that a Windows candidate binary that cannot execute is never proven to be rejected by a distinct, assertable signal.\\n\\nConsider making the PowerShell script emit `candidate binary failed --version` when `$LASTEXITCODE -ne 0`, then removing the `#[cfg(unix)]` gate here.\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@apps/shiplog/tests/release_candidate_smoke.rs` around lines 246 - 248, Update\\nscripts/release-install-smoke.ps1 to emit the distinct “candidate binary failed\\n--version” signal when the candidate command exits with a nonzero $LASTEXITCODE,\\nwhile retaining “unexpected version output” for successful commands with\\nmismatched output. Then remove the #[cfg(unix)] gate from\\nstaged_candidate_smoke_rejects_broken_command_with_matching_checksum so the same\\nrejection assertion runs on Windows.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n\",\"path\":\"apps/shiplog/tests/release_candidate_smoke.rs\",\"side\":\"RIGHT\",\"line\":302}{\"type\":\"pull_request_comment\",\"body\":\"_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\\n\\n**Rename `$matches` to avoid the PowerShell automatic variable.**\\n\\n`$Matches` is the automatic hashtable that the `-match` and `-notmatch` operators populate. `Assert-CandidateManifest` uses `-notmatch` at Lines 94 and 132. Assigning to `$matches` here shadows that automatic variable and PSScriptAnalyzer reports it as `PSAvoidAssignmentToAutomaticVariable`.\\n\\n

\\n

♻️ Proposed refactor

\\n\\n```diff\\n- $matches = @(\\n+ $candidateMatches = @(\\n Get-ChildItem -LiteralPath $Root -Recurse -File |\\n Where-Object { $_.Name -eq $Name }\\n )\\n- if ($matches.Count -ne 1) {\\n- throw \\\"candidate bundle must contain exactly one $Name; found $($matches.Count) under $Root\\\"\\n+ if ($candidateMatches.Count -ne 1) {\\n+ throw \\\"candidate bundle must contain exactly one $Name; found $($candidateMatches.Count) under $Root\\\"\\n }\\n- return $matches[0].FullName\\n+ return $candidateMatches[0].FullName\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n\\n\\n

\\n

🧰 Tools

\\n\\n

\\n

🪛 PSScriptAnalyzer (1.25.0)

\\n\\n[warning] 66-66: The Variable 'matches' is an automatic variable that is built into PowerShell, assigning to it might have undesired side effects. If assignment is not by design, please use a different name.\\n\\n(PSAvoidAssignmentToAutomaticVariable)\\n\\n

\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@scripts/release-install-smoke.ps1` around lines 66 - 73, Rename the local\\n$matches collection in the candidate bundle lookup to a non-automatic variable,\\nand update its Count, error message, and index references consistently; leave\\nthe Assert-CandidateManifest -notmatch usage unchanged.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n_Source: Linters/SAST tools_\\n\\n\",\"path\":\"scripts/release-install-smoke.ps1\",\"side\":\"RIGHT\",\"line\":76}{\"type\":\"pull_request_comment\",\"body\":\"_🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\\n\\n**Match the PowerShell validator and reject duplicated manifest fields.**\\n\\n`scripts/release-install-smoke.ps1` Lines 103-108 parse `RELEASE_CANDIDATE.txt` into a map and reject a malformed or duplicated field. This Bash validator uses `grep -Fxq` presence checks instead. A manifest that carries two `source_sha` lines, or two `release_tag` lines, satisfies every check here while the PowerShell validator rejects it. The two scripts then disagree about whether the same bundle is valid, which weakens the single-candidate-set guarantee this PR establishes.\\n\\nAdd a duplicate-key check before the field assertions.\\n\\n

\\n

♻️ Proposed refactor

\\n\\n```diff\\n+ if awk -F= 'NF > 0 { if (seen[$1]++) { exit 1 } }' \\\"$manifest\\\"; then\\n+ :\\n+ else\\n+ echo \\\"candidate manifest contains duplicated fields\\\" >&2\\n+ exit 1\\n+ fi\\n+\\n grep -Fxq \\\"schema_version=1\\\" \\\"$manifest\\\" || {\\n echo \\\"candidate manifest has unsupported schema\\\" >&2\\n exit 1\\n }\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n> ‼️ **IMPORTANT**\\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\\n\\n```suggestion\\n if awk -F= 'NF > 0 { if (seen[$1]++) { exit 1 } }' \\\"$manifest\\\"; then\\n :\\n else\\n echo \\\"candidate manifest contains duplicated fields\\\" >&2\\n exit 1\\n fi\\n\\n grep -Fxq \\\"schema_version=1\\\" \\\"$manifest\\\" || {\\n echo \\\"candidate manifest has unsupported schema\\\" >&2\\n exit 1\\n }\\n grep -Fxq \\\"release_tag=$tag\\\" \\\"$manifest\\\" || {\\n echo \\\"candidate manifest is not bound to $tag\\\" >&2\\n exit 1\\n }\\n grep -Fxq \\\"source_sha=$expected_source_sha\\\" \\\"$manifest\\\" || {\\n echo \\\"candidate manifest is not bound to source commit $expected_source_sha\\\" >&2\\n exit 1\\n }\\n grep -Fxq \\\"asset_count=4\\\" \\\"$manifest\\\" || {\\n echo \\\"candidate manifest does not record the four supported binaries\\\" >&2\\n exit 1\\n }\\n```\\n\\n

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@scripts/release-install-smoke.sh` around lines 119 - 134, Update the Bash\\nmanifest validation before the existing schema_version, release_tag, source_sha,\\nand asset_count assertions to detect and reject duplicate manifest keys,\\nmatching the parsing behavior in the PowerShell validator. Ensure each required\\nfield appears exactly once while preserving the current field-value checks and\\nerror handling.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n✅ Addressed in commits 595e615 to 52d5667\",\"path\":\"scripts/release-install-smoke.sh\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\\n\\n

\\n

🧩 Analysis chain

\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\n# Description: Inspect how SHA256SUMS.txt entries are produced for published releases versus the staged bundle.\\nset -euo pipefail\\n\\nrg -n 'SHA256SUMS' --glob '!**/target/**' .\\nrg -n -C4 'sha256sum' .github/workflows scripts\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 10864\\n\\n---\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\nset -euo pipefail\\n\\necho \\\"== release workflow SHA256SUMS generation ==\\\"\\nsed -n '500,610p' .github/workflows/release.yml\\n\\necho \\\"== release-install-smoke.sh relevant lines ==\\\"\\nsed -n '160,210p' scripts/release-install-smoke.sh\\n\\necho \\\"== release-install-smoke.ps1 relevant lines ==\\\"\\nsed -n '197,223p' scripts/release-install-smoke.ps1\\n\\necho \\\"== install.sh matcher for comparison ==\\\"\\nsed -n '60,80p' scripts/install.sh\\n\\necho \\\"== deterministic regex/probe for current awk matcher ==\\\"\\npython3 - <<'PY'\\nimport re\\n\\nassets = [\\n \\\"shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\\\",\\n \\\"shiplog-x86_64-pc-windows-msvc.exe\\\",\\n \\\"shiplog-x86_64-darwin\\\",\\n \\\"foo/bar/with/slashes\\\",\\n]\\nentries = [\\n (\\\"sha\\\", \\\"shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\\\"),\\n (\\\"sha\\\", \\\"shiplog-x86_64-pc-windows-msvc.exe\\\"),\\n (\\\"sha\\\", \\\"shiplog-x86_64-darwin\\\"),\\n]\\n\\nasset_re = re.compile(r\\\"/\\\" + re.escape(assets[1]) + r\\\"$\\\")\\nfor asset in assets:\\n print(asset, bool(asset_re.search(asset)))\\n\\nprint(\\\"flat entry for public asset matches:\\\", asset_re.search(\\\"sha\\\" + \\\" \\\" + \\\"shiplog-x86_64-pc-windows-msvc.exe\\\"))\\nPY\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 9270\\n\\n---\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\nset -euo pipefail\\nsed -n '260,300p' .github/workflows/release.yml\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 1885\\n\\n---\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\nset -euo pipefail\\necho \\\"== release workflow upload assets section ==\\\"\\nsed -n '304,380p' .github/workflows/release.yml\\necho \\\"== inspect exact upload artifact paths, no regex ==\\\"\\nrg -n 'cd artifacts|expected=|upload-artifact|upload-release|asset_rel|ReleaseAsset|create.*release|SHA256SUMS.txt' .github/workflows/release.yml\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 6137\\n\\n---\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\nset -euo pipefail\\necho \\\"== create-release step ==\\\"\\nsed -n '200,240p' .github/workflows/release.yml\\necho \\\"== upload-assets step ==\\\"\\nsed -n '160,200p' .github/workflows/release.yml\\necho \\\"== any release asset creation elsewhere ==\\\"\\nrg -n -C 3 'create-release|upload-release|release_url|draft|tag_name|asset_name|filename|ReleaseAsset|gh release' .github/workflows/release.yml\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 5214\\n\\n---\\n\\n🏁 Script executed:\\n\\n```shell\\n#!/bin/bash\\nset -euo pipefail\\necho \\\"== scripts/release-install-smoke.sh public-mode asset selection ==\\\"\\nsed -n '1,150p' scripts/release-install-smoke.sh\\necho \\\"== environment flow around release-install-smoke.sh invocations ==\\\"\\nrg -n -C 5 'release-install-smoke\\\\.sh|SHIPLOG_RELEASE_SMOKE|candidate_dir|RELEASE_CANDIDATE_DIR|download_dir|base_url|platform|asset' .* scripts apps/docs 2>/dev/null || true\\n```\\n\\nRepository: EffortlessMetrics/shiplog-swarm\\n\\nLength of output: 50389\\n\\n---\\n\\n🌐 Web query:\\n\\n`GitHub release SHA256SUMS asset flat filenames gh release download SHA256SUMS.txt`\\n\\n💡 Result:\\n\\nWhen using the GitHub CLI (gh) to download assets, including a SHA256SUMS file, the tool handles filenames as they are explicitly named in the release [1][2]. There is no native \\\"flat filename\\\" or automatic directory flattening feature in the `gh release download` command that renames files [1][3]. The command downloads assets into the target directory (defaulting to the current directory) using their original names as published on GitHub [1][2]. Key points regarding asset management and verification: 1. Asset Naming: GitHub release assets are stored and downloaded with their precise, original filenames [4]. If a project publishes a SHA256SUMS file, it is downloaded as exactly that name [1][5]. 2. Manual Verification: Currently, `gh release download` does not have a built-in flag to automatically verify downloaded files against a provided SHA256SUMS file [6]. Users must download the checksum file separately and perform the verification using standard utilities like `sha256sum -c SHA256SUMS` [5]. 3. Native Digest Support: As of June 2025, GitHub computes and exposes SHA256 digests for all release assets via the GitHub API [7]. The `gh` CLI can access this metadata, but it is not used for automatic verification during the `gh release download` process [6][7]. 4. Automation Pattern: To download a specific SHA256SUMS file alongside other assets, you can use the `--pattern` flag [1][2]. For example: gh release download -p 'SHA256SUMS' -p '*.tar.gz' If you require a specific directory structure or renamed files, it is standard practice to handle this via shell scripting or a post-download command, rather than relying on the GitHub CLI to modify the filenames during the download process [8][5].\\n\\nCitations:\\n\\n- 1: https://cli.github.com/manual/gh_release_download\\n- 2: https://www.mankier.com/1/gh-release-download\\n- 3: https://fossies.org/linux/gh-cli/pkg/cmd/release/download/download.go\\n- 4: https://docs.github.com/en/rest/releases/assets\\n- 5: https://github.com/github/gh-ost/pull/1729\\n- 6: https://github.com/cli/cli/issues/13961\\n- 7: https://github.blog/changelog/2025-06-03-releases-now-expose-digests-for-release-assets/\\n- 8: https://alexwlchan.net/notes/2024/install-from-github-releases/\\n\\n---\\n\\n🌐 Web query:\\n\\n`github.com/EffortlessMetrics/shiplog/releases SHA256SUMS.txt asset names`\\n\\n💡 Result:\\n\\nThe SHA256SUMS.txt file included in the EffortlessMetrics/shiplog GitHub releases contains checksums for the following platform-specific binary assets [1][2][3][4]: shiplog-x86_64-unknown-linux-gnu shiplog-x86_64-apple-darwin shiplog-aarch64-apple-darwin shiplog-x86_64-pc-windows-msvc.exe These assets are consistently used across releases and are verified by scripts provided in the project documentation [1]. The SHA256SUMS.txt file itself is also included as a release asset [2][3][4].\\n\\nCitations:\\n\\n- 1: https://github.com/EffortlessMetrics/shiplog/blob/main/docs/install.md\\n- 2: https://github.com/EffortlessMetrics/shiplog/releases/tag/v0.5.0\\n- 3: https://github.com/EffortlessMetrics/shiplog/releases/tag/v0.4.0\\n- 4: https://github.com/EffortlessMetrics/shiplog/releases/tag/v0.3.0\\n\\n---\\n\\n\\n\\n

\\n\\n**Handle both flat and directory-prefixed `SHA256SUMS.txt` entries before searching.**\\n\\nThe public-path code downloads `https://github.com/$repo/releases/download/$tag/SHA256SUMS.txt`; published release checksums use flat filenames, so entries without `/` do not match `$2 ~ \\\"/\\\" asset \\\"$\\\"`. Use the basename match that `scripts/release-install-smoke.ps1` already uses, but escape the asset value in the awk regex.\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@scripts/release-install-smoke.sh` around lines 188 - 192, Update the checksum\\nlookup in the SHA256SUMS verification block to match both flat filenames and\\ndirectory-prefixed entries, reusing the basename-matching behavior from the\\nPowerShell smoke script. Escape the asset value before using it in the awk\\nregular expression, while preserving the existing missing-entry failure\\nbehavior.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n\",\"path\":\"scripts/release-install-smoke.sh\",\"side\":\"RIGHT\",\"line\":257}{\"type\":\"pull_request_comment\",\"body\":\"_🩺 Stability & Availability_ | _🟡 Minor_ | _⚡ Quick win_\\n\\n**Resolve `binary_path` to an absolute path before the `cd`.**\\n\\nThe subshell changes directory to `$cold_start_dir`, then invokes `\\\"$binary_path\\\"`. `binary_path` is derived from `work_dir`, which the documented `SHIPLOG_RELEASE_SMOKE_DIR` override at Line 17 can set to a relative path. In that case the invocation fails here with a confusing \\\"no such file\\\" error, even though the candidate binary is valid. The candidate path is already normalized this way at Line 168.\\n\\n

\\n

🐛 Proposed fix

\\n\\n```diff\\n echo \\\"==> structurally validating cold-start receipts\\\"\\n latest_run_name=\\\"$(basename \\\"$latest_run\\\")\\\"\\n+binary_path=\\\"$(cd -- \\\"$(dirname -- \\\"$binary_path\\\")\\\" && pwd)/$(basename -- \\\"$binary_path\\\")\\\"\\n (\\n cd \\\"$cold_start_dir\\\"\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@scripts/release-install-smoke.sh` around lines 259 - 264, Normalize\\n`binary_path` to an absolute path before the subshell changes directories,\\nmatching the existing candidate-path normalization pattern near the release\\nsmoke setup. Ensure the invocation in the `cold_start_dir` subshell uses that\\nabsolute `binary_path` while preserving the current validation arguments.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n\",\"path\":\"scripts/release-install-smoke.sh\",\"side\":\"RIGHT\",\"line\":329}{\"type\":\"pull_request_comment\",\"body\":\"**Actionable comments posted: 11**\\n\\n> [!CAUTION]\\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\\n> \\n> \\n> \\n>

\\n>

⚠️ Outside diff range comments (1)

\\n> \\n>
\\n>
.github/workflows/release.yml (1)
\\n> \\n> `304-316`: _🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\\n> \\n> **Align candidate retention with the receipt retention.**\\n> \\n> The staged candidate set expires after 5 days. The readiness receipt at Line 732 is retained for 30 days and records `candidate_artifact_id` and `candidate_artifact_digest`. For 25 of those days the receipt names bytes that no longer exist, so a human cannot re-verify the digest before authorizing publication.\\n> \\n> Set `retention-days` here to match the receipt, or shorten the receipt retention.\\n> \\n>
\\n>
🤖 Prompt for AI Agents
\\n> \\n> ```\\n> Verify each finding against current code. Fix only still-valid issues, skip the\\n> rest with a brief reason, keep changes minimal, and validate.\\n> \\n> In @.github/workflows/release.yml around lines 304 - 316, Update the\\n> retention-days setting in the “Retain exact staged release candidates” step to\\n> 30 days, matching the readiness receipt retention and preserving candidate\\n> artifacts for the full verification window.\\n> ```\\n> \\n>
\\n> \\n> \\n> \\n>
\\n> \\n>

\\n\\n

\\n

🤖 Prompt for all review comments with AI agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nInline comments:\\nIn @.github/workflows/release.yml:\\n- Around line 516-526: Add an exact-commit verification step immediately after\\nthe checkout step in the job containing “Checkout release scripts,” comparing\\ngit rev-parse HEAD with needs.release-preflight.outputs.release_sha and failing\\non mismatch. Keep the existing artifact download and release-install-smoke.sh\\nflow unchanged.\\n- Around line 286-296: Update the release candidate metadata generation around\\nRELEASE_CANDIDATE.txt to derive asset_count from the expected asset array\\ndefined earlier in the workflow instead of hardcoding 4. Ensure the computed\\ncount is written to the asset_count field so validators and smoke tests reflect\\nevery configured target.\\n- Around line 254-257: Update every actions/download-artifact reference in the\\nrelease workflow, including the steps named “Download all binary artifacts” and\\nthe other listed usages, to the immutable commit SHA\\n3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c and retain a # v8 comment on each\\nreference.\\n- Around line 228-230: Update the release workflow step’s shell commands so both\\nhandoff messages, including the statement that Swarm cannot create a GitHub\\nrelease, are appended to GITHUB_STEP_SUMMARY rather than only printed to stdout.\\nPreserve the existing message text and ordering.\\n\\nIn `@apps/shiplog/tests/release_candidate_smoke.rs`:\\n- Around line 101-107: In the release-candidate smoke test, update the\\nfilesystem operations around the Unix permission setup and the additional sites\\nnear lines 209, 229, 231, 253, and 255 to attach context before propagating\\nerrors. Use static .context descriptions for fixed operations and .with_context\\nclosures with the relevant path for dynamic operations, covering metadata,\\nset_permissions, and other bare filesystem ? calls while preserving the existing\\nbehavior.\\n- Around line 246-248: Update scripts/release-install-smoke.ps1 to emit the\\ndistinct “candidate binary failed --version” signal when the candidate command\\nexits with a nonzero $LASTEXITCODE, while retaining “unexpected version output”\\nfor successful commands with mismatched output. Then remove the #[cfg(unix)]\\ngate from staged_candidate_smoke_rejects_broken_command_with_matching_checksum\\nso the same rejection assertion runs on Windows.\\n- Around line 16-21: Move CandidateFixture and candidate_fixture() out of\\nrelease_candidate_smoke.rs into the reusable shiplog-testkit::fixtures module or\\nan appropriate release-scenario submodule. Preserve the existing\\nrelease-candidate metadata and bundle setup, then update the smoke test imports\\nand usages to reference the shared fixture implementation.\\n\\nIn `@scripts/release-install-smoke.ps1`:\\n- Around line 66-73: Rename the local $matches collection in the candidate\\nbundle lookup to a non-automatic variable, and update its Count, error message,\\nand index references consistently; leave the Assert-CandidateManifest -notmatch\\nusage unchanged.\\n\\nIn `@scripts/release-install-smoke.sh`:\\n- Around line 259-264: Normalize `binary_path` to an absolute path before the\\nsubshell changes directories, matching the existing candidate-path normalization\\npattern near the release smoke setup. Ensure the invocation in the\\n`cold_start_dir` subshell uses that absolute `binary_path` while preserving the\\ncurrent validation arguments.\\n- Around line 119-134: Update the Bash manifest validation before the existing\\nschema_version, release_tag, source_sha, and asset_count assertions to detect\\nand reject duplicate manifest keys, matching the parsing behavior in the\\nPowerShell validator. Ensure each required field appears exactly once while\\npreserving the current field-value checks and error handling.\\n- Around line 188-192: Update the checksum lookup in the SHA256SUMS verification\\nblock to match both flat filenames and directory-prefixed entries, reusing the\\nbasename-matching behavior from the PowerShell smoke script. Escape the asset\\nvalue before using it in the awk regular expression, while preserving the\\nexisting missing-entry failure behavior.\\n\\n---\\n\\nOutside diff comments:\\nIn @.github/workflows/release.yml:\\n- Around line 304-316: Update the retention-days setting in the “Retain exact\\nstaged release candidates” step to 30 days, matching the readiness receipt\\nretention and preserving candidate artifacts for the full verification window.\\n```\\n\\n

\\n\\n

\\n

🪄 Autofix

\\n\\nFix all unresolved CodeRabbit comments on this PR:\\n\\n- [ ] Push a commit to this branch (recommended)\\n- [ ] Create a new PR with the fixes\\n\\n

\\n\\n---\\n\\n

\\n

ℹ️ Review info

\\n\\n

\\n

⚙️ Run configuration

\\n\\n**Configuration used**: Organization UI\\n\\n**Review profile**: ASSERTIVE\\n\\n**Plan**: Pro Plus\\n\\n**Run ID**: `3dd83058-a03d-4c42-9260-fb97321a663a`\\n\\n

\\n\\n

\\n

📥 Commits

\\n\\nReviewing files that changed from the base of the PR and between b816b6032e85ed698ae34ac1d60974cd6f8b8f53 and a54884d2f0b2660bd57b301504dce8df7f7cab5e.\\n\\n

\\n\\n

\\n

📒 Files selected for processing (4)

\\n\\n* `.github/workflows/release.yml`\\n* `apps/shiplog/tests/release_candidate_smoke.rs`\\n* `scripts/release-install-smoke.ps1`\\n* `scripts/release-install-smoke.sh`\\n\\n

\\n\\n

\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"[P1] Assert the negative-control checkout resolves the preflight SHA\\n\\nFailure mode:\\nThe `release-candidate-negative-controls` job checks out `${{ needs.release-preflight.outputs.release_tag }}` and immediately runs `scripts/release-install-smoke.sh`, but never compares `git rev-parse HEAD` with `${{ needs.release-preflight.outputs.release_sha }}`. If the tag resolution changes between preflight and this job, the negative controls can execute a different release-script revision while reporting evidence for the preflight candidate.\\n\\nWhy here:\\nThis PR's core contract is one immutable exact-tag candidate set. Every job that executes release scripts must prove the checkout identity, not only the artifact manifest identity.\\n\\nFix direction:\\nAdd the same exact-commit assertion used by the other release jobs immediately after the checkout:\\n`test \\\"$(git rev-parse HEAD)\\\" = \\\"${{ needs.release-preflight.outputs.release_sha }}\\\"`.\\nRetain the existing staged-artifact and negative-control assertions.\\n\\nValidation:\\nExercise a tag/ref mismatch fixture or equivalent workflow proof and confirm the negative-control job fails before invoking either smoke script.\\n\\nConfidence:\\nHigh; inspected current head `595e6152c3370c85a069caf9f12b5264c2d5c1ce`, `.github/workflows/release.yml:516-520`.\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"@codex review\\n\\nPlease review the current final head, especially exact tag/source/artifact binding, complete four-platform bundle validation, failure controls, matrix consumption of staged bytes, and the terminal readiness aggregate.\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Bind tag-push resolution to the triggering commit**\\n\\nFailure mode: On a tag-push run, this force-fetch resolves the tag from its current remote value instead of binding it to the triggering `github.sha`; if the tag is moved after the webhook is created but before preflight executes, the workflow can build and certify a different commit while still reporting success for the original tag event. Why here: every downstream comparison uses the newly resolved `release_sha`, so none detects this initial substitution. Fix direction: for `push` events, require the peeled tag commit to equal the event SHA (while retaining current-tag resolution for approved manual dispatches). Validation: trigger a run and retarget the tag before this fetch, then verify preflight rejects the mismatch. Confidence: high. This is particularly important because tag and release operations remain source-repository authority.\\n\\nAGENTS.md reference: [AGENTS.md:L14-L17](https://github.com/EffortlessMetrics/shiplog-swarm/blob/46fd16c469eca8eae4420a9c1d6980aa922bfbf8/AGENTS.md#L14-L17)\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":73}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `46fd16c469`\\n \\n\\n

ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_653":1926,"_632":633,"_655":639},{"_656":1927,"_658":-5,"_42":-5,"_660":1928,"_662":-5,"_97":432,"_93":664},[1929],{"_665":639},{"_46":1922,"_93":688},{"_653":1931,"_632":633,"_655":639},{"_656":1932,"_658":-5,"_42":-5,"_660":1933,"_662":-5,"_97":432,"_93":664},[1934,1935],{"_665":639},{"_46":1937,"_93":688},{"_46":1936,"_93":688},"\n /workspace/shiplog-swarm\n bash\n 2026-08-04\n Etc/UTC\n /workspace/shiplog-swarm\n","# AGENTS.md instructions for /workspace/shiplog-swarm\n\n\n# Agent Context for shiplog\n\nThis file provides guidance for AI agents and code review automation (Factory Droid) working in this repository.\n\n## Development Control Plane\n\nNormal development now targets `EffortlessMetrics/shiplog-swarm`.\n\nUse `EffortlessMetrics/shiplog-swarm` for focused product, docs, tests, CI,\npolicy, and cleanup PRs. Squash-merge normal swarm PRs after\n`Shiplog Rust Small Result` passes. Do not push directly to\n`shiplog-swarm/main`.\n\n`EffortlessMetrics/shiplog` remains the release/public source surface until an\nexplicit release-authority cutover. It owns tags, crates.io publish, GitHub\nReleases, signing, release branches, release workflows, and security-sensitive\ntoken operations.\n\nWhen working from a checkout that has both remotes:\n\n```bash\ngit fetch origin --prune\ngit fetch swarm --prune\ngit switch -c swarm/main\n```\n\nPush normal development branches to `swarm` and open PRs against\n`EffortlessMetrics/shiplog-swarm/main`. Do not retarget an existing\n`EffortlessMetrics/shiplog` clone in place for new normal work; clone\n`shiplog-swarm` side-by-side when setting up a fresh agent or machine.\n\nPromotion from swarm back to source uses a regular merge-commit PR into\n`EffortlessMetrics/shiplog/main`, not a squash merge. A promotion PR should\ninclude the swarm head SHA, included swarm PRs, and proof that\n`Shiplog Rust Small Result` passed. Use\n[`plans/shiplog-swarm/promotion-runbook.md`](plans/shiplog-swarm/promotion-runbook.md)\nfor the exact promotion sequence.\n\n## Code Review Standards\n\n### Finding Format\n\nUse this structure for actionable findings:\n\n```\n[P0|P1|P2] Short title\n\nFailure mode:\nWhy here:\nFix direction:\nValidation:\nConfidence:\n```\n\n### Clean Review Format\n\nWhen no actionable findings are emitted:\n\n```\nNo actionable findings emitted.\nInspected surfaces:\nChecks performed:\nWhy no comments:\nResidual risk:\nValidation signal:\n Observed:\n Reported:\n Not verified:\n```\n\n### Review Principles\n\n- **No naked LGTM**: Approval requires explicit validation signals\n- **No arbitrary comment cap**: All identified issues are reported\n- **No extra @mentions**: Findings are directed only to the PR author and reviewers\n- **Actionable findings**: Issues are repair packets with clear fix direction\n- **Clean reviews**: Include inspection record with evidence provenance\n- **Evidence split**: Observed (from running code/tests) / Reported (from tool/CI output) / Not verified (unconfirmed claims)\n- **PR-body validation claims**: Not treated as independently verified; require confirmation\n\n## Droid Automation\n\n### Auto Review\n\nDroid auto-reviews all non-draft PRs from the same repository.\n\n- Trigger: `pull_request` (opened, synchronize, ready_for_review, reopened)\n- Guard: Same-repo origin only; [skip-review] tag bypasses\n- Permissions: `contents: write` (for review publication)\n- Model: `custom:MiniMax-M3-0`\n- Depth: `shallow`\n- Secrets: `FACTORY_API_KEY` and `MINIMAX_API_KEY`; runs skip if either is unavailable\n- No raw debug artifacts uploaded\n\n### Manual @droid Commands\n\nTrusted actors (OWNER, MEMBER, COLLABORATOR) can invoke Droid manually:\n\n```\n@droid review # Request code review\n@droid security # Request security analysis\n```\n\n- Guard: Author must be trusted actor\n- Permissions: `contents: read` (manual requests are read-only)\n- Model: `custom:MiniMax-M3-0`\n- Depth: `shallow`\n- Secrets: `FACTORY_API_KEY` and `MINIMAX_API_KEY`; runs skip if either is unavailable\n\n### Scheduled Security Scan\n\nWeekly Monday 08:00 UTC full repository security scan.\n\n- Trigger: Schedule + manual workflow dispatch\n- Permissions: `contents: write` (for scan report publication)\n- Model: `custom:MiniMax-M3-0`\n- Threshold: Medium\n- Secrets: `FACTORY_API_KEY` and `MINIMAX_API_KEY`; runs skip if either is unavailable\n- Critical issues block; High issues reported only\n\n## References\n\n- Droid action: `EffortlessMetrics/droid-action-safe@7c1377ccbacddc95560d1570547a5baa51de01ec`\n- MiniMax model: `custom:MiniMax-M3-0`\n- LLM provider: Anthropic API (via MiniMax BYOK bridge)\n\n",{"_653":1939,"_632":633,"_655":639},{"_656":1940,"_658":-5,"_42":-5,"_660":1941,"_662":-5,"_97":1942,"_93":664},[1943],{"_665":639},"developer",{"_46":1944,"_93":688},"Do not spawn sub-agents unless the user or applicable AGENTS.md/skill instructions explicitly ask for sub-agents, delegation, or parallel agent work.",{"_653":1946,"_632":633,"_655":639},{"_656":1947,"_658":-5,"_42":-5,"_660":1948,"_662":-5,"_97":1942,"_93":664},[1949],{"_665":639},{"_46":1950,"_93":688},"You are `/root`, the primary agent in a team of agents collaborating to fulfill the user's goals.\n\nAt the start of your turn, you are the active agent.\nYou can spawn sub-agents to handle subtasks, and those sub-agents can spawn their own sub-agents.\nAll agents in the team, including the agents that you can assign tasks to, are equally intelligent and capable, and have access to the same set of tools.\n\nYou can use `spawn_agent` to create a new agent, `followup_task` to give an existing agent a new task and trigger a turn, and `send_message` to pass a message to a running agent without triggering a turn.\nChild agents can also spawn their own sub-agents.\nYou can decide how much context you want to propagate to your sub-agents with the `fork_turns` parameter.\n\nYou will receive messages in the analysis channel in the form:\n```\nMessage Type: MESSAGE | FINAL_ANSWER\nTask name: \nSender: \nPayload:\n\n```\nThey may be addressed as to=/root\n\nNote that collaboration tools cannot be called from inside `functions.exec`. Call `spawn_agent`, `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents` only as direct tool calls using the recipient shown in their tool definitions, such as `to=functions.collaboration.spawn_agent`, since they are intentionally absent from the `functions.exec` `tools.*` namespace. Available tools in `functions.exec` are explicitly described with a `tools` namespace in the developer message.\n\nAll agents share the same directory. In detail:\n- All agents have access to the same container and filesystem as you.\n- All agents use the same current working directory.\n- As a result, edits made by one agent are immediately visible to all other agents.\n\nThere are 4 available concurrency slots, meaning that up to 4 agents can be active at once, including you.",{"_653":1952,"_632":633,"_655":639},{"_656":1953,"_658":-5,"_42":-5,"_660":1954,"_662":-5,"_97":1942,"_93":664},[1955,1956],{"_665":639},{"_46":1958,"_93":688},{"_46":1957,"_93":688},"\n## Skills\nA skill is a set of instructions provided through a `SKILL.md` source. Below is the list of skills that can be used. Each entry includes a name, description, and source locator. `file` locators are on the host filesystem, `environment resource` locators are owned by an execution environment, `orchestrator resource` locators are opaque non-filesystem resources, and `custom resource` locators use their provider's access mechanism.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs, asks about Codex itself or choosing Codex surfaces, needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; use OpenAI docs MCP tools for non-Codex docs questions, use the Codex manual helper first for broad Codex self-knowledge, and restrict fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a new personal plugin, add optional plugin structure, generate or update marketplace entries for plugin ordering and availability metadata, or update an existing local plugin during development with the CLI-driven cachebuster and reinstall flow. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_632":633,"_88":1961},{"_104":-5,"_42":639,"_640":1962,"_642":643,"_644":645,"_646":1963},[],"inProgress",{"_646":1965,"_632":633},{"_1966":1967,"_93":1968},"activeFlags",[],"active","thread/started",{"_1971":1972},"thread",{"_1973":-5,"_1974":-5,"_1975":1976,"_1977":645,"_698":699,"_1978":15,"_1979":-5,"_1980":-5,"_1981":-5,"_1982":1983,"_42":633,"_1984":1985,"_291":-5,"_1986":-5,"_214":1987,"_1988":305,"_1989":645,"_1990":633,"_704":1991,"_646":1992,"_1993":-5,"_78":1994,"_1995":645},"agentNickname","agentRole","cliVersion","0.144.0-alpha.4","createdAt","ephemeral","extra","forkedFromId","gitInfo","historyMode","legacy","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/08/04/rollout-2026-08-04T10-55-49-019fcc6a-586d-7412-9dec-476ff726be13.jsonl","preview","recencyAt","sessionId","vscode",{"_93":650},"threadSource",[],"updatedAt",[],"messages",[1999],{"_42":2000,"_2001":2002,"_2003":2004,"_2005":2004,"_656":2006,"_646":2007,"_658":-5,"_2008":32,"_2009":2010,"_2011":406,"_2012":-5},"4717ea5d-f4c8-4e0f-8fba-a7ccc2b213a2","author",{"_97":432,"_291":-5,"_2009":2021},"create_time",1785840947.744157,"update_time",{"_2017":46,"_2018":2019},"finished_successfully","weight","metadata",{"_2013":2014},"recipient","channel","l1239dk1",{"_2015":2016},"inline_comments",[],"content_type","parts",[2020],"@codex address that feedback\n\nAddress the current workflow-only findings without broadening scope:\n\n1. Pin all four `actions/download-artifact@v8` uses to official v8.0.1 commit `3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` with a version comment.\n2. In `create-release`, always write the general verification-only summary; keep the pull-request-specific warning additive.\n3. Derive `asset_count` from the `expected` array when generating `RELEASE_CANDIDATE.txt`; pass GitHub expression values through step `env` variables rather than embedding them directly in the shell body.\n4. In `release-candidate-negative-controls`, confirm `git rev-parse HEAD` equals the exact `release-preflight.outputs.release_sha` before using scripts from the checkout.\n\nDo not move the release fixture to `shiplog-testkit`; that private integration target deliberately exercises repository scripts and workflow-adjacent behavior, and moving it would add an unrelated crate dependency/public seam. Do not merge or mark the PR ready.\nfix(release): prove one staged candidate set before publication\n\n## What changed\n\nImplements the still-open staged-artifact portion of #245 in the authoritative development repository.\n\n### One exact candidate set\n\n- `release-preflight` resolves both the explicit semver tag and its exact 40-character commit SHA;\n- every build and downstream job proves it checked out that exact commit;\n- `Stage Release Candidates` assembles exactly one copy of all four platform binaries, deterministic `SHA256SUMS.txt`, and a bounded `RELEASE_CANDIDATE.txt` manifest containing tag, source SHA, repository, workflow run identity, asset count, and checksum-manifest digest;\n- the retained `verified-release-candidates` workflow artifact exposes its artifact id/digest and manifest hashes to downstream jobs.\n\n### Acceptance consumes staged bytes\n\n- Linux, macOS Intel, macOS Apple Silicon, and Windows first-use jobs now wait for candidate staging and download the same `verified-release-candidates` artifact;\n- Bash and PowerShell smoke scripts accept `SHIPLOG_RELEASE_CANDIDATE_DIR` plus exact `SHIPLOG_RELEASE_SOURCE_SHA`, require the complete four-binary bundle, validate manifest identity/checksums, and exercise the local candidate from an empty directory with provider credentials cleared;\n- public-release download mode remains available for post-publication verification;\n- each platform uploads produced receipts and diagnostics even on failure.\n\n### Fail-closed release authority\n\n- a Linux negative-control job corrupts the staged binary without changing checksums and proves the gate rejects it;\n- a second control replaces the binary with a failing executable, updates checksums consistently, and proves command execution still rejects it;\n- terminal `Release Candidate Ready` requires preflight, staging, release validation, all four first-use lanes, both negative controls, and release-mode tests;\n- it emits a durable receipt with exact tag/source/artifact/manifests and states that publication still requires explicit source-side human authority.\n\n### Ordinary PR proof\n\nA new cross-platform integration target synthesizes the complete four-platform candidate bundle from the cargo-built test binary and drives the real Bash or PowerShell smoke script. It proves:\n\n- local staged-candidate success and retained first-use receipts;\n- checksum corruption fails before execution; and\n- on Unix, a broken executable with a matching checksum still fails the command boundary.\n\n## Why\n\nPR #273 correctly added structural validation for all five first-use receipt artifacts, but explicitly left candidate staging, exact uploaded-byte consumption, four-lane publication gating, and rollback outside scope. The current workflow allowed first-use jobs to race asset upload and the smoke scripts fetched release URLs independently, so the jobs were not bound to one workflow-staged candidate set.\n\nThis PR closes that implementation gap on the swarm verification surface. It does not add release-write authority to swarm.\n\n## Review map\n\n- `.github/workflows/release.yml` — exact tag binding, candidate assembly, matrix consumption, diagnostics, negative controls, and terminal authority.\n- `scripts/release-install-smoke.sh` — complete local candidate-bundle mode plus public release mode, manifest/checksum validation, and explicit command-failure diagnostics.\n- `scripts/release-install-smoke.ps1` — Windows parity for the same contract.\n- `apps/shiplog/tests/release_candidate_smoke.rs` — normal-PR execution proof for success, checksum failure, and command failure.\n\n## Expected proof\n\n```bash\nbash -n scripts/release-install-smoke.sh\npwsh -NoProfile -Command '$null = [scriptblock]::Create((Get-Content scripts/release-install-smoke.ps1 -Raw))'\ncargo fmt --all -- --check\ncargo clippy -p shiplog --all-targets --locked -- -D warnings\ncargo test -p shiplog --test release_candidate_smoke --locked\ncargo xtask check-workflows --mode blocking-allowlist\ncargo xtask check-file-policy --mode blocking-allowlist\ncargo xtask ci-small\ngit diff --check\n```\n\nA real release proof additionally requires one explicit tag/owner-approved workflow run whose four first-use jobs consume the same staged artifact and whose `Release Candidate Ready` job is green.\n\n## Source handoff\n\n`.github/workflows/release.yml` is deliberately source-owned governance. After this shared implementation is merged and promoted, canonical source must port the bounded source-writer counterpart: draft GitHub Release creation/upload may remain source-only, but its four acceptance lanes must consume this same staged candidate set and final publication must remain human-authorized.\n\n## Claim boundary\n\nThis prepares and proves release candidates in `shiplog-swarm`. It does not create or publish a GitHub Release, publish crates.io, push or move a tag, sign/notarize artifacts, update Homebrew/Scoop, change the current promotion state, or move release authority from `EffortlessMetrics/shiplog`.\n\n## Rollback\n\nRevert the squash merge. Public release download mode remains unchanged; no tag, release, crate, package channel, or source branch is mutated by this PR.\n\nRefs #245. Keep #245 open until the source writer counterpart lands and one exact explicit-tag run records all four target results plus a green `Release Candidate Ready` receipt.\n\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/EffortlessMetrics/shiplog-swarm/pull/391?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\n\n\n> [!WARNING]\n> ## Review limit reached\n> \n> `@EffortlessSteven`, you've reached your PR review limit, so we couldn't start this review.\n> \n> **Next review available in:** **34 minutes**\n> \n> You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.\n> \n>

\n>

How can I continue?

\n> \n> After more reviews become available, a review can be triggered using the `@coderabbitai review` command as a PR comment. Alternatively, push new commits to this PR.\n> \n> To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.\n> \n>

\n> \n> \n>

\n>

How do review limits work?

\n> \n> CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.\n> \n> For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.\n> \n> Please refer [docs](https://docs.coderabbit.ai/management/plans#rate-limits) for additional details.\n> \n>

\n> \n>

\n>

Review details

\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: Organization UI\n> \n> **Review profile**: ASSERTIVE\n> \n> **Plan**: Pro Plus\n> \n> **Run ID**: `b08ea09d-1c36-4ad2-bf5d-c9f5b1724c39`\n> \n>

\n> \n>

\n>

📥 Commits

\n> \n> Reviewing files that changed from the base of the PR and between a54884d2f0b2660bd57b301504dce8df7f7cab5e and 52d56676c07cf11b1e9a7d4f0b4b9039253d28d2.\n> \n>

\n> \n>

\n>

📒 Files selected for processing (3)

\n> \n> * `apps/shiplog/tests/release_candidate_smoke.rs`\n> * `scripts/release-install-smoke.ps1`\n> * `scripts/release-install-smoke.sh`\n> \n>

\n> \n>

\n\n\n\n\n\n\n\n## Summary by CodeRabbit\n\n* **New Features**\n * Added comprehensive release-candidate verification across supported platforms before publication.\n * Added staged-bundle testing for installation, checksums, metadata, and executable startup.\n * Added release readiness records summarizing validation results.\n\n* **Bug Fixes**\n * Releases are now verified against the exact source revision used to build them.\n * Invalid, corrupted, incomplete, or non-functional release packages are rejected before publication.\n\n* **Documentation**\n * Updated installation verification guidance and status messages for staged and published releases.\n\n\n## Walkthrough\n\nThe release workflow now binds all jobs to an immutable commit, stages a four-platform candidate, validates candidate metadata and binaries, performs first-use acceptance, checks negative controls, and records a readiness receipt before human-authorized publication.\n\n### Changes\n\n**Release candidate workflow**\n\n|Layer / File(s)|Summary|\n|---|---|\n|**Immutable source and candidate staging**
`.github/workflows/release.yml`|Preflight resolves and exports the exact release commit. Build and staging jobs verify that commit. The workflow creates deterministic candidate assets, checksums, and manifest metadata.|\n|**Candidate manifest and smoke validation**
`.github/workflows/release.yml`, `scripts/release-install-smoke.sh`, `scripts/release-install-smoke.ps1`|Validation supports staged candidates and public releases. Candidate manifests, source SHAs, required assets, checksum digests, versions, commands, and receipts are checked.|\n|**Cross-platform acceptance and negative controls**
`.github/workflows/release.yml`, `apps/shiplog/tests/release_candidate_smoke.rs`|Acceptance jobs test staged candidates on four platforms. Tests and negative controls reject incomplete bundles, corrupted checksums, and executables that fail during use.|\n|**Readiness receipt and publication gate**
`.github/workflows/release.yml`|The workflow requires all release gates, records candidate and artifact digests in a readiness receipt, and retains the receipt while publication remains human-authorized.|\n\n**Estimated code review effort:** 5 (Critical) | ~90 minutes\n\n**Possibly related issues**\n\n- EffortlessMetrics/shiplog-swarm#245 — The PR implements staged exact-binary, four-platform first-use acceptance and release-readiness gates.\n- EffortlessMetrics/shiplog-swarm#246 — The PR implements immutable staging, first-use acceptance, negative controls, and terminal readiness gating.\n\n**Possibly related PRs**\n\n- [EffortlessMetrics/shiplog-swarm#273](https://github.com/EffortlessMetrics/shiplog-swarm/pull/273) — Both changes update the release smoke scripts and receipt validation used during cold-start checks.\n\n**Poem**\n\n> A rabbit checks each checksum bright, \n> Four platforms run through the night. \n> Bad bytes hop out, failed tools flee, \n> Receipts rest by the release tree. \n> The final gate waits for human cheer.\n\n\n\n\n

🚥 Pre-merge checks | ✅ 5

\n\n

✅ Passed checks (5 passed)

\n\n

\n\n\n\n\n

✨ Finishing Touches

\n\n

📝 Generate docstrings

\n\n- [ ] Create stacked PR\n- [ ] Commit on current branch\n\n

🧪 Generate unit tests (beta)

\n\n- [ ] Create PR with unit tests\n- [ ] Commit unit tests in branch `fix/release-staged-candidate-gate`\n\n

\n\n

\n\n\n\n\n---\n\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=EffortlessMetrics/shiplog-swarm&utm_content=391)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\n\n

❤️ Share

\n\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\n\n

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands.}\n\n\n## CI budget acknowledgement\n\nThe PR planner selected the release-package, workflow-policy, and CLI-product risk packs: 11 lanes at an estimated ~165 LEM, placing this in the hard band. `ci-budget-override` is applied deliberately.\n\nThe spend is justified because this PR changes the exact release artifact trust boundary, platform smoke scripts, workflow policy surface, and cross-platform integration proof together. Splitting the workflow from the scripts/tests would create an intermediate contract that cannot prove the bytes it selects and would run overlapping release/policy lanes multiple times.\n\nSkipped nightly, coverage, mutation, and release-only lanes are not claimed as executed proof. A real explicit-tag run remains required before #245 can close.\n[P1] Make the staged-candidate success path pass receipt validation\n\nFailure mode:\nThe exact-head hosted `Shiplog Rust Small Result` run for this PR fails `staged_candidate_smoke_uses_local_bundle_and_emits_receipts`: `report validate --path \"$latest_run/intake.report.json\" --receipts` rejects the generated report because `reports.json` points at `.../out/merge_.../out/merge_.../intake.report.json` while the validated file is `.../out/merge_.../intake.report.json`.\n\nWhy here:\nThe new staged-candidate smoke contract makes this validation a required release gate at `scripts/release-install-smoke.sh:258`, so the PR's exact hosted gate is currently red even though the other three new tests pass.\n\nFix direction:\nAlign the receipt path contract used by the cold-start command and `report validate --receipts`—either emit the canonical run-relative path expected by the validator or resolve an already run-rooted path without prepending `out/` again. Keep the regression in `release_candidate_smoke` so this exact candidate path stays green.\n\nValidation:\nRerun `cargo test -p shiplog --test release_candidate_smoke --locked` and the routed `Shiplog Rust Small Result` check on the updated exact head.\n\nConfidence:\nHigh; reproduced in hosted run 30899824202, job 91961327124.\n_📐 Maintainability & Code Quality_ | _🟡 Minor_ | _⚡ Quick win_\n\n**Send both handoff lines to the step summary.**\n\nLine 229 writes to stdout only. The recorded summary therefore omits the statement that Swarm cannot create a GitHub release, which is the point of this receipt.\n\n

🧹 Proposed fix

\n\n```diff\n run: |\n- echo \"Swarm verifies release inputs but cannot create a GitHub release.\"\n- echo \"Promote this exact proven tree to EffortlessMetrics/shiplog for authorized release execution.\" >> \"$GITHUB_STEP_SUMMARY\"\n+ set -euo pipefail\n+ {\n+ echo \"Swarm verifies release inputs but cannot create a GitHub release.\"\n+ echo \"Promote this exact proven tree to EffortlessMetrics/shiplog for authorized release execution.\"\n+ } >> \"$GITHUB_STEP_SUMMARY\"\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/release.yml around lines 228 - 230, Update the release\nworkflow step’s shell commands so both handoff messages, including the statement\nthat Swarm cannot create a GitHub release, are appended to GITHUB_STEP_SUMMARY\nrather than only printed to stdout. Preserve the existing message text and\nordering.\n```\n\n

\n\n\n\n\n\n\n\n\n_🔒 Security & Privacy_ | _🟠 Major_ | _⚡ Quick win_\n\n

🧩 Analysis chain

\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\n# Description: List action pinning style in release.yml and resolve the download-artifact v8 commit SHA.\nset -euo pipefail\n\nrg -n 'uses: ' .github/workflows/release.yml\n\n# Test: resolve the tag to an immutable commit SHA for pinning.\ngh api repos/actions/download-artifact/git/ref/tags/v8 --jq '.object'\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 2110\n\n---\n\n\n\n

\n\n\n\n**Security Misconfiguration (CWE-1357)**\n\n**Reachability:** Internal\n\n**Pin `actions/download-artifact` to a commit SHA.**\n\nThe release workflow pins its Action references to immutable commit SHAs, but `actions/download-artifact@v8` is used at lines 255, 349, 479, and 523. Use the `v8` commit SHA (`3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`) with a `# v8` comment for each reference so the tag cannot be repointed.\n\n

🧰 Tools

\n\n

🪛 zizmor (1.28.0)

\n\n[error] 255-255: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)\n\n(unpinned-uses)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/release.yml around lines 254 - 257, Update every\nactions/download-artifact reference in the release workflow, including the steps\nnamed “Download all binary artifacts” and the other listed usages, to the\nimmutable commit SHA 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c and retain a # v8\ncomment on each reference.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Linters/SAST tools_\n\n\n_🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Derive `asset_count` from the `expected` array.**\n\nLine 293 hardcodes `asset_count=4` while Lines 266-271 define the real asset list. If a fifth target is added to the matrix and to `expected`, the manifest still reports 4. The validators at Line 361, `scripts/release-install-smoke.sh` Line 131, and `scripts/release-install-smoke.ps1` Line 119 all accept `4`, so the incomplete claim passes silently. Deriving the count makes that mismatch fail loudly.\n\n

♻️ Proposed refactor

\n\n```diff\n- asset_count=4\n+ asset_count=${`#expected`[@]}\n```\n

\n\n\n\n

📝 Committable suggestion

🧰 Tools

\n\n

🪛 zizmor (1.28.0)

\n\n[info] 288-288: code injection via template expansion (template-injection): may expand into attacker-controllable code\n\n(template-injection)\n\n---\n\n[info] 289-289: code injection via template expansion (template-injection): may expand into attacker-controllable code\n\n(template-injection)\n\n---\n\n[warning] 290-290: code injection via template expansion (template-injection): may expand into attacker-controllable code\n\n(template-injection)\n\n---\n\n[warning] 291-291: code injection via template expansion (template-injection): may expand into attacker-controllable code\n\n(template-injection)\n\n---\n\n[warning] 292-292: code injection via template expansion (template-injection): may expand into attacker-controllable code\n\n(template-injection)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/release.yml around lines 286 - 296, Update the release\ncandidate metadata generation around RELEASE_CANDIDATE.txt to derive asset_count\nfrom the expected asset array defined earlier in the workflow instead of\nhardcoding 4. Ensure the computed count is written to the asset_count field so\nvalidators and smoke tests reflect every configured target.\n```\n\n

\n\n\n\n\n\n\n\n\n_🗄️ Data Integrity & Integration_ | _🟡 Minor_ | _⚡ Quick win_\n\n**Add the exact-commit confirmation to this job.**\n\nEvery other job that checks out the tag also asserts `git rev-parse HEAD` equals `needs.release-preflight.outputs.release_sha`: Lines 147, 216, 252, 346, 476, and 622. This job omits that assertion, yet it executes `scripts/release-install-smoke.sh` from the checked-out tree. If the tag is moved between preflight and this job, the negative controls run against different script bytes than the ones the acceptance lane proved, and the readiness gate at Line 656 still reports success.\n\n

🔒️ Proposed fix

\n\n```diff\n persist-credentials: false\n ref: ${{ needs.release-preflight.outputs.release_tag }}\n \n+ - name: Confirm exact release commit\n+ shell: bash\n+ run: test \"$(git rev-parse HEAD)\" = \"${{ needs.release-preflight.outputs.release_sha }}\"\n+\n - name: Download exact staged candidate set\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n - name: Checkout release scripts\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n ref: ${{ needs.release-preflight.outputs.release_tag }}\n\n - name: Confirm exact release commit\n shell: bash\n run: test \"$(git rev-parse HEAD)\" = \"${{ needs.release-preflight.outputs.release_sha }}\"\n\n - name: Download exact staged candidate set\n uses: actions/download-artifact@v8\n with:\n name: verified-release-candidates\n path: ${{ runner.temp }}/release-candidate\n```\n\n

\n\n\n\n

🧰 Tools

\n\n

🪛 zizmor (1.28.0)

\n\n[error] 523-523: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)\n\n(unpinned-uses)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/release.yml around lines 516 - 526, Add an exact-commit\nverification step immediately after the checkout step in the job containing\n“Checkout release scripts,” comparing git rev-parse HEAD with\nneeds.release-preflight.outputs.release_sha and failing on mismatch. Keep the\nexisting artifact download and release-install-smoke.sh flow unchanged.\n```\n\n

\n\n\n\n\n\n\n\n\n_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\n\n

🧩 Analysis chain

\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\n# Description: Inspect shiplog-testkit for existing fixture and bdd helpers reusable by this test.\nset -euo pipefail\n\nfd -t d 'shiplog-testkit' . | head\nfd -t f -e rs . --full-path shiplog-testkit --exec ast-grep outline {} --items all\n\n# Test: check whether apps/shiplog declares shiplog-testkit as a dev-dependency.\nrg -n -C6 'shiplog-testkit' --glob 'Cargo.toml'\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 298\n\n---\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\n# Inspect the smoke test, the shiplog-testkit crate tree, published/declared APIs,\n# and Cargo dependency declarations without running repository code.\nset -e\n\necho \"== candidate smoke outline ==\"\nast-grep outline apps/shiplog/tests/release_candidate_smoke.rs --view expanded || true\n\necho \"== candidate smoke relevant lines ==\"\nnl -ba apps/shiplog/tests/release_candidate_smoke.rs | sed -n '1,220p'\n\necho \"== shiplog-testkit files ==\"\nfind crates/shiplog-testkit -maxdepth 5 -type f -name '*.rs' -o -type d -print | sort\n\necho \"== shiplog-testkit outlines for relevant.rs/files ==\"\nfor f in $(find crates/shiplog-testkit -maxdepth 4 \$ -name '*.rs' -type f \$); do\n echo \"--- $f\"\n ast-grep outline \"$f\" --view expanded || true\ndone\n\necho \"== tests using fixtures/bdd in apps/shiplog tests ==\"\nrg -n 'use shiplog-testkit|shiplog-testkit::fixtures|shiplog-testkit::bdd|fixtures::|bdd::|CandidateFixture|candidate_fixture' apps/shiplog -S || true\n\necho \"== Cargo dependency declarations ==\"\nrg -n -C4 'shiplog-testkit' --glob 'Cargo.toml' . || true\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 32080\n\n---\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\n# Read the key implementation slices needed to assess whether CandidateFixture can be moved/shared.\nset -euo pipefail\n\necho \"== release_candidate_smoke.rs with line numbers ==\"\npython3 - <<'PY'\nfrom pathlib import Path\np=Path('apps/shiplog/tests/release_candidate_smoke.rs')\nfor i,line in enumerate(p.read_text().splitlines(),1):\n print(f'{i:4d}\\t{line}')\nPY\n\necho \"== shiplog-testkit src/lib.rs tail around fixtures ==\"\nsed -n '120,236p' crates/shiplog-testkit/src/lib.rs | nl -ba -v120\n\necho \"== bdd ScenarioContext/cleanup behavior ==\"\nsed -n '20,90p' crates/shiplog-testkit/src/bdd.rs | nl -ba -v20\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 10696\n\n---\n\n\n\n

\n\n**Move `CandidateFixture` and `candidate_fixture()` into reusable shared fixtures.**\n\n`shiplog-testkit` already declares a `fixtures` module, and `apps/shiplog` depends on it. This setup builds release-candidate metadata and bundles; keep it in `shiplog-testkit::fixtures` or a release-scenario module rather than duplicating it in `release_candidate_smoke.rs`.\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@apps/shiplog/tests/release_candidate_smoke.rs` around lines 16 - 21, Move\nCandidateFixture and candidate_fixture() out of release_candidate_smoke.rs into\nthe reusable shiplog-testkit::fixtures module or an appropriate release-scenario\nsubmodule. Preserve the existing release-candidate metadata and bundle setup,\nthen update the smoke test imports and usages to reference the shared fixture\nimplementation.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Add error context to the bare `?` propagations.**\n\nThe file uses `.with_context(|| ...)` for most filesystem operations. These sites propagate `std::io::Error` with no context: Lines 104, 106, 209, 229, 231, 253, and 255. A failure reports only `Permission denied` with no path or operation, which is hard to diagnose in CI.\n\n

♻️ Proposed refactor for one site

\n\n```diff\n #[cfg(unix)]\n {\n use std::os::unix::fs::PermissionsExt;\n- let mut permissions = fs::metadata(&asset_path)?.permissions();\n+ let mut permissions = fs::metadata(&asset_path)\n+ .with_context(|| format!(\"read metadata for {}\", asset_path.display()))?\n+ .permissions();\n permissions.set_mode(0o755);\n- fs::set_permissions(&asset_path, permissions)?;\n+ fs::set_permissions(&asset_path, permissions)\n+ .with_context(|| format!(\"set mode 0o755 on {}\", asset_path.display()))?;\n }\n```\n

\n\nApply the same pattern at Lines 209, 229, 231, 253, and 255.\n\nAs per coding guidelines: \"Use `anyhow::Result` with `.context(\"description\")?` for error propagation\" and \"Add contextual messages with `.with_context(|| format!(...))` for dynamic error information\".\n\n\n\n\n\n\nAlso applies to: 229-231, 252-256\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@apps/shiplog/tests/release_candidate_smoke.rs` around lines 101 - 107, In the\nrelease-candidate smoke test, update the filesystem operations around the Unix\npermission setup and the additional sites near lines 209, 229, 231, 253, and 255\nto attach context before propagating errors. Use static .context descriptions\nfor fixed operations and .with_context closures with the relevant path for\ndynamic operations, covering metadata, set_permissions, and other bare\nfilesystem ? calls while preserving the existing behavior.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**The Windows broken-executable path has no equivalent proof.**\n\nThis test is gated to unix because `scripts/release-install-smoke.ps1` reports execution failure and version mismatch under one message, `unexpected version output`. The Bash script separates them and emits `candidate binary failed --version`. The negative control at `.github/workflows/release.yml` Lines 551-594 also runs on `ubuntu-latest` only. The result is that a Windows candidate binary that cannot execute is never proven to be rejected by a distinct, assertable signal.\n\nConsider making the PowerShell script emit `candidate binary failed --version` when `$LASTEXITCODE -ne 0`, then removing the `#[cfg(unix)]` gate here.\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@apps/shiplog/tests/release_candidate_smoke.rs` around lines 246 - 248, Update\nscripts/release-install-smoke.ps1 to emit the distinct “candidate binary failed\n--version” signal when the candidate command exits with a nonzero $LASTEXITCODE,\nwhile retaining “unexpected version output” for successful commands with\nmismatched output. Then remove the #[cfg(unix)] gate from\nstaged_candidate_smoke_rejects_broken_command_with_matching_checksum so the same\nrejection assertion runs on Windows.\n```\n\n

\n\n\n\n\n\n\n\n\n_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Rename `$matches` to avoid the PowerShell automatic variable.**\n\n`$Matches` is the automatic hashtable that the `-match` and `-notmatch` operators populate. `Assert-CandidateManifest` uses `-notmatch` at Lines 94 and 132. Assigning to `$matches` here shadows that automatic variable and PSScriptAnalyzer reports it as `PSAvoidAssignmentToAutomaticVariable`.\n\n

♻️ Proposed refactor

\n\n```diff\n- $matches = @(\n+ $candidateMatches = @(\n Get-ChildItem -LiteralPath $Root -Recurse -File |\n Where-Object { $_.Name -eq $Name }\n )\n- if ($matches.Count -ne 1) {\n- throw \"candidate bundle must contain exactly one $Name; found $($matches.Count) under $Root\"\n+ if ($candidateMatches.Count -ne 1) {\n+ throw \"candidate bundle must contain exactly one $Name; found $($candidateMatches.Count) under $Root\"\n }\n- return $matches[0].FullName\n+ return $candidateMatches[0].FullName\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🧰 Tools

\n\n

🪛 PSScriptAnalyzer (1.25.0)

\n\n[warning] 66-66: The Variable 'matches' is an automatic variable that is built into PowerShell, assigning to it might have undesired side effects. If assignment is not by design, please use a different name.\n\n(PSAvoidAssignmentToAutomaticVariable)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@scripts/release-install-smoke.ps1` around lines 66 - 73, Rename the local\n$matches collection in the candidate bundle lookup to a non-automatic variable,\nand update its Count, error message, and index references consistently; leave\nthe Assert-CandidateManifest -notmatch usage unchanged.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Linters/SAST tools_\n\n\n_🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Match the PowerShell validator and reject duplicated manifest fields.**\n\n`scripts/release-install-smoke.ps1` Lines 103-108 parse `RELEASE_CANDIDATE.txt` into a map and reject a malformed or duplicated field. This Bash validator uses `grep -Fxq` presence checks instead. A manifest that carries two `source_sha` lines, or two `release_tag` lines, satisfies every check here while the PowerShell validator rejects it. The two scripts then disagree about whether the same bundle is valid, which weakens the single-candidate-set guarantee this PR establishes.\n\nAdd a duplicate-key check before the field assertions.\n\n

♻️ Proposed refactor

\n\n```diff\n+ if awk -F= 'NF > 0 { if (seen[$1]++) { exit 1 } }' \"$manifest\"; then\n+ :\n+ else\n+ echo \"candidate manifest contains duplicated fields\" >&2\n+ exit 1\n+ fi\n+\n grep -Fxq \"schema_version=1\" \"$manifest\" || {\n echo \"candidate manifest has unsupported schema\" >&2\n exit 1\n }\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n if awk -F= 'NF > 0 { if (seen[$1]++) { exit 1 } }' \"$manifest\"; then\n :\n else\n echo \"candidate manifest contains duplicated fields\" >&2\n exit 1\n fi\n\n grep -Fxq \"schema_version=1\" \"$manifest\" || {\n echo \"candidate manifest has unsupported schema\" >&2\n exit 1\n }\n grep -Fxq \"release_tag=$tag\" \"$manifest\" || {\n echo \"candidate manifest is not bound to $tag\" >&2\n exit 1\n }\n grep -Fxq \"source_sha=$expected_source_sha\" \"$manifest\" || {\n echo \"candidate manifest is not bound to source commit $expected_source_sha\" >&2\n exit 1\n }\n grep -Fxq \"asset_count=4\" \"$manifest\" || {\n echo \"candidate manifest does not record the four supported binaries\" >&2\n exit 1\n }\n```\n\n

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@scripts/release-install-smoke.sh` around lines 119 - 134, Update the Bash\nmanifest validation before the existing schema_version, release_tag, source_sha,\nand asset_count assertions to detect and reject duplicate manifest keys,\nmatching the parsing behavior in the PowerShell validator. Ensure each required\nfield appears exactly once while preserving the current field-value checks and\nerror handling.\n```\n\n

\n\n\n\n\n\n\n\n\n\n✅ Addressed in commits 595e615 to 52d5667\n_🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\n\n

🧩 Analysis chain

\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\n# Description: Inspect how SHA256SUMS.txt entries are produced for published releases versus the staged bundle.\nset -euo pipefail\n\nrg -n 'SHA256SUMS' --glob '!**/target/**' .\nrg -n -C4 'sha256sum' .github/workflows scripts\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 10864\n\n---\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\nset -euo pipefail\n\necho \"== release workflow SHA256SUMS generation ==\"\nsed -n '500,610p' .github/workflows/release.yml\n\necho \"== release-install-smoke.sh relevant lines ==\"\nsed -n '160,210p' scripts/release-install-smoke.sh\n\necho \"== release-install-smoke.ps1 relevant lines ==\"\nsed -n '197,223p' scripts/release-install-smoke.ps1\n\necho \"== install.sh matcher for comparison ==\"\nsed -n '60,80p' scripts/install.sh\n\necho \"== deterministic regex/probe for current awk matcher ==\"\npython3 - <<'PY'\nimport re\n\nassets = [\n \"shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\",\n \"shiplog-x86_64-pc-windows-msvc.exe\",\n \"shiplog-x86_64-darwin\",\n \"foo/bar/with/slashes\",\n]\nentries = [\n (\"sha\", \"shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\"),\n (\"sha\", \"shiplog-x86_64-pc-windows-msvc.exe\"),\n (\"sha\", \"shiplog-x86_64-darwin\"),\n]\n\nasset_re = re.compile(r\"/\" + re.escape(assets[1]) + r\"$\")\nfor asset in assets:\n print(asset, bool(asset_re.search(asset)))\n\nprint(\"flat entry for public asset matches:\", asset_re.search(\"sha\" + \" \" + \"shiplog-x86_64-pc-windows-msvc.exe\"))\nPY\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 9270\n\n---\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\nset -euo pipefail\nsed -n '260,300p' .github/workflows/release.yml\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 1885\n\n---\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\nset -euo pipefail\necho \"== release workflow upload assets section ==\"\nsed -n '304,380p' .github/workflows/release.yml\necho \"== inspect exact upload artifact paths, no regex ==\"\nrg -n 'cd artifacts|expected=|upload-artifact|upload-release|asset_rel|ReleaseAsset|create.*release|SHA256SUMS.txt' .github/workflows/release.yml\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 6137\n\n---\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\nset -euo pipefail\necho \"== create-release step ==\"\nsed -n '200,240p' .github/workflows/release.yml\necho \"== upload-assets step ==\"\nsed -n '160,200p' .github/workflows/release.yml\necho \"== any release asset creation elsewhere ==\"\nrg -n -C 3 'create-release|upload-release|release_url|draft|tag_name|asset_name|filename|ReleaseAsset|gh release' .github/workflows/release.yml\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 5214\n\n---\n\n🏁 Script executed:\n\n```shell\n#!/bin/bash\nset -euo pipefail\necho \"== scripts/release-install-smoke.sh public-mode asset selection ==\"\nsed -n '1,150p' scripts/release-install-smoke.sh\necho \"== environment flow around release-install-smoke.sh invocations ==\"\nrg -n -C 5 'release-install-smoke\\.sh|SHIPLOG_RELEASE_SMOKE|candidate_dir|RELEASE_CANDIDATE_DIR|download_dir|base_url|platform|asset' .* scripts apps/docs 2>/dev/null || true\n```\n\nRepository: EffortlessMetrics/shiplog-swarm\n\nLength of output: 50389\n\n---\n\n🌐 Web query:\n\n`GitHub release SHA256SUMS asset flat filenames gh release download SHA256SUMS.txt`\n\n💡 Result:\n\nWhen using the GitHub CLI (gh) to download assets, including a SHA256SUMS file, the tool handles filenames as they are explicitly named in the release [1][2]. There is no native \"flat filename\" or automatic directory flattening feature in the `gh release download` command that renames files [1][3]. The command downloads assets into the target directory (defaulting to the current directory) using their original names as published on GitHub [1][2]. Key points regarding asset management and verification: 1. Asset Naming: GitHub release assets are stored and downloaded with their precise, original filenames [4]. If a project publishes a SHA256SUMS file, it is downloaded as exactly that name [1][5]. 2. Manual Verification: Currently, `gh release download` does not have a built-in flag to automatically verify downloaded files against a provided SHA256SUMS file [6]. Users must download the checksum file separately and perform the verification using standard utilities like `sha256sum -c SHA256SUMS` [5]. 3. Native Digest Support: As of June 2025, GitHub computes and exposes SHA256 digests for all release assets via the GitHub API [7]. The `gh` CLI can access this metadata, but it is not used for automatic verification during the `gh release download` process [6][7]. 4. Automation Pattern: To download a specific SHA256SUMS file alongside other assets, you can use the `--pattern` flag [1][2]. For example: gh release download -p 'SHA256SUMS' -p '*.tar.gz' If you require a specific directory structure or renamed files, it is standard practice to handle this via shell scripting or a post-download command, rather than relying on the GitHub CLI to modify the filenames during the download process [8][5].\n\nCitations:\n\n- 1: https://cli.github.com/manual/gh_release_download\n- 2: https://www.mankier.com/1/gh-release-download\n- 3: https://fossies.org/linux/gh-cli/pkg/cmd/release/download/download.go\n- 4: https://docs.github.com/en/rest/releases/assets\n- 5: https://github.com/github/gh-ost/pull/1729\n- 6: https://github.com/cli/cli/issues/13961\n- 7: https://github.blog/changelog/2025-06-03-releases-now-expose-digests-for-release-assets/\n- 8: https://alexwlchan.net/notes/2024/install-from-github-releases/\n\n---\n\n🌐 Web query:\n\n`github.com/EffortlessMetrics/shiplog/releases SHA256SUMS.txt asset names`\n\n💡 Result:\n\nThe SHA256SUMS.txt file included in the EffortlessMetrics/shiplog GitHub releases contains checksums for the following platform-specific binary assets [1][2][3][4]: shiplog-x86_64-unknown-linux-gnu shiplog-x86_64-apple-darwin shiplog-aarch64-apple-darwin shiplog-x86_64-pc-windows-msvc.exe These assets are consistently used across releases and are verified by scripts provided in the project documentation [1]. The SHA256SUMS.txt file itself is also included as a release asset [2][3][4].\n\nCitations:\n\n- 1: https://github.com/EffortlessMetrics/shiplog/blob/main/docs/install.md\n- 2: https://github.com/EffortlessMetrics/shiplog/releases/tag/v0.5.0\n- 3: https://github.com/EffortlessMetrics/shiplog/releases/tag/v0.4.0\n- 4: https://github.com/EffortlessMetrics/shiplog/releases/tag/v0.3.0\n\n---\n\n\n\n

\n\n**Handle both flat and directory-prefixed `SHA256SUMS.txt` entries before searching.**\n\nThe public-path code downloads `https://github.com/$repo/releases/download/$tag/SHA256SUMS.txt`; published release checksums use flat filenames, so entries without `/` do not match `$2 ~ \"/\" asset \"$\"`. Use the basename match that `scripts/release-install-smoke.ps1` already uses, but escape the asset value in the awk regex.\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@scripts/release-install-smoke.sh` around lines 188 - 192, Update the checksum\nlookup in the SHA256SUMS verification block to match both flat filenames and\ndirectory-prefixed entries, reusing the basename-matching behavior from the\nPowerShell smoke script. Escape the asset value before using it in the awk\nregular expression, while preserving the existing missing-entry failure\nbehavior.\n```\n\n

\n\n\n\n\n\n\n\n\n_🩺 Stability & Availability_ | _🟡 Minor_ | _⚡ Quick win_\n\n**Resolve `binary_path` to an absolute path before the `cd`.**\n\nThe subshell changes directory to `$cold_start_dir`, then invokes `\"$binary_path\"`. `binary_path` is derived from `work_dir`, which the documented `SHIPLOG_RELEASE_SMOKE_DIR` override at Line 17 can set to a relative path. In that case the invocation fails here with a confusing \"no such file\" error, even though the candidate binary is valid. The candidate path is already normalized this way at Line 168.\n\n

🐛 Proposed fix

\n\n```diff\n echo \"==> structurally validating cold-start receipts\"\n latest_run_name=\"$(basename \"$latest_run\")\"\n+binary_path=\"$(cd -- \"$(dirname -- \"$binary_path\")\" && pwd)/$(basename -- \"$binary_path\")\"\n (\n cd \"$cold_start_dir\"\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@scripts/release-install-smoke.sh` around lines 259 - 264, Normalize\n`binary_path` to an absolute path before the subshell changes directories,\nmatching the existing candidate-path normalization pattern near the release\nsmoke setup. Ensure the invocation in the `cold_start_dir` subshell uses that\nabsolute `binary_path` while preserving the current validation arguments.\n```\n\n

\n\n\n\n\n\n\n\n\n**Actionable comments posted: 11**\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (1)

\n> \n>
\n>
.github/workflows/release.yml (1)
\n> \n> `304-316`: _🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\n> \n> **Align candidate retention with the receipt retention.**\n> \n> The staged candidate set expires after 5 days. The readiness receipt at Line 732 is retained for 30 days and records `candidate_artifact_id` and `candidate_artifact_digest`. For 25 of those days the receipt names bytes that no longer exist, so a human cannot re-verify the digest before authorizing publication.\n> \n> Set `retention-days` here to match the receipt, or shorten the receipt retention.\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In @.github/workflows/release.yml around lines 304 - 316, Update the\n> retention-days setting in the “Retain exact staged release candidates” step to\n> 30 days, matching the readiness receipt retention and preserving candidate\n> artifacts for the full verification window.\n> ```\n> \n>
\n> \n> \n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nInline comments:\nIn @.github/workflows/release.yml:\n- Around line 516-526: Add an exact-commit verification step immediately after\nthe checkout step in the job containing “Checkout release scripts,” comparing\ngit rev-parse HEAD with needs.release-preflight.outputs.release_sha and failing\non mismatch. Keep the existing artifact download and release-install-smoke.sh\nflow unchanged.\n- Around line 286-296: Update the release candidate metadata generation around\nRELEASE_CANDIDATE.txt to derive asset_count from the expected asset array\ndefined earlier in the workflow instead of hardcoding 4. Ensure the computed\ncount is written to the asset_count field so validators and smoke tests reflect\nevery configured target.\n- Around line 254-257: Update every actions/download-artifact reference in the\nrelease workflow, including the steps named “Download all binary artifacts” and\nthe other listed usages, to the immutable commit SHA\n3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c and retain a # v8 comment on each\nreference.\n- Around line 228-230: Update the release workflow step’s shell commands so both\nhandoff messages, including the statement that Swarm cannot create a GitHub\nrelease, are appended to GITHUB_STEP_SUMMARY rather than only printed to stdout.\nPreserve the existing message text and ordering.\n\nIn `@apps/shiplog/tests/release_candidate_smoke.rs`:\n- Around line 101-107: In the release-candidate smoke test, update the\nfilesystem operations around the Unix permission setup and the additional sites\nnear lines 209, 229, 231, 253, and 255 to attach context before propagating\nerrors. Use static .context descriptions for fixed operations and .with_context\nclosures with the relevant path for dynamic operations, covering metadata,\nset_permissions, and other bare filesystem ? calls while preserving the existing\nbehavior.\n- Around line 246-248: Update scripts/release-install-smoke.ps1 to emit the\ndistinct “candidate binary failed --version” signal when the candidate command\nexits with a nonzero $LASTEXITCODE, while retaining “unexpected version output”\nfor successful commands with mismatched output. Then remove the #[cfg(unix)]\ngate from staged_candidate_smoke_rejects_broken_command_with_matching_checksum\nso the same rejection assertion runs on Windows.\n- Around line 16-21: Move CandidateFixture and candidate_fixture() out of\nrelease_candidate_smoke.rs into the reusable shiplog-testkit::fixtures module or\nan appropriate release-scenario submodule. Preserve the existing\nrelease-candidate metadata and bundle setup, then update the smoke test imports\nand usages to reference the shared fixture implementation.\n\nIn `@scripts/release-install-smoke.ps1`:\n- Around line 66-73: Rename the local $matches collection in the candidate\nbundle lookup to a non-automatic variable, and update its Count, error message,\nand index references consistently; leave the Assert-CandidateManifest -notmatch\nusage unchanged.\n\nIn `@scripts/release-install-smoke.sh`:\n- Around line 259-264: Normalize `binary_path` to an absolute path before the\nsubshell changes directories, matching the existing candidate-path normalization\npattern near the release smoke setup. Ensure the invocation in the\n`cold_start_dir` subshell uses that absolute `binary_path` while preserving the\ncurrent validation arguments.\n- Around line 119-134: Update the Bash manifest validation before the existing\nschema_version, release_tag, source_sha, and asset_count assertions to detect\nand reject duplicate manifest keys, matching the parsing behavior in the\nPowerShell validator. Ensure each required field appears exactly once while\npreserving the current field-value checks and error handling.\n- Around line 188-192: Update the checksum lookup in the SHA256SUMS verification\nblock to match both flat filenames and directory-prefixed entries, reusing the\nbasename-matching behavior from the PowerShell smoke script. Escape the asset\nvalue before using it in the awk regular expression, while preserving the\nexisting missing-entry failure behavior.\n\n---\n\nOutside diff comments:\nIn @.github/workflows/release.yml:\n- Around line 304-316: Update the retention-days setting in the “Retain exact\nstaged release candidates” step to 30 days, matching the readiness receipt\nretention and preserving candidate artifacts for the full verification window.\n```\n\n

\n\n

🪄 Autofix

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Organization UI\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro Plus\n\n**Run ID**: `3dd83058-a03d-4c42-9260-fb97321a663a`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between b816b6032e85ed698ae34ac1d60974cd6f8b8f53 and a54884d2f0b2660bd57b301504dce8df7f7cab5e.\n\n

\n\n

📒 Files selected for processing (4)

\n\n* `.github/workflows/release.yml`\n* `apps/shiplog/tests/release_candidate_smoke.rs`\n* `scripts/release-install-smoke.ps1`\n* `scripts/release-install-smoke.sh`\n\n

\n\n

\n\n\n[P1] Assert the negative-control checkout resolves the preflight SHA\n\nFailure mode:\nThe `release-candidate-negative-controls` job checks out `${{ needs.release-preflight.outputs.release_tag }}` and immediately runs `scripts/release-install-smoke.sh`, but never compares `git rev-parse HEAD` with `${{ needs.release-preflight.outputs.release_sha }}`. If the tag resolution changes between preflight and this job, the negative controls can execute a different release-script revision while reporting evidence for the preflight candidate.\n\nWhy here:\nThis PR's core contract is one immutable exact-tag candidate set. Every job that executes release scripts must prove the checkout identity, not only the artifact manifest identity.\n\nFix direction:\nAdd the same exact-commit assertion used by the other release jobs immediately after the checkout:\n`test \"$(git rev-parse HEAD)\" = \"${{ needs.release-preflight.outputs.release_sha }}\"`.\nRetain the existing staged-artifact and negative-control assertions.\n\nValidation:\nExercise a tag/ref mismatch fixture or equivalent workflow proof and confirm the negative-control job fails before invoking either smoke script.\n\nConfidence:\nHigh; inspected current head `595e6152c3370c85a069caf9f12b5264c2d5c1ce`, `.github/workflows/release.yml:516-520`.\n@codex review\n\nPlease review the current final head, especially exact tag/source/artifact binding, complete four-platform bundle validation, failure controls, matrix consumption of staged bytes, and the terminal readiness aggregate.\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Bind tag-push resolution to the triggering commit**\n\nFailure mode: On a tag-push run, this force-fetch resolves the tag from its current remote value instead of binding it to the triggering `github.sha`; if the tag is moved after the webhook is created but before preflight executes, the workflow can build and certify a different commit while still reporting success for the original tag event. Why here: every downstream comparison uses the newly resolved `release_sha`, so none detects this initial substitution. Fix direction: for `push` events, require the peeled tag commit to equal the event SHA (while retaining current-tag resolution for approved manual dispatches). Validation: trigger a run and retarget the tag before this fetch, then verify preflight rejects the mismatch. Confidence: high. This is particularly important because tag and release operations remain source-repository authority.\n\nAGENTS.md reference: [AGENTS.md:L14-L17](https://github.com/EffortlessMetrics/shiplog-swarm/blob/46fd16c469eca8eae4420a9c1d6980aa922bfbf8/AGENTS.md#L14-L17)\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `46fd16c469`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

",{},"created",1785841335.3119633,"Completing the task","event_type","info",{"_93":664,"_97":94,"_656":2590},{"_93":2056,"_2057":2058},{"_93":2030,"_2031":2032,"_2033":2034,"_2035":2036,"_2037":-5},"pr","pr_title","fix(release): pin download-artifact v8, emit handoff summary, derive asset_count, and verify preflight SHA","pr_message","### Motivation\n\n- Prevent tag/flow-time races and unpinned-action surprises by binding `actions/download-artifact@v8` uses to an immutable v8.0.1 commit. \n- Ensure the release handoff always records the verification-only summary (while keeping a pull-request-specific warning additive). \n- Make the staged-candidate manifest reflect the actual expected bundle size and ensure jobs execute scripts from the exact preflight-specified source commit. \n\n### Description\n\n- Replaced the four `actions/download-artifact@v8` references with the v8.0.1 commit SHA and added a `# v8.0.1` comment; updated the workflow allowlist entry to match the pinned reference. \n- Updated the release handoff step to append both verification messages to `GITHUB_STEP_SUMMARY` (wrapped in `set -euo pipefail`) and emit an additional warning when runs are `pull_request` verification-only. \n- Changed candidate manifest generation to pass workflow expression values through step `env` variables and derive `asset_count` from the `expected` array rather than hardcoding `4`. \n- Added an exact-commit confirmation (`git rev-parse HEAD` equals the preflight `release_sha`) immediately after checkouts in the jobs that run scripts or negative controls so repository script bytes are proven before use. \n- Applied the edits to `.github/workflows/release.yml` and to `policy/workflow-allowlist.toml` to keep file-policy and workflow allowlist consistent with the pinned action. \n\n### Testing\n\n- Ran `git diff --check` and observed no whitespace or patch-format issues. \n- Ran `cargo xtask check-workflows --mode blocking-allowlist` with no findings reported. \n- Ran `cargo xtask check-file-policy --mode blocking-allowlist` with no findings reported.","output_diff",{"_93":2035,"_2038":699,"_129":130,"_2039":-5,"_431":2040,"_2041":2042,"_2043":2044,"_2045":2046,"_2047":2048,"_2049":2050,"_2051":2052},"pre_apply_patch","repo_id","preapply_patch_base_commit_sha","diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml\nindex 4b53b9b5cf83f107b6a2174facdaaaae241272df..e986be76713bfcc43e69253ba2a77622f87452e0 100644\n--- a/.github/workflows/release.yml\n+++ b/.github/workflows/release.yml\n@@ -203,116 +203,130 @@ jobs:\n needs: [release-preflight, build-binary]\n outputs:\n version: ${{ steps.version.outputs.version }}\n \n steps:\n - name: Checkout exact release tag\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n ref: ${{ needs.release-preflight.outputs.release_tag }}\n \n - name: Confirm exact release commit\n shell: bash\n run: test \"$(git rev-parse HEAD)\" = \"${{ needs.release-preflight.outputs.release_sha }}\"\n \n - name: Extract version\n id: version\n shell: bash\n run: |\n VERSION=${{ needs.release-preflight.outputs.release_tag }}\n VERSION=${VERSION#v}\n echo \"version=$VERSION\" >> \"$GITHUB_OUTPUT\"\n \n - name: Record source release handoff\n shell: bash\n+ env:\n+ EVENT_NAME: ${{ github.event_name }}\n run: |\n- echo \"Swarm verifies release inputs but cannot create a GitHub release.\"\n- echo \"Promote this exact proven tree to EffortlessMetrics/shiplog for authorized release execution.\" >> \"$GITHUB_STEP_SUMMARY\"\n+ set -euo pipefail\n+ {\n+ echo \"Swarm verifies release inputs but cannot create a GitHub release.\"\n+ echo \"Promote this exact proven tree to EffortlessMetrics/shiplog for authorized release execution.\"\n+ } >> \"$GITHUB_STEP_SUMMARY\"\n+ if [[ \"$EVENT_NAME\" == \"pull_request\" ]]; then\n+ echo \"::warning::Pull request runs are verification-only; no release is created.\"\n+ fi\n \n # Assemble one immutable workflow-staged candidate set before acceptance.\n upload-assets:\n name: Stage Release Candidates\n runs-on: ${{ github.repository == 'EffortlessMetrics/shiplog-swarm' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && 'self-hosted' || 'ubuntu-latest' }}\n needs: [release-preflight, build-binary, create-release]\n outputs:\n candidate_artifact_id: ${{ steps.candidates.outputs.artifact-id }}\n candidate_artifact_digest: ${{ steps.candidates.outputs.artifact-digest }}\n candidate_manifest_sha256: ${{ steps.candidate_manifest.outputs.candidate_manifest_sha256 }}\n checksum_manifest_sha256: ${{ steps.candidate_manifest.outputs.checksum_manifest_sha256 }}\n \n steps:\n - name: Checkout exact release tag\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n ref: ${{ needs.release-preflight.outputs.release_tag }}\n \n - name: Confirm exact release commit\n shell: bash\n run: test \"$(git rev-parse HEAD)\" = \"${{ needs.release-preflight.outputs.release_sha }}\"\n \n - name: Download all binary artifacts\n- uses: actions/download-artifact@v8\n+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n path: artifacts\n \n - name: Generate candidate manifest and checksums\n id: candidate_manifest\n shell: bash\n+ env:\n+ RELEASE_TAG: ${{ needs.release-preflight.outputs.release_tag }}\n+ RELEASE_SHA: ${{ needs.release-preflight.outputs.release_sha }}\n+ RELEASE_REPOSITORY: ${{ github.repository }}\n+ WORKFLOW_RUN_ID: ${{ github.run_id }}\n+ WORKFLOW_RUN_ATTEMPT: ${{ github.run_attempt }}\n run: |\n set -euo pipefail\n cd artifacts\n \n expected=(\n \"shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\"\n \"shiplog-x86_64-apple-darwin/shiplog-x86_64-apple-darwin\"\n \"shiplog-aarch64-apple-darwin/shiplog-aarch64-apple-darwin\"\n \"shiplog-x86_64-pc-windows-msvc/shiplog-x86_64-pc-windows-msvc.exe\"\n )\n for path in \"${expected[@]}\"; do\n if [[ ! -f \"$path\" ]]; then\n echo \"missing expected staged binary: $path\" >&2\n find . -maxdepth 3 -type f -print >&2\n exit 1\n fi\n done\n \n : > SHA256SUMS.txt\n for path in \"${expected[@]}\"; do\n sha256sum \"$path\" >> SHA256SUMS.txt\n done\n checksum_manifest_sha256=\"$(sha256sum SHA256SUMS.txt | awk '{print $1}')\"\n \n cat > RELEASE_CANDIDATE.txt <> \"$GITHUB_OUTPUT\"\n echo \"candidate_manifest_sha256=$candidate_manifest_sha256\" >> \"$GITHUB_OUTPUT\"\n cat RELEASE_CANDIDATE.txt\n cat SHA256SUMS.txt\n \n - name: Retain exact staged release candidates\n id: candidates\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n with:\n name: verified-release-candidates\n path: |\n artifacts/shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\n artifacts/shiplog-x86_64-apple-darwin/shiplog-x86_64-apple-darwin\n artifacts/shiplog-aarch64-apple-darwin/shiplog-aarch64-apple-darwin\n artifacts/shiplog-x86_64-pc-windows-msvc/shiplog-x86_64-pc-windows-msvc.exe\n artifacts/SHA256SUMS.txt\n artifacts/RELEASE_CANDIDATE.txt\n retention-days: 5\n \n - name: Record staged candidate identity\n@@ -324,51 +338,51 @@ jobs:\n echo \"- Source commit: \\`${{ needs.release-preflight.outputs.release_sha }}\\`\"\n echo \"- Artifact id: \\`${{ steps.candidates.outputs.artifact-id }}\\`\"\n echo \"- Artifact digest: \\`${{ steps.candidates.outputs.artifact-digest }}\\`\"\n echo \"- Candidate manifest SHA-256: \\`${{ steps.candidate_manifest.outputs.candidate_manifest_sha256 }}\\`\"\n echo \"- Checksum manifest SHA-256: \\`${{ steps.candidate_manifest.outputs.checksum_manifest_sha256 }}\\`\"\n } >> \"$GITHUB_STEP_SUMMARY\"\n \n # Validate the staged candidate while retaining independent release-mode checks.\n release-validation:\n name: Release Validation\n runs-on: ${{ github.repository == 'EffortlessMetrics/shiplog-swarm' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && 'self-hosted' || 'ubuntu-latest' }}\n needs: [release-preflight, upload-assets]\n \n steps:\n - name: Checkout exact release tag\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n ref: ${{ needs.release-preflight.outputs.release_tag }}\n \n - name: Confirm exact release commit\n shell: bash\n run: test \"$(git rev-parse HEAD)\" = \"${{ needs.release-preflight.outputs.release_sha }}\"\n \n - name: Download staged candidate set\n- uses: actions/download-artifact@v8\n+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: verified-release-candidates\n path: candidate\n \n - name: Verify staged candidate identity\n shell: bash\n run: |\n set -euo pipefail\n grep -Fxq \"schema_version=1\" candidate/RELEASE_CANDIDATE.txt\n grep -Fxq \"release_tag=${{ needs.release-preflight.outputs.release_tag }}\" candidate/RELEASE_CANDIDATE.txt\n grep -Fxq \"source_sha=${{ needs.release-preflight.outputs.release_sha }}\" candidate/RELEASE_CANDIDATE.txt\n grep -Fxq \"asset_count=4\" candidate/RELEASE_CANDIDATE.txt\n expected=\"$(sed -n 's/^checksum_manifest_sha256=//p' candidate/RELEASE_CANDIDATE.txt)\"\n actual=\"$(sha256sum candidate/SHA256SUMS.txt | awk '{print $1}')\"\n test \"$actual\" = \"$expected\"\n test \"$(sha256sum candidate/RELEASE_CANDIDATE.txt | awk '{print $1}')\" = \"${{ needs.upload-assets.outputs.candidate_manifest_sha256 }}\"\n \n - name: Smoke staged Linux candidate\n shell: bash\n run: |\n set -euo pipefail\n binary=\"candidate/shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\"\n expected=\"$(awk '$2 == \"shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\" {print $1}' candidate/SHA256SUMS.txt)\"\n actual=\"$(sha256sum \"$binary\" | awk '{print $1}')\"\n test \"$actual\" = \"$expected\"\n@@ -454,95 +468,101 @@ jobs:\n - name: macOS Intel\n os: macos-15-intel\n shell: bash\n target: x86_64-apple-darwin\n - name: macOS Apple Silicon\n os: macos-15\n shell: bash\n target: aarch64-apple-darwin\n - name: Windows x86_64\n os: windows-latest\n shell: pwsh\n target: x86_64-pc-windows-msvc\n \n steps:\n - name: Checkout release scripts\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n ref: ${{ needs.release-preflight.outputs.release_tag }}\n \n - name: Confirm exact release commit\n shell: bash\n run: test \"$(git rev-parse HEAD)\" = \"${{ needs.release-preflight.outputs.release_sha }}\"\n \n - name: Download exact staged candidate set\n- uses: actions/download-artifact@v8\n+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: verified-release-candidates\n path: ${{ runner.temp }}/release-candidate\n \n - name: Run staged-binary first-use acceptance (Unix)\n if: matrix.shell == 'bash'\n shell: bash\n env:\n SHIPLOG_RELEASE_CANDIDATE_DIR: ${{ runner.temp }}/release-candidate\n SHIPLOG_RELEASE_SOURCE_SHA: ${{ needs.release-preflight.outputs.release_sha }}\n run: bash scripts/release-install-smoke.sh \"${{ needs.release-preflight.outputs.release_tag }}\"\n \n - name: Run staged-binary first-use acceptance (Windows)\n if: matrix.shell == 'pwsh'\n shell: pwsh\n env:\n SHIPLOG_RELEASE_CANDIDATE_DIR: ${{ runner.temp }}/release-candidate\n SHIPLOG_RELEASE_SOURCE_SHA: ${{ needs.release-preflight.outputs.release_sha }}\n run: pwsh -NoProfile -File scripts/release-install-smoke.ps1 \"${{ needs.release-preflight.outputs.release_tag }}\"\n \n - name: Upload first-use diagnostics and receipts\n if: always()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n with:\n name: release-first-use-${{ matrix.target }}\n path: target/release-install-smoke/${{ needs.release-preflight.outputs.release_tag }}\n if-no-files-found: warn\n retention-days: 14\n \n # Prove checksum and executable failures cannot satisfy the candidate gate.\n release-candidate-negative-controls:\n name: Release Candidate Negative Controls\n runs-on: ubuntu-latest\n needs: [release-preflight, upload-assets]\n \n steps:\n - name: Checkout release scripts\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n ref: ${{ needs.release-preflight.outputs.release_tag }}\n \n+ - name: Confirm exact release commit\n+ shell: bash\n+ env:\n+ RELEASE_SHA: ${{ needs.release-preflight.outputs.release_sha }}\n+ run: test \"$(git rev-parse HEAD)\" = \"$RELEASE_SHA\"\n+\n - name: Download exact staged candidate set\n- uses: actions/download-artifact@v8\n+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: verified-release-candidates\n path: ${{ runner.temp }}/release-candidate\n \n - name: Prove corrupted checksum is rejected\n shell: bash\n env:\n RELEASE_TAG: ${{ needs.release-preflight.outputs.release_tag }}\n RELEASE_SHA: ${{ needs.release-preflight.outputs.release_sha }}\n run: |\n set -euo pipefail\n root=\"$RUNNER_TEMP/checksum-broken\"\n rm -rf \"$root\"\n mkdir -p \"$root\"\n cp -a \"$RUNNER_TEMP/release-candidate/.\" \"$root/\"\n printf '\\ncorrupt\\n' >> \"$root/shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\"\n \n if SHIPLOG_RELEASE_CANDIDATE_DIR=\"$root\" \\\n SHIPLOG_RELEASE_SOURCE_SHA=\"$RELEASE_SHA\" \\\n SHIPLOG_RELEASE_SMOKE_DIR=\"$RUNNER_TEMP/checksum-control-work\" \\\n bash scripts/release-install-smoke.sh \"$RELEASE_TAG\" \\\n >\"$RUNNER_TEMP/checksum-control.log\" 2>&1; then\n echo \"corrupted candidate unexpectedly passed\" >&2\n exit 1\n fi\ndiff --git a/policy/workflow-allowlist.toml b/policy/workflow-allowlist.toml\nindex f2f094ba53216b2b6476184f2367f99e888dd153..11d7a0c73fbc8c8e9b5ff20ec1fbd91a73407482 100644\n--- a/policy/workflow-allowlist.toml\n+++ b/policy/workflow-allowlist.toml\n@@ -129,51 +129,51 @@ expires = \"permanent\"\n path = \".github/workflows/ci.yml\"\n owner = \"release/ci\"\n reason = \"Self-hosted main/full-ci correctness gate. Check job covers fmt --check, clippy -D --locked --all-features, workspace tests --locked --all-features, doc-tests --locked --all-features, doc build -D warnings, release build --locked, canary `shiplog` publish --dry-run --locked. Sibling jobs: cargo-deny dependency policy, Policy gates (runs policy ledger checks plus source-of-truth validators, with cargo-allow replacing the non-Rust file-policy xtask gate; added in PR #165 and expanded for SHIPLOG-SPEC-0010).\"\n permissions = [\"contents:read\"]\n secrets_used = []\n external_actions = [\n \"actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1\",\n \"dtolnay/rust-toolchain@master\",\n \"./.github/actions/native-build-deps\",\n \"Swatinem/rust-cache@v2\",\n \"taiki-e/install-action@cargo-deny\",\n ]\n created = \"2026-05-09\"\n expires = \"permanent\"\n \n [[entry]]\n path = \".github/workflows/release.yml\"\n owner = \"release/ci\"\n reason = \"Swarm release-verification pipeline; builds and retains candidate artifacts but has no GitHub Release write authority. Canonical source restores explicitly authorized release writers as source-only governance.\"\n permissions = [\"contents:read\"]\n secrets_used = []\n external_actions = [\n \"actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1\",\n \"dtolnay/rust-toolchain@master\",\n \"actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\",\n- \"actions/download-artifact@v8\",\n+ \"actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c\",\n \"actions/cache@v6\",\n \"Swatinem/rust-cache@v2\",\n \"taiki-e/install-action@v2\",\n ]\n created = \"2026-05-09\"\n expires = \"permanent\"\n \n [[entry]]\n path = \".github/workflows/security.yml\"\n owner = \"release/ci\"\n reason = \"Standalone cargo-deny on push/PR/weekly. Duplicate of ci.yml#deny on PR; PR #155 routes to manifest changes / weekly / label only.\"\n permissions = [\"contents:read\"]\n secrets_used = []\n external_actions = [\n \"actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1\",\n \"dtolnay/rust-toolchain@stable\",\n \"taiki-e/install-action@v2\",\n ]\n duplicate_of_lane = \"lane.ci_deny\"\n created = \"2026-05-09\"\n expires = \"permanent\"\n \n [[entry]]\n path = \".github/workflows/em-ci-routed-shiplog-rust.yml\"\n owner = \"repo-infra/ci\"\n","external_storage_diff",{"_2053":2054,"_2055":-5},"files_modified",2,"lines_added",33,"lines_removed",13,"commit_message","fix(release): address staged workflow review","additional_parent_commit_shas",[],"file_id","file_00000000ac6c81f79a9b983157d1e3f4","ttl","partial_repo_snapshot","files",[2059,2060],{"_214":2163,"_2062":-5,"_2063":2164,"_2065":-5},{"_214":2061,"_2062":-5,"_2063":2064,"_2065":-5},"policy/workflow-allowlist.toml","contents","line_range_contents",[2066],"missing_reason",{"_2067":853,"_2068":2069,"_656":2070,"_2071":59},"line_range_start","line_range_end",309,[2072,2073,2074,2075,305,2076,2077,2078,2079,2080,2081,2082,2083,305,2084,2085,2086,2087,2088,2089,2090,2091,2092,305,2084,2093,2094,2095,2096,2089,2097,2098,2099,2100,2101,2092,305,2084,2102,2103,2104,2088,2089,2097,2098,2105,2106,2107,2100,2108,2092,305,2084,2109,2103,2110,2111,2112,2097,2098,2105,2106,2107,2100,2108,2092,305,2084,2113,2114,2115,2096,2089,2097,2098,2105,2116,2106,2100,2108,2092,305,2084,2117,2114,2118,2096,2089,2097,2098,2105,2116,2106,2100,2108,2092,305,2084,2119,2114,2120,2096,2089,2097,2098,2105,2116,2121,2106,2107,2100,2108,2092,305,2084,2122,2114,2123,2096,2089,2097,2098,2107,2100,2108,2092,305,2084,2124,2103,2125,2096,2089,2097,2098,2105,2116,2106,2126,2100,2127,2092,305,2084,2128,2103,2129,2096,2089,2097,2098,2105,2130,2131,2121,2106,2132,2100,2127,2092,305,2084,2133,2103,2134,2096,2089,2097,2098,2135,2132,2100,2136,2127,2092,305,2084,2137,2094,2138,2096,2139,2097,2098,2099,2106,2100,2140,2092,305,2084,2141,2114,2142,2096,2089,2097,2098,2105,2116,2106,2100,2127,2092,305,2084,2143,2114,2144,2096,2089,2097,2098,2105,2116,2106,2100,2127,2092,305,2084,2145,2114,2146,2096,2089,2097,2098,2105,2116,2121,2106,2107,2100,2127,2092,305,2084,2147,2114,2148,2096,2089,2097,2098,2105,2116,2107,2106,2100,2127,2092,305,2084,2149,2103,2150,2096,2151,2097,2098,2105,2116,2106,2132,2152,2107,2100,2127,2092,305,2084,2153,2114,2154,2155,2156,2097,2098,2157,2100,2127,2092,305,2084,2158,2114,2159,2160,2156,2097,2098,2157,2100,2127,2092,305,2084,2161,2114,2162,2160,2156,2097,2098,2157,2100,2127,2092],"contains_end_of_file","schema_version = 1","policy = \"workflow-allowlist\"","owner = \"EffortlessMetrics\"","status = \"advisory\"","# GitHub Actions workflows. Each entry captures the workflow's","# permissions, secrets used, and external actions. A new `uses:` line in","# any workflow is a policy event, not just a code change. The","# file-policy checker (PR #149) verifies that:","# - every workflow file has an entry,","# - declared external_actions match the actual uses: lines,","# - secrets_used matches the actual ${{ secrets.* }} references.","# See docs/FILE_POLICY.md.","[[entry]]","path = \".github/workflows/source-automation-guard.yml\"","owner = \"repo-infra/release\"","reason = \"Source-side fail-closed guard for routine Dependabot and Factory Droid product PRs. It runs only in canonical source, reads pull-request metadata without checkout, and leaves remediation in shiplog-swarm.\"","permissions = [\"contents:read\", \"pull-requests:read\"]","secrets_used = []","external_actions = []","created = \"2026-08-02\"","expires = \"permanent\"","path = \".github/workflows/contributor-acceptance.yml\"","owner = \"repo-infra/ci\"","reason = \"Fresh Linux and Windows contributor acceptance from a credential-free shiplog-swarm checkout. Proves the pinned toolchain, locked workspace build, canonical wrapper gate, and clean post-check worktree.\"","permissions = [\"contents:read\"]","external_actions = ["," \"actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1\","," \"dtolnay/rust-toolchain@v1\",","]","created = \"2026-07-17\"","path = \".github/workflows/pr-plan.yml\"","owner = \"release/ci\"","reason = \"Advisory LEM PR Plan. Emits target/ci/ci-plan.json against contracts/schemas/ci-plan.v1.schema.json. Reads policy/ci-budget.toml + policy/ci-lanes.toml + policy/ci-risk-packs.toml via `cargo xtask ci plan`. Never blocks merge in v0.5.0.\""," \"dtolnay/rust-toolchain@master\","," \"Swatinem/rust-cache@v2\","," \"actions/upload-artifact@v7\",","created = \"2026-05-10\"","path = \".github/workflows/ci-actuals.yml\"","reason = \"CI Actuals collector. Triggers on workflow_run completion for every instrumented workflow, fetches per-job timings via the GitHub REST API, joins to policy/ci-lanes.toml + policy/ci-budget.toml via `cargo xtask ci actuals`, emits target/ci/ci-actuals.json against contracts/schemas/ci-actuals.v1.schema.json. Closes the LEM feedback loop. Never blocks merge.\"","permissions = [\"contents:read\", \"actions:read\"]","secrets_used = [\"GITHUB_TOKEN\"]","path = \".github/workflows/bdd-smoke.yml\"","owner = \"policy\"","reason = \"Bounded BDD smoke (lane.bdd_smoke, added in PR #154). Runs two critical CLI-flow scenarios on every Rust-diff PR; broad lane.bdd stays PR-on-every until PR #155 routes it. Never blocks merge.\""," \"./.github/actions/native-build-deps\",","path = \".github/workflows/property-smoke.yml\"","reason = \"Bounded property smoke (lane.property_smoke, added in PR #154). Runs proptest at PROPTEST_CASES=64 with deterministic seed across foundation surfaces (shiplog::ids, shiplog::schema, shiplog::coverage, shiplog::redact). Broad lane.property stays PR-on-every until PR #155 routes it. Never blocks merge.\"","path = \".github/workflows/fuzz-smoke.yml\"","reason = \"Touched-target fuzz smoke (lane.fuzz_smoke, added in PR #154). Resolves changed paths to a subset of fuzz targets and runs each at 30s; no-ops when no parser surface is touched. Broad lane.fuzz_quick stays PR-on-every until PR #155 routes it. Never blocks merge.\""," \"actions/cache@v6\",","path = \".github/workflows/ripr.yml\"","reason = \"ripr advisory lane. Stub in PR #153 emits target/ripr/ripr.json + .sarif on Rust-diff PRs without doing real analysis (follow-up release replaces the stub with real ripr integration). Reads ripr.toml + policy/ripr-suppressions.toml. Never blocks merge.\"","path = \".github/workflows/ci.yml\"","reason = \"Self-hosted main/full-ci correctness gate. Check job covers fmt --check, clippy -D --locked --all-features, workspace tests --locked --all-features, doc-tests --locked --all-features, doc build -D warnings, release build --locked, canary `shiplog` publish --dry-run --locked. Sibling jobs: cargo-deny dependency policy, Policy gates (runs policy ledger checks plus source-of-truth validators, with cargo-allow replacing the non-Rust file-policy xtask gate; added in PR #165 and expanded for SHIPLOG-SPEC-0010).\""," \"taiki-e/install-action@cargo-deny\",","created = \"2026-05-09\"","path = \".github/workflows/release.yml\"","reason = \"Swarm release-verification pipeline; builds and retains candidate artifacts but has no GitHub Release write authority. Canonical source restores explicitly authorized release writers as source-only governance.\""," \"actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\","," \"actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c\","," \"taiki-e/install-action@v2\",","path = \".github/workflows/security.yml\"","reason = \"Standalone cargo-deny on push/PR/weekly. Duplicate of ci.yml#deny on PR; PR #155 routes to manifest changes / weekly / label only.\""," \"dtolnay/rust-toolchain@stable\",","duplicate_of_lane = \"lane.ci_deny\"","path = \".github/workflows/em-ci-routed-shiplog-rust.yml\"","reason = \"shiplog-swarm routed Linux gate. Routes trusted same-repo PRs through CPX42, then CX43, then CX53, then GitHub-hosted fallback, while fork PRs stay off self-hosted runners. Normalizes branch protection to Shiplog Rust Small Result; implementation jobs are conditional and should not be required checks.\"","secrets_used = [\"EM_RUNNER_READ_TOKEN\"]","created = \"2026-05-21\"","path = \".github/workflows/property-testing.yml\"","reason = \"Property tests at 256 cases per crate. Currently runs full sweep on every PR; PR #154 carves out a bounded smoke; PR #155 routes broad form.\"","path = \".github/workflows/bdd-testing.yml\"","reason = \"BDD scenarios across 4 jobs. Currently runs full matrix on every PR; PR #154 carves out a critical-flow smoke; PR #155 routes broad form.\"","path = \".github/workflows/fuzzing.yml\"","reason = \"Quick fuzz on PR (9 targets × 30s) + extended fuzz on nightly cron (9 targets × 60min). PR #154 carves out touched-target smoke; PR #155 routes full matrix to nightly + label.\"","path = \".github/workflows/mutation-testing.yml\"","reason = \"Mutation testing across 22 crates (3 tiers, advisory). Off PR (correctly), Mon weekly cron + dispatch.\"","path = \".github/workflows/coverage.yml\"","reason = \"Codecov execution-surface coverage. Push main + label-gated PR (coverage / full-ci) + dispatch.\"","secrets_used = [\"CODECOV_TOKEN\"]"," \"codecov/codecov-action@v7\",","path = \".github/workflows/droid.yml\"","reason = \"Out-of-band @droid mention handler (interactive).\"","permissions = [\"contents:read\", \"pull-requests:write\", \"issues:write\", \"id-token:write\", \"actions:read\"]","secrets_used = [\"MINIMAX_API_KEY\", \"FACTORY_API_KEY\"]"," \"EffortlessMetrics/droid-action-safe@7c1377ccbacddc95560d1570547a5baa51de01ec\",","path = \".github/workflows/droid-review.yml\"","reason = \"Factory Droid auto-review on PR open/sync/ready_for_review/reopened. Advisory only; bot failure is not code failure.\"","permissions = [\"contents:write\", \"pull-requests:write\", \"issues:write\", \"id-token:write\", \"actions:read\"]","path = \".github/workflows/droid-security-scan.yml\"","reason = \"Factory Droid weekly security scan.\"",".github/workflows/release.yml",[2165],{"_2067":853,"_2068":2166,"_656":2167,"_2071":59},752,[2168,305,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,2180,2177,2181,2182,305,2183,2184,305,2185,2186,305,2187,2188,2189,2190,2191,2192,2193,2194,305,2195,2196,2197,2198,2199,305,2200,2201,2202,2203,2204,2205,2206,2207,2208,2209,305,2210,2211,2212,2213,2214,2215,2216,2217,305,2218,2219,2220,2217,305,2221,305,2222,2202,2208,2209,2223,2224,2225,305,2226,2227,2202,2208,2209,2223,2228,2229,2230,2231,2220,2217,2232,2233,2220,2217,2234,305,2235,2236,305,2237,2238,2198,2239,2240,305,2241,2198,2242,305,2243,2244,2198,2245,305,2246,2247,305,2248,2249,305,2250,2251,2252,2253,2254,2255,2256,2257,2258,2259,2260,2261,2262,2260,2263,2264,2260,2265,2266,2267,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2237,2238,2198,2239,305,2271,2272,305,2273,2274,2198,2275,2276,305,2277,2274,2198,2278,2279,305,2280,2274,2198,2281,2282,305,2283,2284,305,2285,2202,2208,2209,2286,2287,2288,2289,2290,2291,2220,2217,2292,305,2293,2294,2198,2295,2296,2297,305,2298,2299,2300,2191,2301,2192,2302,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2303,2304,2202,2208,2305,2306,2307,305,2308,2202,2203,2204,2208,2209,2309,2310,2311,2312,2313,2314,2217,305,2315,2316,2317,2191,2318,2192,2319,2320,2321,2322,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2323,2324,2198,2325,305,2326,2327,2202,2203,2328,2329,2330,2331,2332,2208,2209,2333,305,2334,2335,2336,2337,2338,2339,2340,2341,2342,2343,2214,2215,2344,305,2345,2340,2346,2344,2347,305,2348,2349,2350,2351,2352,2353,2354,2355,2356,2357,2358,305,2359,2360,2361,2362,2363,305,2364,2365,2294,2198,2366,2367,2368,2369,2370,2371,2372,2373,2297,305,2374,2202,2208,2309,2375,2376,2377,2378,2379,2380,2381,2312,305,2382,2383,2384,2191,2385,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2386,2324,2198,2366,2387,305,2388,2202,2208,2209,2389,2390,2391,2392,2393,2394,2395,2396,305,2397,2202,2208,2209,2398,2399,2400,2395,2401,2402,2403,2404,2405,305,2406,2238,2198,2239,305,2280,2274,2198,2281,2407,305,2408,2409,305,2410,2202,2208,2209,2411,2412,2413,2414,2415,2416,2417,2418,2419,2420,2421,2422,2423,2424,2425,2426,2427,305,2428,2202,2208,2429,2430,2431,2432,2433,2434,2217,305,2435,2202,2208,2309,2436,2437,2438,2439,2440,2441,2442,2312,305,2443,2444,2445,2253,2385,2255,2446,2256,2257,2447,2448,2449,2259,2450,2451,2449,2262,2452,2453,2449,2264,2454,2455,2456,2266,305,2195,2457,2197,2198,2199,2268,305,2269,2202,2270,305,2458,2324,2198,2366,2459,305,2460,2461,2202,2203,2462,2463,2464,305,2465,2466,2467,2203,2462,2463,2468,305,2469,2470,2294,2198,2471,2472,2473,2474,305,2475,2476,2477,2478,2385,305,2195,2457,2197,2198,2199,2268,305,2269,2202,2203,2329,2479,305,2458,2324,2198,2366,2459,305,2480,2202,2203,2328,2329,2208,2209,2481,2482,2483,2484,2485,305,2486,2487,2488,2489,2490,2491,2220,2217,2492,305,2493,2202,2203,2328,2329,2208,2209,2494,2495,2482,2483,2484,305,2496,2497,2498,2499,2500,2501,305,2502,2503,2504,2505,2506,2507,2508,305,2509,2510,2511,2505,2512,2513,305,2486,2487,2514,2489,2515,2516,2220,2217,2517,305,2518,2470,2294,2198,2519,2367,2520,2521,2473,2474,305,2522,2523,2524,2191,2318,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2237,2238,2198,2239,305,2280,2274,2198,2281,2407,305,2525,2526,305,2527,2470,2202,2208,2528,2529,2530,305,2531,2532,2533,2478,2534,2535,2536,2537,2538,2539,2540,2541,305,2195,2542,2202,2203,2543,2544,2545,2546,2547,2548,2208,2209,2549,2550,2551,2552,2553,2554,2555,2556,2557,2214,2215,2344,305,2558,2202,2203,2328,2329,2559,2560,2561,2562,2208,2209,2563,2350,2351,2564,2565,2566,2567,2568,2569,2570,2571,2572,2357,2573,2574,305,2309,2575,2437,2576,2577,2578,2579,2580,2581,2582,2583,2584,2437,2585,2312,305,2586,2294,2198,2587,2588,2589],"name: Release","on:"," push:"," tags:"," - 'v*'"," workflow_dispatch:"," inputs:"," release_tag:"," description: \"Existing semver tag to release, e.g. v0.8.1\""," required: true"," type: string"," owner_approved_release_execution:"," description: \"Owner explicitly approved release execution\""," type: boolean"," default: false","env:"," CARGO_TERM_COLOR: always","permissions:"," contents: read","jobs:"," # Prove the package surface and resolve one immutable tagged source commit."," release-preflight:"," name: Release Preflight"," runs-on: ${{ github.repository == 'EffortlessMetrics/shiplog-swarm' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && 'self-hosted' || 'ubuntu-latest' }}"," outputs:"," release_tag: ${{ steps.release_tag.outputs.release_tag }}"," release_sha: ${{ steps.release_commit.outputs.release_sha }}"," steps:"," - name: Checkout code"," uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1"," with:"," persist-credentials: false"," - name: Resolve release tag"," id: release_tag"," shell: bash"," env:"," EVENT_NAME: ${{ github.event_name }}"," REF_NAME: ${{ github.ref_name }}"," INPUT_RELEASE_TAG: ${{ inputs.release_tag }}"," INPUT_OWNER_APPROVED: ${{ inputs.owner_approved_release_execution }}"," run: |"," set -euo pipefail"," tag=\"$REF_NAME\""," if [[ \"$EVENT_NAME\" == \"workflow_dispatch\" ]]; then"," if [[ \"$INPUT_OWNER_APPROVED\" != \"true\" ]]; then"," echo \"manual release workflow dispatch requires owner approval\" >&2"," exit 1"," fi"," tag=\"$INPUT_RELEASE_TAG\""," fi"," if [[ ! \"$tag\" =~ ^v[0-9]+\\.[0-9]+\\.[0-9]+$ ]]; then"," echo \"release workflow requires an explicit semver tag like v0.8.1; got '$tag'\" >&2"," exit 1"," echo \"release_tag=$tag\" >> \"$GITHUB_OUTPUT\""," - name: Checkout exact release tag"," tag=\"${{ steps.release_tag.outputs.release_tag }}\""," git fetch --force --depth=1 origin \"refs/tags/$tag:refs/tags/$tag\""," git checkout --detach \"$tag\""," - name: Resolve immutable release commit"," id: release_commit"," release_sha=\"$(git rev-parse HEAD)\""," tag_commit=\"$(git rev-list -n 1 \"$tag\")\""," if [[ \"$release_sha\" != \"$tag_commit\" ]]; then"," echo \"checked out $release_sha, but $tag resolves to $tag_commit\" >&2"," if [[ ! \"$release_sha\" =~ ^[0-9a-f]{40}$ ]]; then"," echo \"release tag did not resolve to a full commit SHA\" >&2"," echo \"release_sha=$release_sha\" >> \"$GITHUB_OUTPUT\""," - name: Release hold guard"," run: bash scripts/check-release-hold.sh \"${{ steps.release_tag.outputs.release_tag }}\""," - name: Install Rust toolchain"," uses: dtolnay/rust-toolchain@master"," toolchain: \"1.95.0\""," components: rustfmt, clippy"," - uses: Swatinem/rust-cache@v2"," shared-key: \"release-preflight\""," - name: Install cargo-deny"," uses: taiki-e/install-action@v2"," tool: cargo-deny"," - name: Package proof"," run: ./scripts/package-proof.sh"," - name: Publish dry run (allowlist)"," run: scripts/publish-dry-run.sh"," # Build the exact tagged binary on every supported target."," build-binary:"," name: Build ${{ matrix.target }}"," runs-on: ${{ matrix.os }}"," needs: release-preflight"," strategy:"," matrix:"," include:"," - os: ubuntu-latest"," target: x86_64-unknown-linux-gnu"," ext: ''"," - os: macos-15-intel"," target: x86_64-apple-darwin"," - os: macos-15"," target: aarch64-apple-darwin"," - os: windows-latest"," target: x86_64-pc-windows-msvc"," ext: .exe"," ref: ${{ needs.release-preflight.outputs.release_tag }}"," - name: Confirm exact release commit"," run: test \"$(git rev-parse HEAD)\" = \"${{ needs.release-preflight.outputs.release_sha }}\""," - name: Install Rust target"," run: rustup target add ${{ matrix.target }}"," - name: Cache cargo registry"," uses: actions/cache@v6"," path: ~/.cargo/registry"," key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}"," - name: Cache cargo index"," path: ~/.cargo/git"," key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }}"," - name: Cache cargo build"," path: target"," key: ${{ runner.os }}-${{ matrix.target }}-cargo-release-${{ hashFiles('**/Cargo.lock') }}"," - name: Build release"," run: cargo build --release --target ${{ matrix.target }} -p shiplog --locked"," - name: Stage binary"," mkdir -p dist"," src=\"target/${{ matrix.target }}/release/shiplog${{ matrix.ext }}\""," dest=\"dist/shiplog-${{ matrix.target }}${{ matrix.ext }}\""," if [[ ! -f \"$src\" ]]; then"," echo \"missing expected binary: $src\" >&2"," find target -maxdepth 4 -type f -name 'shiplog*' -print >&2 || true"," cp \"$src\" \"$dest\""," - name: Upload binary"," uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7"," name: shiplog-${{ matrix.target }}"," path: dist/shiplog-${{ matrix.target }}${{ matrix.ext }}"," retention-days: 5"," # Swarm records the source handoff; canonical source creates the draft release."," create-release:"," name: Create Release"," needs: [release-preflight, build-binary]"," version: ${{ steps.version.outputs.version }}"," - name: Extract version"," id: version"," VERSION=${{ needs.release-preflight.outputs.release_tag }}"," VERSION=${VERSION#v}"," echo \"version=$VERSION\" >> \"$GITHUB_OUTPUT\""," - name: Record source release handoff"," {"," echo \"Swarm verifies release inputs but cannot create a GitHub release.\""," echo \"Promote this exact proven tree to EffortlessMetrics/shiplog for authorized release execution.\""," } >> \"$GITHUB_STEP_SUMMARY\""," if [[ \"$EVENT_NAME\" == \"pull_request\" ]]; then"," echo \"::warning::Pull request runs are verification-only; no release is created.\""," # Assemble one immutable workflow-staged candidate set before acceptance."," upload-assets:"," name: Stage Release Candidates"," needs: [release-preflight, build-binary, create-release]"," candidate_artifact_id: ${{ steps.candidates.outputs.artifact-id }}"," candidate_artifact_digest: ${{ steps.candidates.outputs.artifact-digest }}"," candidate_manifest_sha256: ${{ steps.candidate_manifest.outputs.candidate_manifest_sha256 }}"," checksum_manifest_sha256: ${{ steps.candidate_manifest.outputs.checksum_manifest_sha256 }}"," - name: Download all binary artifacts"," uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1"," path: artifacts"," - name: Generate candidate manifest and checksums"," id: candidate_manifest"," RELEASE_TAG: ${{ needs.release-preflight.outputs.release_tag }}"," RELEASE_SHA: ${{ needs.release-preflight.outputs.release_sha }}"," RELEASE_REPOSITORY: ${{ github.repository }}"," WORKFLOW_RUN_ID: ${{ github.run_id }}"," WORKFLOW_RUN_ATTEMPT: ${{ github.run_attempt }}"," cd artifacts"," expected=("," \"shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\""," \"shiplog-x86_64-apple-darwin/shiplog-x86_64-apple-darwin\""," \"shiplog-aarch64-apple-darwin/shiplog-aarch64-apple-darwin\""," \"shiplog-x86_64-pc-windows-msvc/shiplog-x86_64-pc-windows-msvc.exe\""," )"," for path in \"${expected[@]}\"; do"," if [[ ! -f \"$path\" ]]; then"," echo \"missing expected staged binary: $path\" >&2"," find . -maxdepth 3 -type f -print >&2"," done"," : > SHA256SUMS.txt"," sha256sum \"$path\" >> SHA256SUMS.txt"," checksum_manifest_sha256=\"$(sha256sum SHA256SUMS.txt | awk '{print $1}')\""," cat > RELEASE_CANDIDATE.txt <> \"$GITHUB_OUTPUT\""," echo \"candidate_manifest_sha256=$candidate_manifest_sha256\" >> \"$GITHUB_OUTPUT\""," cat RELEASE_CANDIDATE.txt"," cat SHA256SUMS.txt"," - name: Retain exact staged release candidates"," id: candidates"," name: verified-release-candidates"," path: |"," artifacts/shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu"," artifacts/shiplog-x86_64-apple-darwin/shiplog-x86_64-apple-darwin"," artifacts/shiplog-aarch64-apple-darwin/shiplog-aarch64-apple-darwin"," artifacts/shiplog-x86_64-pc-windows-msvc/shiplog-x86_64-pc-windows-msvc.exe"," artifacts/SHA256SUMS.txt"," artifacts/RELEASE_CANDIDATE.txt"," - name: Record staged candidate identity"," echo \"## Workflow-staged candidate\""," echo \"- Tag: \\`${{ needs.release-preflight.outputs.release_tag }}\\`\""," echo \"- Source commit: \\`${{ needs.release-preflight.outputs.release_sha }}\\`\""," echo \"- Artifact id: \\`${{ steps.candidates.outputs.artifact-id }}\\`\""," echo \"- Artifact digest: \\`${{ steps.candidates.outputs.artifact-digest }}\\`\""," echo \"- Candidate manifest SHA-256: \\`${{ steps.candidate_manifest.outputs.candidate_manifest_sha256 }}\\`\""," echo \"- Checksum manifest SHA-256: \\`${{ steps.candidate_manifest.outputs.checksum_manifest_sha256 }}\\`\""," # Validate the staged candidate while retaining independent release-mode checks."," release-validation:"," name: Release Validation"," needs: [release-preflight, upload-assets]"," - name: Download staged candidate set"," path: candidate"," - name: Verify staged candidate identity"," grep -Fxq \"schema_version=1\" candidate/RELEASE_CANDIDATE.txt"," grep -Fxq \"release_tag=${{ needs.release-preflight.outputs.release_tag }}\" candidate/RELEASE_CANDIDATE.txt"," grep -Fxq \"source_sha=${{ needs.release-preflight.outputs.release_sha }}\" candidate/RELEASE_CANDIDATE.txt"," grep -Fxq \"asset_count=4\" candidate/RELEASE_CANDIDATE.txt"," expected=\"$(sed -n 's/^checksum_manifest_sha256=//p' candidate/RELEASE_CANDIDATE.txt)\""," actual=\"$(sha256sum candidate/SHA256SUMS.txt | awk '{print $1}')\""," test \"$actual\" = \"$expected\""," test \"$(sha256sum candidate/RELEASE_CANDIDATE.txt | awk '{print $1}')\" = \"${{ needs.upload-assets.outputs.candidate_manifest_sha256 }}\""," - name: Smoke staged Linux candidate"," binary=\"candidate/shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\""," expected=\"$(awk '$2 == \"shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\" {print $1}' candidate/SHA256SUMS.txt)\""," actual=\"$(sha256sum \"$binary\" | awk '{print $1}')\""," chmod +x \"$binary\""," \"$binary\" --help"," \"$binary\" --version"," \"$binary\" collect --help"," \"$binary\" render --help"," - name: Install Rust toolchain for independent release-mode checks"," key: ${{ runner.os }}-cargo-release-${{ hashFiles('**/Cargo.lock') }}"," - name: Build independent release-mode test binary"," run: cargo build --release -p shiplog --locked"," - name: Run independent command smoke tests"," ./target/release/shiplog --help"," ./target/release/shiplog --version"," ./target/release/shiplog help"," ./target/release/shiplog init --help"," ./target/release/shiplog doctor --help"," ./target/release/shiplog config --help"," ./target/release/shiplog collect --help"," ./target/release/shiplog collect github --help"," ./target/release/shiplog collect gitlab --help"," ./target/release/shiplog collect jira --help"," ./target/release/shiplog collect linear --help"," ./target/release/shiplog collect multi --help"," ./target/release/shiplog workstreams --help"," ./target/release/shiplog render --help"," ./target/release/shiplog cache --help"," ./target/release/shiplog runs --help"," ./target/release/shiplog open --help"," - name: Check versionless installers"," bash -n scripts/install.sh"," scripts/install.sh --help"," cargo metadata --no-deps --format-version 1 >/dev/null"," if command -v pwsh >/dev/null 2>&1; then"," pwsh -NoProfile -Command '$null = [scriptblock]::Create((Get-Content scripts/install.ps1 -Raw))'"," pwsh -NoProfile -File scripts/install.ps1 --help"," - name: Generate validation summary"," echo \"# Release Validation Results\""," echo"," echo \"- Staged candidate artifact digest: \\`${{ needs.upload-assets.outputs.candidate_artifact_digest }}\\`\""," echo \"- Candidate manifest SHA-256: \\`${{ needs.upload-assets.outputs.candidate_manifest_sha256 }}\\`\""," echo \"- Staged Linux candidate help/version/collect/render: **PASSED**\""," echo \"- Independent release-mode command checks: **PASSED**\""," echo \"- Multi-platform candidate assembly: **PASSED**\""," # Prove the same workflow-staged bytes from empty directories on all targets."," release-binary-acceptance:"," name: First-use ${{ matrix.name }}"," fail-fast: false"," - name: Linux x86_64"," os: ubuntu-latest"," shell: bash"," - name: macOS Intel"," os: macos-15-intel"," - name: macOS Apple Silicon"," os: macos-15"," - name: Windows x86_64"," os: windows-latest"," shell: pwsh"," - name: Checkout release scripts"," - name: Download exact staged candidate set"," path: ${{ runner.temp }}/release-candidate"," - name: Run staged-binary first-use acceptance (Unix)"," if: matrix.shell == 'bash'"," SHIPLOG_RELEASE_CANDIDATE_DIR: ${{ runner.temp }}/release-candidate"," SHIPLOG_RELEASE_SOURCE_SHA: ${{ needs.release-preflight.outputs.release_sha }}"," run: bash scripts/release-install-smoke.sh \"${{ needs.release-preflight.outputs.release_tag }}\""," - name: Run staged-binary first-use acceptance (Windows)"," if: matrix.shell == 'pwsh'"," shell: pwsh"," run: pwsh -NoProfile -File scripts/release-install-smoke.ps1 \"${{ needs.release-preflight.outputs.release_tag }}\""," - name: Upload first-use diagnostics and receipts"," if: always()"," name: release-first-use-${{ matrix.target }}"," path: target/release-install-smoke/${{ needs.release-preflight.outputs.release_tag }}"," if-no-files-found: warn"," retention-days: 14"," # Prove checksum and executable failures cannot satisfy the candidate gate."," release-candidate-negative-controls:"," name: Release Candidate Negative Controls"," runs-on: ubuntu-latest"," run: test \"$(git rev-parse HEAD)\" = \"$RELEASE_SHA\""," - name: Prove corrupted checksum is rejected"," root=\"$RUNNER_TEMP/checksum-broken\""," rm -rf \"$root\""," mkdir -p \"$root\""," cp -a \"$RUNNER_TEMP/release-candidate/.\" \"$root/\""," printf '\\ncorrupt\\n' >> \"$root/shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\""," if SHIPLOG_RELEASE_CANDIDATE_DIR=\"$root\" \\"," SHIPLOG_RELEASE_SOURCE_SHA=\"$RELEASE_SHA\" \\"," SHIPLOG_RELEASE_SMOKE_DIR=\"$RUNNER_TEMP/checksum-control-work\" \\"," bash scripts/release-install-smoke.sh \"$RELEASE_TAG\" \\"," >\"$RUNNER_TEMP/checksum-control.log\" 2>&1; then"," echo \"corrupted candidate unexpectedly passed\" >&2"," grep -q \"checksum mismatch\" \"$RUNNER_TEMP/checksum-control.log\""," - name: Prove broken executable command is rejected"," root=\"$RUNNER_TEMP/command-broken\""," asset_rel=\"shiplog-x86_64-unknown-linux-gnu/shiplog-x86_64-unknown-linux-gnu\""," cat > \"$root/$asset_rel\" <<'BROKEN'"," #!/usr/bin/env bash"," exit 42"," BROKEN"," sed -i 's/^ //' \"$root/$asset_rel\""," chmod +x \"$root/$asset_rel\""," replacement_sha=\"$(sha256sum \"$root/$asset_rel\" | awk '{print $1}')\""," awk -v asset=\"$asset_rel\" -v replacement=\"$replacement_sha\" '"," $2 == asset { print replacement \" \" asset; found=1; next }"," { print }"," END { if (!found) exit 1 }"," ' \"$root/SHA256SUMS.txt\" > \"$root/SHA256SUMS.txt.new\""," mv \"$root/SHA256SUMS.txt.new\" \"$root/SHA256SUMS.txt\""," sums_sha=\"$(sha256sum \"$root/SHA256SUMS.txt\" | awk '{print $1}')\""," awk -F= -v OFS== -v digest=\"$sums_sha\" '"," $1 == \"checksum_manifest_sha256\" { $2=digest }"," ' \"$root/RELEASE_CANDIDATE.txt\" > \"$root/RELEASE_CANDIDATE.txt.new\""," mv \"$root/RELEASE_CANDIDATE.txt.new\" \"$root/RELEASE_CANDIDATE.txt\""," SHIPLOG_RELEASE_SMOKE_DIR=\"$RUNNER_TEMP/command-control-work\" \\"," >\"$RUNNER_TEMP/command-control.log\" 2>&1; then"," echo \"broken candidate executable unexpectedly passed\" >&2"," grep -q \"candidate binary failed --version\" \"$RUNNER_TEMP/command-control.log\""," - name: Upload negative-control evidence"," name: release-candidate-negative-controls"," ${{ runner.temp }}/checksum-control.log"," ${{ runner.temp }}/command-control.log"," # Run independent integration tests in release mode."," release-test:"," name: Release Integration Tests"," - name: Run release tests"," run: cargo test --release --workspace --exclude shiplog-testkit --locked"," - name: Generate test summary"," echo \"# Release Integration Test Results\" >> \"$GITHUB_STEP_SUMMARY\""," echo \"\" >> \"$GITHUB_STEP_SUMMARY\""," echo \"All integration tests passed in release mode!\" >> \"$GITHUB_STEP_SUMMARY\""," # One terminal authority for human source-side publication."," release-candidate-ready:"," name: Release Candidate Ready"," if: always()"," needs:"," - release-preflight"," - upload-assets"," - release-validation"," - release-binary-acceptance"," - release-candidate-negative-controls"," - release-test"," - name: Require every candidate gate"," PREFLIGHT_RESULT: ${{ needs.release-preflight.result }}"," STAGE_RESULT: ${{ needs.upload-assets.result }}"," VALIDATION_RESULT: ${{ needs.release-validation.result }}"," FIRST_USE_RESULT: ${{ needs.release-binary-acceptance.result }}"," NEGATIVE_CONTROL_RESULT: ${{ needs.release-candidate-negative-controls.result }}"," RELEASE_TEST_RESULT: ${{ needs.release-test.result }}"," for result in \\"," \"$PREFLIGHT_RESULT\" \\"," \"$STAGE_RESULT\" \\"," \"$VALIDATION_RESULT\" \\"," \"$FIRST_USE_RESULT\" \\"," \"$NEGATIVE_CONTROL_RESULT\" \\"," \"$RELEASE_TEST_RESULT\"; do"," if [[ \"$result\" != \"success\" ]]; then"," echo \"release candidate gate is not green: $result\" >&2"," - name: Record release candidate authority"," CANDIDATE_ARTIFACT_ID: ${{ needs.upload-assets.outputs.candidate_artifact_id }}"," CANDIDATE_ARTIFACT_DIGEST: ${{ needs.upload-assets.outputs.candidate_artifact_digest }}"," CANDIDATE_MANIFEST_SHA256: ${{ needs.upload-assets.outputs.candidate_manifest_sha256 }}"," CHECKSUM_MANIFEST_SHA256: ${{ needs.upload-assets.outputs.checksum_manifest_sha256 }}"," cat > release-candidate-ready.txt <

ℹ️ About Codex in GitHub

","side","line","**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Bind tag-push resolution to the triggering commit**\n\nFailure mode: On a tag-push run, this force-fetch resolves the tag from its current remote value instead of binding it to the triggering `github.sha`; if the tag is moved after the webhook is created but before preflight executes, the workflow can build and certify a different commit while still reporting success for the original tag event. Why here: every downstream comparison uses the newly resolved `release_sha`, so none detects this initial substitution. Fix direction: for `push` events, require the peeled tag commit to equal the event SHA (while retaining current-tag resolution for approved manual dispatches). Validation: trigger a run and retarget the tag before this fetch, then verify preflight rejects the mismatch. Confidence: high. This is particularly important because tag and release operations remain source-repository authority.\n\nAGENTS.md reference: [AGENTS.md:L14-L17](https://github.com/EffortlessMetrics/shiplog-swarm/blob/46fd16c469eca8eae4420a9c1d6980aa922bfbf8/AGENTS.md#L14-L17)\n\nUseful? React with 👍 / 👎.","RIGHT",73,"@codex review\n\nPlease review the current final head, especially exact tag/source/artifact binding, complete four-platform bundle validation, failure controls, matrix consumption of staged bytes, and the terminal readiness aggregate.","[P1] Assert the negative-control checkout resolves the preflight SHA\n\nFailure mode:\nThe `release-candidate-negative-controls` job checks out `${{ needs.release-preflight.outputs.release_tag }}` and immediately runs `scripts/release-install-smoke.sh`, but never compares `git rev-parse HEAD` with `${{ needs.release-preflight.outputs.release_sha }}`. If the tag resolution changes between preflight and this job, the negative controls can execute a different release-script revision while reporting evidence for the preflight candidate.\n\nWhy here:\nThis PR's core contract is one immutable exact-tag candidate set. Every job that executes release scripts must prove the checkout identity, not only the artifact manifest identity.\n\nFix direction:\nAdd the same exact-commit assertion used by the other release jobs immediately after the checkout:\n`test \"$(git rev-parse HEAD)\" = \"${{ needs.release-preflight.outputs.release_sha }}\"`.\nRetain the existing staged-artifact and negative-control assertions.\n\nValidation:\nExercise a tag/ref mismatch fixture or equivalent workflow proof and confirm the negative-control job fails before invoking either smoke script.\n\nConfidence:\nHigh; inspected current head `595e6152c3370c85a069caf9f12b5264c2d5c1ce`, `.github/workflows/release.yml:516-520`.","**Actionable comments posted: 11**\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (1)

\n> \n>
\n>
.github/workflows/release.yml (1)
\n> \n> `304-316`: _🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\n> \n> **Align candidate retention with the receipt retention.**\n> \n> The staged candidate set expires after 5 days. The readiness receipt at Line 732 is retained for 30 days and records `candidate_artifact_id` and `candidate_artifact_digest`. For 25 of those days the receipt names bytes that no longer exist, so a human cannot re-verify the digest before authorizing publication.\n> \n> Set `retention-days` here to match the receipt, or shorten the receipt retention.\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In @.github/workflows/release.yml around lines 304 - 316, Update the\n> retention-days setting in the “Retain exact staged release candidates” step to\n> 30 days, matching the readiness receipt retention and preserving candidate\n> artifacts for the full verification window.\n> ```\n> \n>
\n> \n> \n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n

🪄 Autofix

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Organization UI\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro Plus\n\n**Run ID**: `3dd83058-a03d-4c42-9260-fb97321a663a`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between b816b6032e85ed698ae34ac1d60974cd6f8b8f53 and a54884d2f0b2660bd57b301504dce8df7f7cab5e.\n\n

\n\n

📒 Files selected for processing (4)

\n\n* `.github/workflows/release.yml`\n* `apps/shiplog/tests/release_candidate_smoke.rs`\n* `scripts/release-install-smoke.ps1`\n* `scripts/release-install-smoke.sh`\n\n

\n\n

\n\n","_🩺 Stability & Availability_ | _🟡 Minor_ | _⚡ Quick win_\n\n**Resolve `binary_path` to an absolute path before the `cd`.**\n\nThe subshell changes directory to `$cold_start_dir`, then invokes `\"$binary_path\"`. `binary_path` is derived from `work_dir`, which the documented `SHIPLOG_RELEASE_SMOKE_DIR` override at Line 17 can set to a relative path. In that case the invocation fails here with a confusing \"no such file\" error, even though the candidate binary is valid. The candidate path is already normalized this way at Line 168.\n\n

🐛 Proposed fix

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@scripts/release-install-smoke.sh` around lines 259 - 264, Normalize\n`binary_path` to an absolute path before the subshell changes directories,\nmatching the existing candidate-path normalization pattern near the release\nsmoke setup. Ensure the invocation in the `cold_start_dir` subshell uses that\nabsolute `binary_path` while preserving the current validation arguments.\n```\n\n

\n\n\n\n\n\n\n\n","scripts/release-install-smoke.sh",329,"_🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\n\n

🧩 Analysis chain

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@scripts/release-install-smoke.sh` around lines 188 - 192, Update the checksum\nlookup in the SHA256SUMS verification block to match both flat filenames and\ndirectory-prefixed entries, reusing the basename-matching behavior from the\nPowerShell smoke script. Escape the asset value before using it in the awk\nregular expression, while preserving the existing missing-entry failure\nbehavior.\n```\n\n

\n\n\n\n\n\n\n\n",257,"_🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Match the PowerShell validator and reject duplicated manifest fields.**\n\n`scripts/release-install-smoke.ps1` Lines 103-108 parse `RELEASE_CANDIDATE.txt` into a map and reject a malformed or duplicated field. This Bash validator uses `grep -Fxq` presence checks instead. A manifest that carries two `source_sha` lines, or two `release_tag` lines, satisfies every check here while the PowerShell validator rejects it. The two scripts then disagree about whether the same bundle is valid, which weakens the single-candidate-set guarantee this PR establishes.\n\nAdd a duplicate-key check before the field assertions.\n\n

♻️ Proposed refactor

\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n if awk -F= 'NF > 0 { if (seen[$1]++) { exit 1 } }' \"$manifest\"; then\n :\n else\n echo \"candidate manifest contains duplicated fields\" >&2\n exit 1\n fi\n\n grep -Fxq \"schema_version=1\" \"$manifest\" || {\n echo \"candidate manifest has unsupported schema\" >&2\n exit 1\n }\n grep -Fxq \"release_tag=$tag\" \"$manifest\" || {\n echo \"candidate manifest is not bound to $tag\" >&2\n exit 1\n }\n grep -Fxq \"source_sha=$expected_source_sha\" \"$manifest\" || {\n echo \"candidate manifest is not bound to source commit $expected_source_sha\" >&2\n exit 1\n }\n grep -Fxq \"asset_count=4\" \"$manifest\" || {\n echo \"candidate manifest does not record the four supported binaries\" >&2\n exit 1\n }\n```\n\n

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@scripts/release-install-smoke.sh` around lines 119 - 134, Update the Bash\nmanifest validation before the existing schema_version, release_tag, source_sha,\nand asset_count assertions to detect and reject duplicate manifest keys,\nmatching the parsing behavior in the PowerShell validator. Ensure each required\nfield appears exactly once while preserving the current field-value checks and\nerror handling.\n```\n\n

\n\n\n\n\n\n\n\n\n\n✅ Addressed in commits 595e615 to 52d5667","_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Rename `$matches` to avoid the PowerShell automatic variable.**\n\n`$Matches` is the automatic hashtable that the `-match` and `-notmatch` operators populate. `Assert-CandidateManifest` uses `-notmatch` at Lines 94 and 132. Assigning to `$matches` here shadows that automatic variable and PSScriptAnalyzer reports it as `PSAvoidAssignmentToAutomaticVariable`.\n\n

♻️ Proposed refactor

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🧰 Tools

\n\n

🪛 PSScriptAnalyzer (1.25.0)

\n\n

🤖 Prompt for AI Agents

\n\n\n\n\n\n\n\n_Source: Linters/SAST tools_\n\n","scripts/release-install-smoke.ps1",76,"_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**The Windows broken-executable path has no equivalent proof.**\n\nThis test is gated to unix because `scripts/release-install-smoke.ps1` reports execution failure and version mismatch under one message, `unexpected version output`. The Bash script separates them and emits `candidate binary failed --version`. The negative control at `.github/workflows/release.yml` Lines 551-594 also runs on `ubuntu-latest` only. The result is that a Windows candidate binary that cannot execute is never proven to be rejected by a distinct, assertable signal.\n\nConsider making the PowerShell script emit `candidate binary failed --version` when `$LASTEXITCODE -ne 0`, then removing the `#[cfg(unix)]` gate here.\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@apps/shiplog/tests/release_candidate_smoke.rs` around lines 246 - 248, Update\nscripts/release-install-smoke.ps1 to emit the distinct “candidate binary failed\n--version” signal when the candidate command exits with a nonzero $LASTEXITCODE,\nwhile retaining “unexpected version output” for successful commands with\nmismatched output. Then remove the #[cfg(unix)] gate from\nstaged_candidate_smoke_rejects_broken_command_with_matching_checksum so the same\nrejection assertion runs on Windows.\n```\n\n

\n\n\n\n\n\n\n\n","apps/shiplog/tests/release_candidate_smoke.rs",302,"_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Add error context to the bare `?` propagations.**\n\nThe file uses `.with_context(|| ...)` for most filesystem operations. These sites propagate `std::io::Error` with no context: Lines 104, 106, 209, 229, 231, 253, and 255. A failure reports only `Permission denied` with no path or operation, which is hard to diagnose in CI.\n\n

♻️ Proposed refactor for one site

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@apps/shiplog/tests/release_candidate_smoke.rs` around lines 101 - 107, In the\nrelease-candidate smoke test, update the filesystem operations around the Unix\npermission setup and the additional sites near lines 209, 229, 231, 253, and 255\nto attach context before propagating errors. Use static .context descriptions\nfor fixed operations and .with_context closures with the relevant path for\ndynamic operations, covering metadata, set_permissions, and other bare\nfilesystem ? calls while preserving the existing behavior.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n",114,"_📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_\n\n

🧩 Analysis chain

🤖 Prompt for AI Agents

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n",28,"_🗄️ Data Integrity & Integration_ | _🟡 Minor_ | _⚡ Quick win_\n\n**Add the exact-commit confirmation to this job.**\n\nEvery other job that checks out the tag also asserts `git rev-parse HEAD` equals `needs.release-preflight.outputs.release_sha`: Lines 147, 216, 252, 346, 476, and 622. This job omits that assertion, yet it executes `scripts/release-install-smoke.sh` from the checked-out tree. If the tag is moved between preflight and this job, the negative controls run against different script bytes than the ones the acceptance lane proved, and the readiness gate at Line 656 still reports success.\n\n

🔒️ Proposed fix

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🧰 Tools

\n\n

🪛 zizmor (1.28.0)

\n\n[error] 523-523: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)\n\n(unpinned-uses)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/release.yml around lines 516 - 526, Add an exact-commit\nverification step immediately after the checkout step in the job containing\n“Checkout release scripts,” comparing git rev-parse HEAD with\nneeds.release-preflight.outputs.release_sha and failing on mismatch. Keep the\nexisting artifact download and release-install-smoke.sh flow unchanged.\n```\n\n

\n\n\n\n\n\n\n\n",526,"_🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Derive `asset_count` from the `expected` array.**\n\nLine 293 hardcodes `asset_count=4` while Lines 266-271 define the real asset list. If a fifth target is added to the matrix and to `expected`, the manifest still reports 4. The validators at Line 361, `scripts/release-install-smoke.sh` Line 131, and `scripts/release-install-smoke.ps1` Line 119 all accept `4`, so the incomplete claim passes silently. Deriving the count makes that mismatch fail loudly.\n\n

♻️ Proposed refactor

\n\n```diff\n- asset_count=4\n+ asset_count=${`#expected`[@]}\n```\n

\n\n\n\n

📝 Committable suggestion

🧰 Tools

\n\n

🪛 zizmor (1.28.0)

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/release.yml around lines 286 - 296, Update the release\ncandidate metadata generation around RELEASE_CANDIDATE.txt to derive asset_count\nfrom the expected asset array defined earlier in the workflow instead of\nhardcoding 4. Ensure the computed count is written to the asset_count field so\nvalidators and smoke tests reflect every configured target.\n```\n\n

\n\n\n\n\n\n\n\n",296,"_🔒 Security & Privacy_ | _🟠 Major_ | _⚡ Quick win_\n\n

🧩 Analysis chain

🧰 Tools

\n\n

🪛 zizmor (1.28.0)

\n\n[error] 255-255: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)\n\n(unpinned-uses)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/release.yml around lines 254 - 257, Update every\nactions/download-artifact reference in the release workflow, including the steps\nnamed “Download all binary artifacts” and the other listed usages, to the\nimmutable commit SHA 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c and retain a # v8\ncomment on each reference.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Linters/SAST tools_\n\n","_📐 Maintainability & Code Quality_ | _🟡 Minor_ | _⚡ Quick win_\n\n**Send both handoff lines to the step summary.**\n\nLine 229 writes to stdout only. The recorded summary therefore omits the statement that Swarm cannot create a GitHub release, which is the point of this receipt.\n\n

🧹 Proposed fix

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n\n\n\n\n\n\n",230,"[P1] Make the staged-candidate success path pass receipt validation\n\nFailure mode:\nThe exact-head hosted `Shiplog Rust Small Result` run for this PR fails `staged_candidate_smoke_uses_local_bundle_and_emits_receipts`: `report validate --path \"$latest_run/intake.report.json\" --receipts` rejects the generated report because `reports.json` points at `.../out/merge_.../out/merge_.../intake.report.json` while the validated file is `.../out/merge_.../intake.report.json`.\n\nWhy here:\nThe new staged-candidate smoke contract makes this validation a required release gate at `scripts/release-install-smoke.sh:258`, so the PR's exact hosted gate is currently red even though the other three new tests pass.\n\nFix direction:\nAlign the receipt path contract used by the cold-start command and `report validate --receipts`—either emit the canonical run-relative path expected by the validator or resolve an already run-rooted path without prepending `out/` again. Keep the regression in `release_candidate_smoke` so this exact candidate path stays green.\n\nValidation:\nRerun `cargo test -p shiplog --test release_candidate_smoke --locked` and the routed `Shiplog Rust Small Result` check on the updated exact head.\n\nConfidence:\nHigh; reproduced in hosted run 30899824202, job 91961327124.","## CI budget acknowledgement\n\nThe PR planner selected the release-package, workflow-policy, and CLI-product risk packs: 11 lanes at an estimated ~165 LEM, placing this in the hard band. `ci-budget-override` is applied deliberately.\n\nThe spend is justified because this PR changes the exact release artifact trust boundary, platform smoke scripts, workflow policy surface, and cross-platform integration proof together. Splitting the workflow from the scripts/tests would create an intermediate contract that cannot prove the bytes it selects and would run overlapping release/policy lanes multiple times.\n\nSkipped nightly, coverage, mutation, and release-only lanes are not claimed as executed proof. A real explicit-tag run remains required before #245 can close.","\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/EffortlessMetrics/shiplog-swarm/pull/391?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\n\n\n> [!WARNING]\n> ## Review limit reached\n> \n> `@EffortlessSteven`, you've reached your PR review limit, so we couldn't start this review.\n> \n> **Next review available in:** **34 minutes**\n> \n> You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.\n> \n>

\n>

How can I continue?

\n> \n> \n>

\n>

How do review limits work?

\n> \n>

\n>

Review details

\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: Organization UI\n> \n> **Review profile**: ASSERTIVE\n> \n> **Plan**: Pro Plus\n> \n> **Run ID**: `b08ea09d-1c36-4ad2-bf5d-c9f5b1724c39`\n> \n>

\n> \n>

\n>

📥 Commits

\n> \n> Reviewing files that changed from the base of the PR and between a54884d2f0b2660bd57b301504dce8df7f7cab5e and 52d56676c07cf11b1e9a7d4f0b4b9039253d28d2.\n> \n>

\n> \n>

\n>

📒 Files selected for processing (3)

\n> \n> * `apps/shiplog/tests/release_candidate_smoke.rs`\n> * `scripts/release-install-smoke.ps1`\n> * `scripts/release-install-smoke.sh`\n> \n>

\n> \n>

🚥 Pre-merge checks | ✅ 5

\n\n

✅ Passed checks (5 passed)

\n\n

\n\n\n\n\n

✨ Finishing Touches

\n\n

📝 Generate docstrings

\n\n- [ ] Create stacked PR\n- [ ] Commit on current branch\n\n

🧪 Generate unit tests (beta)

\n\n- [ ] Create PR with unit tests\n- [ ] Commit unit tests in branch `fix/release-staged-candidate-gate`\n\n

\n\n

❤️ Share

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands.}\n\n","base_ref","head_ref","pull_request_info",[2715],{"_2017":46,"_46":2716},"@codex address that feedback\n\nAddress the current workflow-only findings without broadening scope:\n\n1. Pin all four `actions/download-artifact@v8` uses to official v8.0.1 commit `3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` with a version comment.\n2. In `create-release`, always write the general verification-only summary; keep the pull-request-specific warning additive.\n3. Derive `asset_count` from the `expected` array when generating `RELEASE_CANDIDATE.txt`; pass GitHub expression values through step `env` variables rather than embedding them directly in the shell body.\n4. In `release-candidate-negative-controls`, confirm `git rev-parse HEAD` equals the exact `release-preflight.outputs.release_sha` before using scripts from the checkout.\n\nDo not move the release fixture to `shiplog-testkit`; that private integration target deliberately exercises repository scripts and workflow-adjacent behavior, and moving it would add an unrelated crate dependency/public seam. Do not merge or mark the PR ready.",[3816,3817,3818],[],{"_2022":2023,"_46":2024,"_2025":2026},{"_1997":3807},{"_446":3806},{"_446":2802},{"_411":412,"_401":413,"_414":415,"_416":15,"_417":59,"_418":59,"_419":420,"_421":422,"_423":373,"_424":128,"_425":426,"_427":130,"_428":429,"_430":-5,"_431":-5,"_432":2801,"_434":435,"_436":437,"_438":439,"_440":441},{"_42":124,"_299":300,"_301":302,"_303":15,"_304":305,"_306":307,"_308":2790,"_310":-5,"_311":312,"_313":15,"_314":2791,"_316":305,"_317":305,"_318":2792,"_320":2793,"_322":2794,"_324":-5,"_325":326,"_327":328,"_329":330,"_331":2795,"_55":-5,"_120":333,"_334":2796,"_336":2797,"_338":339,"_340":15,"_341":15},{"_134":2785},[2727,2728,2729,2730,2731,2732,2733,2734,2735,2736,2737,2738,2739,2740,2741,2742,2743,2744,2745,2746,2747,2748,2749,2750,2751,2752,2753,2754,2755,2756,2757,2758,2759,2760,2761,2762,2763,2764,2765,2766,2767,2768,2769,2770,2771,2772,2773,2774,2775,2776,2777,2778,2779,2780,2781,2782,2783,2784],{"_201":283,"_203":204,"_205":206,"_207":233,"_209":275,"_211":212,"_213":32,"_214":-5},{"_201":281,"_203":204,"_205":206,"_207":233,"_209":282,"_211":212,"_213":32,"_214":-5},{"_201":279,"_203":204,"_205":206,"_207":208,"_209":280,"_211":212,"_213":32,"_214":-5},{"_201":278,"_203":204,"_205":206,"_207":208,"_209":271,"_211":212,"_213":32,"_214":-5},{"_201":276,"_203":204,"_205":206,"_207":270,"_209":271,"_211":212,"_213":277,"_214":-5},{"_201":274,"_203":204,"_205":206,"_207":233,"_209":275,"_211":212,"_213":32,"_214":-5},{"_201":273,"_203":204,"_205":206,"_207":208,"_209":271,"_211":212,"_213":32,"_214":-5},{"_201":269,"_203":204,"_205":206,"_207":270,"_209":271,"_211":212,"_213":272,"_214":-5},{"_201":268,"_203":204,"_205":206,"_207":233,"_209":265,"_211":212,"_213":32,"_214":-5},{"_201":267,"_203":204,"_205":206,"_207":208,"_209":265,"_211":212,"_213":32,"_214":-5},{"_201":266,"_203":204,"_205":206,"_207":233,"_209":265,"_211":212,"_213":32,"_214":-5},{"_201":264,"_203":204,"_205":206,"_207":208,"_209":265,"_211":212,"_213":32,"_214":-5},{"_201":263,"_203":204,"_205":206,"_207":233,"_209":237,"_211":212,"_213":32,"_214":-5},{"_201":262,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":261,"_203":204,"_205":206,"_207":233,"_209":234,"_211":212,"_213":32,"_214":-5},{"_201":260,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":259,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":258,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":257,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":256,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":255,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":254,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":253,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":252,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":251,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":250,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":249,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":248,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":247,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":246,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":245,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":244,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":243,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":242,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":241,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":240,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":239,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":238,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":236,"_203":204,"_205":206,"_207":233,"_209":237,"_211":212,"_213":32,"_214":-5},{"_201":235,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":232,"_203":204,"_205":206,"_207":233,"_209":234,"_211":212,"_213":32,"_214":-5},{"_201":231,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":230,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":229,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":228,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":227,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":226,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":225,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":224,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":223,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":221,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":220,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":219,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":218,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":217,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":216,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":215,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},[2786,2787],{"_287":2789,"_289":296},{"_287":2788,"_289":290},{"_291":292,"_93":293,"_120":294},{"_291":297,"_93":293,"_120":298},{"_403":404,"_405":406,"_407":305,"_408":-5,"_409":-5,"_410":-5},[363],{"_363":2798},{"_345":346,"_347":348,"_349":350,"_351":352,"_353":354,"_355":356,"_357":358,"_359":360,"_361":362},{},[],{"_344":59},{"_342":59,"_343":305},{"_42":365,"_291":302,"_366":2799,"_368":369,"_370":371,"_372":373,"_374":375,"_376":377,"_378":379,"_380":64,"_381":15,"_382":-5,"_383":-5,"_384":-5,"_385":-5,"_386":-5,"_387":-5,"_213":388,"_389":-5,"_55":2800},{"_395":396,"_42":397,"_93":398,"_399":400,"_401":402},{"_391":15,"_392":15,"_393":15,"_394":15},{"_395":442,"_291":442,"_443":-5,"_399":444,"_42":445},[2803,2804,2805,2806,2807,2808,2809,2810,2811,2812,2813,2814,2815,2816,2817,2818,2819,2820,2821,2822,2823,2824,2825,2826,2827,2828,2829,2830,2831,2832,2833,2834,2835,2836,2837,2838,2839,2840,2841,2842,2843,2844,2845,2846,2847,2848,2849,2850,2851,2852,2853,2854,2855,2856,2857,2858,2859,2860,2861,2862,2863,2864,2865,2866,2867,2868,2869,2870,2871,2872,2873,2874,2875,2876,2877,2878,2879,2880,2881,2882,2883,2884,2885,2886,2887,2888,2889,2890,2891,2892,2893,2894,2895,2896,2897,2898,2899,2900,2901,2902,2903,2904,2905,2906,2907,2908,2909,2910,2911,2912,2913,2914,2915,2916,2917,2918,2919,2920,2921,2922,2923,2924,2925,2926,2927,2928,2929,2930,2931,2932,2933,2934,2935,2936,2937,2938,2939,2940,2941,2942,2943,2944,2945,2946,2947,2948,2949,2950,2951,2952,2953,2954,2955,2956,2957,2958,2959,2960,2961,2962,2963,2964,2965,2966,2967,2968,2969,2970,2971,2972,2973,2974,2975,2976,2977,2978,2979,2980,2981,2982,2983],{"_207":1969,"_630":3802},{"_207":647,"_630":3799},{"_207":1959,"_630":3796},{"_207":651,"_630":3790},{"_207":651,"_630":3785},{"_207":651,"_630":3780},{"_207":651,"_630":3774},{"_207":651,"_630":3769},{"_207":669,"_630":3764},{"_207":669,"_630":3760},{"_207":651,"_630":3755},{"_207":651,"_630":3752},{"_207":669,"_630":3748},{"_207":651,"_630":3741},{"_207":669,"_630":3737},{"_207":651,"_630":3732},{"_207":651,"_630":3729},{"_207":669,"_630":3725},{"_207":651,"_630":3718},{"_207":669,"_630":3714},{"_207":651,"_630":3708},{"_207":651,"_630":3705},{"_207":651,"_630":3698},{"_207":669,"_630":3694},{"_207":669,"_630":3690},{"_207":651,"_630":3684},{"_207":651,"_630":3681},{"_207":651,"_630":3674},{"_207":669,"_630":3670},{"_207":651,"_630":3665},{"_207":651,"_630":3662},{"_207":651,"_630":3655},{"_207":669,"_630":3651},{"_207":669,"_630":3647},{"_207":651,"_630":3642},{"_207":651,"_630":3639},{"_207":669,"_630":3634},{"_207":651,"_630":3627},{"_207":651,"_630":3624},{"_207":651,"_630":3617},{"_207":669,"_630":3613},{"_207":669,"_630":3609},{"_207":651,"_630":3604},{"_207":651,"_630":3601},{"_207":651,"_630":3594},{"_207":669,"_630":3590},{"_207":651,"_630":3586},{"_207":651,"_630":3583},{"_207":651,"_630":3576},{"_207":651,"_630":3573},{"_207":651,"_630":3566},{"_207":651,"_630":3563},{"_207":651,"_630":3556},{"_207":651,"_630":3553},{"_207":651,"_630":3546},{"_207":651,"_630":3543},{"_207":651,"_630":3540},{"_207":669,"_630":3536},{"_207":651,"_630":3531},{"_207":651,"_630":3528},{"_207":651,"_630":3521},{"_207":669,"_630":3517},{"_207":651,"_630":3513},{"_207":651,"_630":3510},{"_207":651,"_630":3503},{"_207":669,"_630":3499},{"_207":651,"_630":3495},{"_207":651,"_630":3492},{"_207":651,"_630":3489},{"_207":651,"_630":3486},{"_207":651,"_630":3479},{"_207":669,"_630":3475},{"_207":651,"_630":3471},{"_207":651,"_630":3468},{"_207":651,"_630":3465},{"_207":651,"_630":3462},{"_207":651,"_630":3455},{"_207":669,"_630":3451},{"_207":651,"_630":3447},{"_207":651,"_630":3444},{"_207":651,"_630":3441},{"_207":651,"_630":3438},{"_207":651,"_630":3431},{"_207":669,"_630":3427},{"_207":651,"_630":3422},{"_207":651,"_630":3419},{"_207":669,"_630":3415},{"_207":651,"_630":3408},{"_207":669,"_630":3404},{"_207":651,"_630":3400},{"_207":651,"_630":3397},{"_207":651,"_630":3390},{"_207":669,"_630":3386},{"_207":669,"_630":3382},{"_207":651,"_630":3377},{"_207":651,"_630":3374},{"_207":669,"_630":3370},{"_207":651,"_630":3363},{"_207":669,"_630":3359},{"_207":651,"_630":3354},{"_207":651,"_630":3351},{"_207":669,"_630":3347},{"_207":651,"_630":3340},{"_207":669,"_630":3336},{"_207":651,"_630":3331},{"_207":651,"_630":3328},{"_207":669,"_630":3322},{"_207":651,"_630":3315},{"_207":669,"_630":3311},{"_207":651,"_630":3306},{"_207":651,"_630":3303},{"_207":669,"_630":3298},{"_207":651,"_630":3291},{"_207":669,"_630":3287},{"_207":651,"_630":3282},{"_207":651,"_630":3279},{"_207":651,"_630":3272},{"_207":669,"_630":3268},{"_207":669,"_630":3264},{"_207":651,"_630":3259},{"_207":651,"_630":3256},{"_207":669,"_630":3252},{"_207":651,"_630":3245},{"_207":669,"_630":3241},{"_207":651,"_630":3236},{"_207":651,"_630":3233},{"_207":669,"_630":3229},{"_207":651,"_630":3222},{"_207":669,"_630":3218},{"_207":651,"_630":3213},{"_207":651,"_630":3210},{"_207":651,"_630":3203},{"_207":669,"_630":3199},{"_207":651,"_630":3194},{"_207":651,"_630":3191},{"_207":669,"_630":3186},{"_207":651,"_630":3179},{"_207":669,"_630":3175},{"_207":651,"_630":3170},{"_207":651,"_630":3167},{"_207":651,"_630":3160},{"_207":669,"_630":3156},{"_207":669,"_630":3152},{"_207":651,"_630":3147},{"_207":651,"_630":3144},{"_207":651,"_630":3137},{"_207":669,"_630":3133},{"_207":669,"_630":3129},{"_207":651,"_630":3124},{"_207":651,"_630":3121},{"_207":651,"_630":3114},{"_207":669,"_630":3110},{"_207":669,"_630":3106},{"_207":651,"_630":3101},{"_207":651,"_630":3098},{"_207":651,"_630":3091},{"_207":669,"_630":3087},{"_207":669,"_630":3083},{"_207":651,"_630":3078},{"_207":651,"_630":3075},{"_207":651,"_630":3068},{"_207":669,"_630":3064},{"_207":669,"_630":3060},{"_207":651,"_630":3055},{"_207":651,"_630":3052},{"_207":651,"_630":3045},{"_207":669,"_630":3041},{"_207":669,"_630":3037},{"_207":651,"_630":3033},{"_207":651,"_630":3030},{"_207":651,"_630":3023},{"_207":669,"_630":3019},{"_207":669,"_630":3015},{"_207":651,"_630":3010},{"_207":651,"_630":3007},{"_207":669,"_630":3003},{"_207":651,"_630":2996},{"_207":669,"_630":2994},{"_207":651,"_630":2989},{"_207":647,"_630":2987},{"_207":629,"_630":2984},{"_632":633,"_88":2985},{"_635":636,"_637":638,"_104":-5,"_42":639,"_640":2986,"_642":643,"_644":645,"_646":114},[],{"_646":2988,"_632":633},{"_93":650},{"_653":2990,"_632":633,"_655":639},{"_656":2991,"_658":-5,"_42":659,"_660":2992,"_662":663,"_97":94,"_93":664},[2993],{"_665":639},{"_46":667,"_93":668},{"_671":672,"_653":2995,"_632":633,"_655":639},{"_42":659,"_662":663,"_46":667,"_93":674},{"_653":2997,"_632":633,"_655":639},{"_677":678,"_42":-5,"_660":2998,"_291":-5,"_680":2999,"_93":682},{"_665":639},{"_421":3000,"_684":-5},[3001,3002],{"_46":689,"_93":688},{"_46":687,"_93":688},{"_671":691,"_653":3004,"_632":633,"_655":639},{"_693":687,"_694":695,"_696":3005,"_698":699,"_637":32,"_700":32,"_42":701,"_702":703,"_704":705,"_646":114,"_93":706},[3006],{"_694":708,"_93":709},{"_653":3008,"_632":633,"_655":639},{"_677":678,"_42":712,"_713":714,"_660":3009,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3011,"_632":633,"_655":639},{"_656":-5,"_721":722,"_42":723,"_660":3012,"_725":3013,"_93":727},{"_665":639},[3014],{"_46":729,"_93":730},{"_671":732,"_653":3016,"_632":633,"_655":639},{"_656":3017,"_42":723,"_725":3018,"_93":727},[],[729],{"_671":737,"_653":3020,"_632":633,"_655":639},{"_693":739,"_694":740,"_696":3021,"_698":699,"_637":742,"_700":32,"_42":743,"_702":744,"_704":705,"_646":114,"_93":706},[3022],{"_694":746,"_93":709},{"_653":3024,"_632":633,"_655":639},{"_677":749,"_42":-5,"_660":3025,"_291":-5,"_680":3026,"_93":682},{"_665":639},{"_421":3027,"_684":-5},[3028,3029],{"_46":755,"_93":688},{"_46":739,"_93":688},{"_653":3031,"_632":633,"_655":639},{"_677":749,"_42":758,"_713":759,"_660":3032,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3034,"_632":633,"_655":639},{"_656":-5,"_721":763,"_42":764,"_660":3035,"_725":3036,"_93":727},{"_665":639},[],{"_671":768,"_653":3038,"_632":633,"_655":639},{"_656":3039,"_42":764,"_725":3040,"_93":727},[],[],{"_671":773,"_653":3042,"_632":633,"_655":639},{"_693":-5,"_694":775,"_696":3043,"_698":699,"_637":777,"_700":32,"_42":778,"_702":779,"_704":705,"_646":114,"_93":706},[3044],{"_694":781,"_93":709},{"_653":3046,"_632":633,"_655":639},{"_677":784,"_42":-5,"_660":3047,"_291":-5,"_680":3048,"_93":682},{"_665":639},{"_421":3049,"_684":-5},[3050,3051],{"_46":790,"_93":688},{"_46":305,"_93":688},{"_653":3053,"_632":633,"_655":639},{"_677":784,"_42":793,"_713":794,"_660":3054,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3056,"_632":633,"_655":639},{"_656":-5,"_721":798,"_42":799,"_660":3057,"_725":3058,"_93":727},{"_665":639},[3059],{"_46":803,"_93":730},{"_671":805,"_653":3061,"_632":633,"_655":639},{"_656":3062,"_42":799,"_725":3063,"_93":727},[],[803],{"_671":810,"_653":3065,"_632":633,"_655":639},{"_693":812,"_694":813,"_696":3066,"_698":699,"_637":815,"_700":32,"_42":816,"_702":817,"_704":705,"_646":114,"_93":706},[3067],{"_694":819,"_93":709},{"_653":3069,"_632":633,"_655":639},{"_677":822,"_42":-5,"_660":3070,"_291":-5,"_680":3071,"_93":682},{"_665":639},{"_421":3072,"_684":-5},[3073,3074],{"_46":828,"_93":688},{"_46":812,"_93":688},{"_653":3076,"_632":633,"_655":639},{"_677":822,"_42":831,"_713":832,"_660":3077,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3079,"_632":633,"_655":639},{"_656":-5,"_721":836,"_42":837,"_660":3080,"_725":3081,"_93":727},{"_665":639},[3082],{"_46":841,"_93":730},{"_671":843,"_653":3084,"_632":633,"_655":639},{"_656":3085,"_42":837,"_725":3086,"_93":727},[],[841],{"_671":848,"_653":3088,"_632":633,"_655":639},{"_693":850,"_694":740,"_696":3089,"_698":699,"_637":852,"_700":853,"_42":854,"_702":855,"_704":705,"_646":856,"_93":706},[3090],{"_694":746,"_93":709},{"_653":3092,"_632":633,"_655":639},{"_677":860,"_42":-5,"_660":3093,"_291":-5,"_680":3094,"_93":682},{"_665":639},{"_421":3095,"_684":-5},[3096,3097],{"_46":866,"_93":688},{"_46":850,"_93":688},{"_653":3099,"_632":633,"_655":639},{"_677":860,"_42":869,"_713":759,"_660":3100,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3102,"_632":633,"_655":639},{"_656":-5,"_721":873,"_42":874,"_660":3103,"_725":3104,"_93":727},{"_665":639},[3105],{"_46":878,"_93":730},{"_671":880,"_653":3107,"_632":633,"_655":639},{"_656":3108,"_42":874,"_725":3109,"_93":727},[],[878],{"_671":885,"_653":3111,"_632":633,"_655":639},{"_693":-5,"_694":887,"_696":3112,"_698":699,"_637":889,"_700":32,"_42":890,"_702":891,"_704":705,"_646":114,"_93":706},[3113],{"_694":893,"_93":709},{"_653":3115,"_632":633,"_655":639},{"_677":896,"_42":-5,"_660":3116,"_291":-5,"_680":3117,"_93":682},{"_665":639},{"_421":3118,"_684":-5},[3119,3120],{"_46":902,"_93":688},{"_46":305,"_93":688},{"_653":3122,"_632":633,"_655":639},{"_677":896,"_42":905,"_713":906,"_660":3123,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3125,"_632":633,"_655":639},{"_656":-5,"_721":910,"_42":911,"_660":3126,"_725":3127,"_93":727},{"_665":639},[3128],{"_46":915,"_93":730},{"_671":917,"_653":3130,"_632":633,"_655":639},{"_656":3131,"_42":911,"_725":3132,"_93":727},[],[915],{"_671":922,"_653":3134,"_632":633,"_655":639},{"_693":924,"_694":925,"_696":3135,"_698":699,"_637":927,"_700":853,"_42":928,"_702":929,"_704":705,"_646":856,"_93":706},[3136],{"_694":931,"_93":709},{"_653":3138,"_632":633,"_655":639},{"_677":934,"_42":-5,"_660":3139,"_291":-5,"_680":3140,"_93":682},{"_665":639},{"_421":3141,"_684":-5},[3142,3143],{"_46":940,"_93":688},{"_46":924,"_93":688},{"_653":3145,"_632":633,"_655":639},{"_677":934,"_42":943,"_713":944,"_660":3146,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3148,"_632":633,"_655":639},{"_656":-5,"_721":948,"_42":949,"_660":3149,"_725":3150,"_93":727},{"_665":639},[3151],{"_46":953,"_93":730},{"_671":955,"_653":3153,"_632":633,"_655":639},{"_656":3154,"_42":949,"_725":3155,"_93":727},[],[953],{"_671":960,"_653":3157,"_632":633,"_655":639},{"_693":962,"_694":963,"_696":3158,"_698":699,"_637":965,"_700":853,"_42":966,"_702":967,"_704":705,"_646":856,"_93":706},[3159],{"_694":969,"_93":709},{"_653":3161,"_632":633,"_655":639},{"_677":972,"_42":-5,"_660":3162,"_291":-5,"_680":3163,"_93":682},{"_665":639},{"_421":3164,"_684":-5},[3165,3166],{"_46":978,"_93":688},{"_46":962,"_93":688},{"_653":3168,"_632":633,"_655":639},{"_677":972,"_42":981,"_713":982,"_660":3169,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3171,"_632":633,"_655":639},{"_656":-5,"_721":986,"_42":987,"_660":3172,"_725":3173,"_93":727},{"_665":639},[3174],{"_46":991,"_93":730},{"_671":993,"_653":3176,"_632":633,"_655":639},{"_656":3177,"_42":987,"_725":3178,"_93":727},[],[991],{"_653":3180,"_632":633,"_655":639},{"_677":999,"_42":-5,"_660":3181,"_291":-5,"_680":3182,"_93":682},{"_665":639},{"_421":3183,"_684":-5},[3184,3185],{"_46":689,"_93":688},{"_46":1005,"_93":688},{"_671":1007,"_653":3187,"_632":633,"_655":639},{"_693":1005,"_694":1009,"_696":3188,"_698":699,"_637":32,"_700":32,"_42":1011,"_702":1012,"_704":705,"_646":114,"_93":706},[3189,3190],{"_694":1019,"_291":1020,"_214":1021,"_93":1018},{"_694":1015,"_291":1016,"_214":1017,"_93":1018},{"_653":3192,"_632":633,"_655":639},{"_677":999,"_42":1024,"_713":1025,"_660":3193,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3195,"_632":633,"_655":639},{"_656":-5,"_721":1029,"_42":1030,"_660":3196,"_725":3197,"_93":727},{"_665":639},[3198],{"_46":1034,"_93":730},{"_671":1036,"_653":3200,"_632":633,"_655":639},{"_656":3201,"_42":1030,"_725":3202,"_93":727},[],[1034],{"_653":3204,"_632":633,"_655":639},{"_677":1042,"_42":-5,"_660":3205,"_291":-5,"_680":3206,"_93":682},{"_665":639},{"_421":3207,"_684":-5},[3208,3209],{"_46":1049,"_93":688},{"_46":1048,"_93":688},{"_653":3211,"_632":633,"_655":639},{"_677":1042,"_42":1052,"_713":1053,"_660":3212,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3214,"_632":633,"_655":639},{"_656":-5,"_721":1057,"_42":1058,"_660":3215,"_725":3216,"_93":727},{"_665":639},[3217],{"_46":1062,"_93":730},{"_671":1064,"_653":3219,"_632":633,"_655":639},{"_656":3220,"_42":1058,"_725":3221,"_93":727},[],[1062],{"_653":3223,"_632":633,"_655":639},{"_677":1070,"_42":-5,"_660":3224,"_291":-5,"_680":3225,"_93":682},{"_665":639},{"_421":3226,"_684":-5},[3227,3228],{"_46":689,"_93":688},{"_46":1076,"_93":688},{"_671":1078,"_653":3230,"_632":633,"_655":639},{"_693":1076,"_694":1080,"_696":3231,"_698":699,"_637":32,"_700":32,"_42":1082,"_702":1083,"_704":705,"_646":114,"_93":706},[3232],{"_694":1085,"_93":709},{"_653":3234,"_632":633,"_655":639},{"_677":1070,"_42":1088,"_713":1089,"_660":3235,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3237,"_632":633,"_655":639},{"_656":-5,"_721":1093,"_42":1094,"_660":3238,"_725":3239,"_93":727},{"_665":639},[3240],{"_46":1098,"_93":730},{"_671":1100,"_653":3242,"_632":633,"_655":639},{"_656":3243,"_42":1094,"_725":3244,"_93":727},[],[1098],{"_653":3246,"_632":633,"_655":639},{"_677":1106,"_42":-5,"_660":3247,"_291":-5,"_680":3248,"_93":682},{"_665":639},{"_421":3249,"_684":-5},[3250,3251],{"_46":689,"_93":688},{"_46":1112,"_93":688},{"_671":1114,"_653":3253,"_632":633,"_655":639},{"_693":1112,"_694":1116,"_696":3254,"_698":699,"_637":32,"_700":32,"_42":1118,"_702":1119,"_704":705,"_646":114,"_93":706},[3255],{"_694":1121,"_93":709},{"_653":3257,"_632":633,"_655":639},{"_677":1106,"_42":1124,"_713":1125,"_660":3258,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3260,"_632":633,"_655":639},{"_656":-5,"_721":1129,"_42":1130,"_660":3261,"_725":3262,"_93":727},{"_665":639},[3263],{"_46":1134,"_93":730},{"_671":1136,"_653":3265,"_632":633,"_655":639},{"_656":3266,"_42":1130,"_725":3267,"_93":727},[],[1134],{"_671":1141,"_653":3269,"_632":633,"_655":639},{"_693":1143,"_694":1144,"_696":3270,"_698":699,"_637":1146,"_700":32,"_42":1147,"_702":1148,"_704":705,"_646":114,"_93":706},[3271],{"_694":1150,"_93":709},{"_653":3273,"_632":633,"_655":639},{"_677":1153,"_42":-5,"_660":3274,"_291":-5,"_680":3275,"_93":682},{"_665":639},{"_421":3276,"_684":-5},[3277,3278],{"_46":1160,"_93":688},{"_46":1159,"_93":688},{"_653":3280,"_632":633,"_655":639},{"_677":1153,"_42":1163,"_713":1164,"_660":3281,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3283,"_632":633,"_655":639},{"_656":-5,"_721":1168,"_42":1169,"_660":3284,"_725":3285,"_93":727},{"_665":639},[3286],{"_46":1173,"_93":730},{"_671":1175,"_653":3288,"_632":633,"_655":639},{"_656":3289,"_42":1169,"_725":3290,"_93":727},[],[1173],{"_653":3292,"_632":633,"_655":639},{"_677":1181,"_42":-5,"_660":3293,"_291":-5,"_680":3294,"_93":682},{"_665":639},{"_421":3295,"_684":-5},[3296,3297],{"_46":689,"_93":688},{"_46":1187,"_93":688},{"_671":1189,"_653":3299,"_632":633,"_655":639},{"_1191":3300,"_42":1193,"_646":114,"_93":1194},[3301],{"_431":1196,"_9":3302,"_214":1198},{"_1199":-5,"_93":1200},{"_653":3304,"_632":633,"_655":639},{"_677":1181,"_42":1203,"_713":1204,"_660":3305,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3307,"_632":633,"_655":639},{"_656":-5,"_721":1208,"_42":1209,"_660":3308,"_725":3309,"_93":727},{"_665":639},[3310],{"_46":1213,"_93":730},{"_671":1215,"_653":3312,"_632":633,"_655":639},{"_656":3313,"_42":1209,"_725":3314,"_93":727},[],[1213],{"_653":3316,"_632":633,"_655":639},{"_677":1221,"_42":-5,"_660":3317,"_291":-5,"_680":3318,"_93":682},{"_665":639},{"_421":3319,"_684":-5},[3320,3321],{"_46":689,"_93":688},{"_46":1227,"_93":688},{"_671":1229,"_653":3323,"_632":633,"_655":639},{"_693":1227,"_694":1231,"_696":3324,"_698":699,"_637":32,"_700":32,"_42":1233,"_702":1234,"_704":705,"_646":114,"_93":706},[3325,3326,3327],{"_694":1246,"_291":1247,"_214":1198,"_93":1018},{"_694":1243,"_291":1244,"_214":1245,"_93":1018},{"_694":1238,"_214":1239,"_1240":1241,"_93":1242},{"_653":3329,"_632":633,"_655":639},{"_677":1221,"_42":1250,"_713":1251,"_660":3330,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3332,"_632":633,"_655":639},{"_656":-5,"_721":1255,"_42":1256,"_660":3333,"_725":3334,"_93":727},{"_665":639},[3335],{"_46":1260,"_93":730},{"_671":1262,"_653":3337,"_632":633,"_655":639},{"_656":3338,"_42":1256,"_725":3339,"_93":727},[],[1260],{"_653":3341,"_632":633,"_655":639},{"_677":1268,"_42":-5,"_660":3342,"_291":-5,"_680":3343,"_93":682},{"_665":639},{"_421":3344,"_684":-5},[3345,3346],{"_46":689,"_93":688},{"_46":1274,"_93":688},{"_671":1276,"_653":3348,"_632":633,"_655":639},{"_693":1274,"_694":1278,"_696":3349,"_698":699,"_637":32,"_700":32,"_42":1280,"_702":1281,"_704":705,"_646":114,"_93":706},[3350],{"_694":1283,"_214":1284,"_1240":1285,"_93":1242},{"_653":3352,"_632":633,"_655":639},{"_677":1268,"_42":1288,"_713":1289,"_660":3353,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3355,"_632":633,"_655":639},{"_656":-5,"_721":1293,"_42":1294,"_660":3356,"_725":3357,"_93":727},{"_665":639},[3358],{"_46":1298,"_93":730},{"_671":1300,"_653":3360,"_632":633,"_655":639},{"_656":3361,"_42":1294,"_725":3362,"_93":727},[],[1298],{"_653":3364,"_632":633,"_655":639},{"_677":1306,"_42":-5,"_660":3365,"_291":-5,"_680":3366,"_93":682},{"_665":639},{"_421":3367,"_684":-5},[3368,3369],{"_46":689,"_93":688},{"_46":1312,"_93":688},{"_671":1314,"_653":3371,"_632":633,"_655":639},{"_693":1312,"_694":1316,"_696":3372,"_698":699,"_637":32,"_700":32,"_42":1318,"_702":1319,"_704":705,"_646":114,"_93":706},[3373],{"_694":1321,"_291":1322,"_214":1323,"_93":1018},{"_653":3375,"_632":633,"_655":639},{"_677":1306,"_42":1326,"_713":1327,"_660":3376,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3378,"_632":633,"_655":639},{"_656":-5,"_721":1331,"_42":1332,"_660":3379,"_725":3380,"_93":727},{"_665":639},[3381],{"_46":1336,"_93":730},{"_671":1338,"_653":3383,"_632":633,"_655":639},{"_656":3384,"_42":1332,"_725":3385,"_93":727},[],[1336],{"_671":1343,"_653":3387,"_632":633,"_655":639},{"_693":1345,"_694":1144,"_696":3388,"_698":699,"_637":1347,"_700":853,"_42":1348,"_702":1349,"_704":705,"_646":856,"_93":706},[3389],{"_694":1150,"_93":709},{"_653":3391,"_632":633,"_655":639},{"_677":1353,"_42":-5,"_660":3392,"_291":-5,"_680":3393,"_93":682},{"_665":639},{"_421":3394,"_684":-5},[3395,3396],{"_46":1360,"_93":688},{"_46":1359,"_93":688},{"_653":3398,"_632":633,"_655":639},{"_677":1353,"_42":1363,"_713":1364,"_660":3399,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3401,"_632":633,"_655":639},{"_656":-5,"_721":1368,"_42":1369,"_660":3402,"_725":3403,"_93":727},{"_665":639},[],{"_671":1373,"_653":3405,"_632":633,"_655":639},{"_656":3406,"_42":1369,"_725":3407,"_93":727},[],[],{"_653":3409,"_632":633,"_655":639},{"_677":1379,"_42":-5,"_660":3410,"_291":-5,"_680":3411,"_93":682},{"_665":639},{"_421":3412,"_684":-5},[3413,3414],{"_46":1386,"_93":688},{"_46":1385,"_93":688},{"_671":1388,"_653":3416,"_632":633,"_655":639},{"_693":1385,"_694":1390,"_696":3417,"_698":699,"_637":853,"_700":32,"_42":1392,"_702":1393,"_704":705,"_646":114,"_93":706},[3418],{"_694":1395,"_93":709},{"_653":3420,"_632":633,"_655":639},{"_677":1379,"_42":1398,"_713":1399,"_660":3421,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3423,"_632":633,"_655":639},{"_656":-5,"_721":1403,"_42":1404,"_660":3424,"_725":3425,"_93":727},{"_665":639},[3426],{"_46":1408,"_93":730},{"_671":1410,"_653":3428,"_632":633,"_655":639},{"_656":3429,"_42":1404,"_725":3430,"_93":727},[],[1408],{"_653":3432,"_632":633,"_655":639},{"_677":1416,"_42":-5,"_660":3433,"_680":3434,"_93":1419},{"_665":639},{"_421":3435,"_684":-5},[3436,3437],{"_46":1424,"_93":688},{"_46":1423,"_93":688},{"_653":3439,"_632":633,"_655":639},{"_1427":1428,"_677":1416,"_42":1429,"_660":3440,"_291":1431,"_717":-5,"_93":1432},{"_665":639},{"_653":3442,"_632":633,"_655":639},{"_677":1435,"_42":-5,"_660":3443,"_291":-5,"_680":1437,"_93":682},{"_665":639},{"_653":3445,"_632":633,"_655":639},{"_677":1435,"_42":1440,"_713":1364,"_660":3446,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3448,"_632":633,"_655":639},{"_656":-5,"_721":1444,"_42":1445,"_660":3449,"_725":3450,"_93":727},{"_665":639},[],{"_671":1449,"_653":3452,"_632":633,"_655":639},{"_656":3453,"_42":1445,"_725":3454,"_93":727},[],[],{"_653":3456,"_632":633,"_655":639},{"_677":1455,"_42":-5,"_660":3457,"_680":3458,"_93":1419},{"_665":639},{"_421":3459,"_684":-5},[3460,3461],{"_46":1462,"_93":688},{"_46":1461,"_93":688},{"_653":3463,"_632":633,"_655":639},{"_1427":1465,"_677":1455,"_42":1466,"_660":3464,"_291":1431,"_717":-5,"_93":1432},{"_665":639},{"_653":3466,"_632":633,"_655":639},{"_677":1470,"_42":-5,"_660":3467,"_291":-5,"_680":1472,"_93":682},{"_665":639},{"_653":3469,"_632":633,"_655":639},{"_677":1470,"_42":1475,"_713":1364,"_660":3470,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3472,"_632":633,"_655":639},{"_656":-5,"_721":1479,"_42":1480,"_660":3473,"_725":3474,"_93":727},{"_665":639},[],{"_671":1484,"_653":3476,"_632":633,"_655":639},{"_656":3477,"_42":1480,"_725":3478,"_93":727},[],[],{"_653":3480,"_632":633,"_655":639},{"_677":1490,"_42":-5,"_660":3481,"_680":3482,"_93":1419},{"_665":639},{"_421":3483,"_684":-5},[3484,3485],{"_46":1424,"_93":688},{"_46":1496,"_93":688},{"_653":3487,"_632":633,"_655":639},{"_1427":1499,"_677":1490,"_42":1500,"_660":3488,"_291":1431,"_717":-5,"_93":1432},{"_665":639},{"_653":3490,"_632":633,"_655":639},{"_677":1504,"_42":-5,"_660":3491,"_291":-5,"_680":1506,"_93":682},{"_665":639},{"_653":3493,"_632":633,"_655":639},{"_677":1504,"_42":1509,"_713":1364,"_660":3494,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3496,"_632":633,"_655":639},{"_656":-5,"_721":1513,"_42":1514,"_660":3497,"_725":3498,"_93":727},{"_665":639},[],{"_671":1518,"_653":3500,"_632":633,"_655":639},{"_656":3501,"_42":1514,"_725":3502,"_93":727},[],[],{"_653":3504,"_632":633,"_655":639},{"_677":1524,"_42":-5,"_660":3505,"_291":-5,"_680":3506,"_93":682},{"_665":639},{"_421":3507,"_684":-5},[3508,3509],{"_46":1531,"_93":688},{"_46":1530,"_93":688},{"_653":3511,"_632":633,"_655":639},{"_677":1524,"_42":1534,"_713":1535,"_660":3512,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3514,"_632":633,"_655":639},{"_656":-5,"_721":1539,"_42":1540,"_660":3515,"_725":3516,"_93":727},{"_665":639},[],{"_671":1544,"_653":3518,"_632":633,"_655":639},{"_656":3519,"_42":1540,"_725":3520,"_93":727},[],[],{"_653":3522,"_632":633,"_655":639},{"_677":1550,"_42":-5,"_660":3523,"_680":3524,"_93":1419},{"_665":639},{"_421":3525,"_684":-5},[3526,3527],{"_46":1049,"_93":688},{"_46":305,"_93":688},{"_653":3529,"_632":633,"_655":639},{"_1427":1558,"_677":1550,"_42":1559,"_660":3530,"_291":1431,"_717":-5,"_93":1432},{"_665":639},{"_653":3532,"_632":633,"_655":639},{"_656":-5,"_721":1563,"_42":1564,"_660":3533,"_725":3534,"_93":727},{"_665":639},[3535],{"_46":1568,"_93":730},{"_671":1570,"_653":3537,"_632":633,"_655":639},{"_656":3538,"_42":1564,"_725":3539,"_93":727},[],[1568],{"_653":3541,"_632":633,"_655":639},{"_677":1576,"_42":-5,"_660":3542,"_291":-5,"_680":1578,"_93":682},{"_665":639},{"_653":3544,"_632":633,"_655":639},{"_677":1576,"_42":1581,"_713":1582,"_660":3545,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3547,"_632":633,"_655":639},{"_677":1586,"_42":-5,"_660":3548,"_291":-5,"_680":3549,"_93":682},{"_665":639},{"_421":3550,"_684":-5},[3551,3552],{"_46":1531,"_93":688},{"_46":305,"_93":688},{"_653":3554,"_632":633,"_655":639},{"_677":1586,"_42":1594,"_713":1595,"_660":3555,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3557,"_632":633,"_655":639},{"_677":1599,"_42":-5,"_660":3558,"_291":-5,"_680":3559,"_93":682},{"_665":639},{"_421":3560,"_684":-5},[3561,3562],{"_46":1531,"_93":688},{"_46":305,"_93":688},{"_653":3564,"_632":633,"_655":639},{"_677":1599,"_42":1607,"_713":1608,"_660":3565,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3567,"_632":633,"_655":639},{"_677":1612,"_42":-5,"_660":3568,"_291":-5,"_680":3569,"_93":682},{"_665":639},{"_421":3570,"_684":-5},[3571,3572],{"_46":1531,"_93":688},{"_46":305,"_93":688},{"_653":3574,"_632":633,"_655":639},{"_677":1612,"_42":1620,"_713":1608,"_660":3575,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3577,"_632":633,"_655":639},{"_677":1624,"_42":-5,"_660":3578,"_291":-5,"_680":3579,"_93":682},{"_665":639},{"_421":3580,"_684":-5},[3581,3582],{"_46":1531,"_93":688},{"_46":305,"_93":688},{"_653":3584,"_632":633,"_655":639},{"_677":1624,"_42":1632,"_713":1608,"_660":3585,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3587,"_632":633,"_655":639},{"_656":-5,"_721":1636,"_42":1637,"_660":3588,"_725":3589,"_93":727},{"_665":639},[],{"_671":1641,"_653":3591,"_632":633,"_655":639},{"_656":3592,"_42":1637,"_725":3593,"_93":727},[],[],{"_653":3595,"_632":633,"_655":639},{"_677":1647,"_42":-5,"_660":3596,"_291":-5,"_680":3597,"_93":682},{"_665":639},{"_421":3598,"_684":-5},[3599,3600],{"_46":1654,"_93":688},{"_46":1653,"_93":688},{"_653":3602,"_632":633,"_655":639},{"_677":1647,"_42":1657,"_713":1658,"_660":3603,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3605,"_632":633,"_655":639},{"_656":-5,"_721":1662,"_42":1663,"_660":3606,"_725":3607,"_93":727},{"_665":639},[3608],{"_46":1667,"_93":730},{"_671":1669,"_653":3610,"_632":633,"_655":639},{"_656":3611,"_42":1663,"_725":3612,"_93":727},[],[1667],{"_671":1674,"_653":3614,"_632":633,"_655":639},{"_693":1676,"_694":1677,"_696":3615,"_698":699,"_637":1679,"_700":32,"_42":1680,"_702":1681,"_704":705,"_646":114,"_93":706},[3616],{"_694":1683,"_93":709},{"_653":3618,"_632":633,"_655":639},{"_677":1686,"_42":-5,"_660":3619,"_291":-5,"_680":3620,"_93":682},{"_665":639},{"_421":3621,"_684":-5},[3622,3623],{"_46":1692,"_93":688},{"_46":1676,"_93":688},{"_653":3625,"_632":633,"_655":639},{"_677":1686,"_42":1695,"_713":1696,"_660":3626,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3628,"_632":633,"_655":639},{"_677":1700,"_42":-5,"_660":3629,"_291":-5,"_680":3630,"_93":682},{"_665":639},{"_421":3631,"_684":-5},[3632,3633],{"_46":1706,"_93":688},{"_46":1187,"_93":688},{"_671":1708,"_653":3635,"_632":633,"_655":639},{"_1191":3636,"_42":1711,"_646":114,"_93":1194},[3637],{"_431":1713,"_9":3638,"_214":1323},{"_1199":-5,"_93":1200},{"_653":3640,"_632":633,"_655":639},{"_677":1700,"_42":1717,"_713":1718,"_660":3641,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3643,"_632":633,"_655":639},{"_656":-5,"_721":1722,"_42":1723,"_660":3644,"_725":3645,"_93":727},{"_665":639},[3646],{"_46":1727,"_93":730},{"_671":1729,"_653":3648,"_632":633,"_655":639},{"_656":3649,"_42":1723,"_725":3650,"_93":727},[],[1727],{"_671":1734,"_653":3652,"_632":633,"_655":639},{"_693":1736,"_694":1737,"_696":3653,"_698":699,"_637":1739,"_700":32,"_42":1740,"_702":1741,"_704":705,"_646":114,"_93":706},[3654],{"_694":1743,"_93":709},{"_653":3656,"_632":633,"_655":639},{"_677":1746,"_42":-5,"_660":3657,"_291":-5,"_680":3658,"_93":682},{"_665":639},{"_421":3659,"_684":-5},[3660,3661],{"_46":1752,"_93":688},{"_46":1736,"_93":688},{"_653":3663,"_632":633,"_655":639},{"_677":1746,"_42":1755,"_713":1756,"_660":3664,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3666,"_632":633,"_655":639},{"_656":-5,"_721":1760,"_42":1761,"_660":3667,"_725":3668,"_93":727},{"_665":639},[3669],{"_46":1765,"_93":730},{"_671":1767,"_653":3671,"_632":633,"_655":639},{"_656":3672,"_42":1761,"_725":3673,"_93":727},[],[1765],{"_653":3675,"_632":633,"_655":639},{"_677":1773,"_42":-5,"_660":3676,"_291":-5,"_680":3677,"_93":682},{"_665":639},{"_421":3678,"_684":-5},[3679,3680],{"_46":1780,"_93":688},{"_46":1779,"_93":688},{"_653":3682,"_632":633,"_655":639},{"_677":1773,"_42":1783,"_713":1784,"_660":3683,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3685,"_632":633,"_655":639},{"_656":-5,"_721":1788,"_42":1789,"_660":3686,"_725":3687,"_93":727},{"_665":639},[3688,3689],{"_46":1795,"_93":730},{"_46":1794,"_93":730},{"_671":1797,"_653":3691,"_632":633,"_655":639},{"_656":3692,"_42":1789,"_725":3693,"_93":727},[],[1795,1794],{"_671":1802,"_653":3695,"_632":633,"_655":639},{"_693":1804,"_694":1805,"_696":3696,"_698":699,"_637":1807,"_700":32,"_42":1808,"_702":1809,"_704":705,"_646":114,"_93":706},[3697],{"_694":1811,"_93":709},{"_653":3699,"_632":633,"_655":639},{"_677":1814,"_42":-5,"_660":3700,"_291":-5,"_680":3701,"_93":682},{"_665":639},{"_421":3702,"_684":-5},[3703,3704],{"_46":1820,"_93":688},{"_46":1804,"_93":688},{"_653":3706,"_632":633,"_655":639},{"_677":1814,"_42":1823,"_713":1824,"_660":3707,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3709,"_632":633,"_655":639},{"_656":-5,"_721":1828,"_42":1829,"_660":3710,"_725":3711,"_93":727},{"_665":639},[3712,3713],{"_46":1835,"_93":730},{"_46":1834,"_93":730},{"_671":1837,"_653":3715,"_632":633,"_655":639},{"_656":3716,"_42":1829,"_725":3717,"_93":727},[],[1835,1834],{"_653":3719,"_632":633,"_655":639},{"_677":1843,"_42":-5,"_660":3720,"_291":-5,"_680":3721,"_93":682},{"_665":639},{"_421":3722,"_684":-5},[3723,3724],{"_46":1386,"_93":688},{"_46":1849,"_93":688},{"_671":1851,"_653":3726,"_632":633,"_655":639},{"_693":1849,"_694":1853,"_696":3727,"_698":699,"_637":32,"_700":32,"_42":1855,"_702":1856,"_704":705,"_646":114,"_93":706},[3728],{"_694":1858,"_93":709},{"_653":3730,"_632":633,"_655":639},{"_677":1843,"_42":1861,"_713":1862,"_660":3731,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3733,"_632":633,"_655":639},{"_656":-5,"_721":1866,"_42":1867,"_660":3734,"_725":3735,"_93":727},{"_665":639},[3736],{"_46":1871,"_93":730},{"_671":1873,"_653":3738,"_632":633,"_655":639},{"_656":3739,"_42":1867,"_725":3740,"_93":727},[],[1871],{"_653":3742,"_632":633,"_655":639},{"_677":1879,"_42":-5,"_660":3743,"_291":-5,"_680":3744,"_93":682},{"_665":639},{"_421":3745,"_684":-5},[3746,3747],{"_46":1886,"_93":688},{"_46":1885,"_93":688},{"_671":1888,"_653":3749,"_632":633,"_655":639},{"_693":1885,"_694":1890,"_696":3750,"_698":699,"_637":32,"_700":32,"_42":1892,"_702":1893,"_704":705,"_646":114,"_93":706},[3751],{"_694":1895,"_93":709},{"_653":3753,"_632":633,"_655":639},{"_677":1879,"_42":1898,"_713":1899,"_660":3754,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":3756,"_632":633,"_655":639},{"_656":-5,"_721":1903,"_42":1904,"_660":3757,"_725":3758,"_93":727},{"_665":639},[3759],{"_46":1908,"_93":730},{"_671":1910,"_653":3761,"_632":633,"_655":639},{"_656":3762,"_42":1904,"_725":3763,"_93":727},[],[1908],{"_671":1915,"_653":3765,"_632":633,"_655":639},{"_1917":-5,"_656":3766,"_42":1919,"_93":1920},[3767],{"_46":1922,"_1923":3768,"_93":46},[],{"_653":3770,"_632":633,"_655":639},{"_656":3771,"_658":-5,"_42":-5,"_660":3772,"_662":-5,"_97":432,"_93":664},[3773],{"_665":639},{"_46":1922,"_93":688},{"_653":3775,"_632":633,"_655":639},{"_656":3776,"_658":-5,"_42":-5,"_660":3777,"_662":-5,"_97":432,"_93":664},[3778,3779],{"_665":639},{"_46":1937,"_93":688},{"_46":1936,"_93":688},{"_653":3781,"_632":633,"_655":639},{"_656":3782,"_658":-5,"_42":-5,"_660":3783,"_662":-5,"_97":1942,"_93":664},[3784],{"_665":639},{"_46":1944,"_93":688},{"_653":3786,"_632":633,"_655":639},{"_656":3787,"_658":-5,"_42":-5,"_660":3788,"_662":-5,"_97":1942,"_93":664},[3789],{"_665":639},{"_46":1950,"_93":688},{"_653":3791,"_632":633,"_655":639},{"_656":3792,"_658":-5,"_42":-5,"_660":3793,"_662":-5,"_97":1942,"_93":664},[3794,3795],{"_665":639},{"_46":1958,"_93":688},{"_46":1957,"_93":688},{"_632":633,"_88":3797},{"_104":-5,"_42":639,"_640":3798,"_642":643,"_644":645,"_646":1963},[],{"_646":3800,"_632":633},{"_1966":3801,"_93":1968},[],{"_1971":3803},{"_1973":-5,"_1974":-5,"_1975":1976,"_1977":645,"_698":699,"_1978":15,"_1979":-5,"_1980":-5,"_1981":-5,"_1982":1983,"_42":633,"_1984":1985,"_291":-5,"_1986":-5,"_214":1987,"_1988":305,"_1989":645,"_1990":633,"_704":1991,"_646":3804,"_1993":-5,"_78":3805,"_1995":645},{"_93":650},[],[],[3808],{"_42":2000,"_2001":3809,"_2003":2004,"_2005":2004,"_656":3810,"_646":2007,"_658":-5,"_2008":32,"_2009":3811,"_2011":406,"_2012":-5},{"_97":432,"_291":-5,"_2009":3815},{"_2017":46,"_2018":3814},{"_2013":3812},{"_2015":3813},[],[2020],{},{"_93":664,"_97":94,"_656":3831},{"_93":2056,"_2057":3822},{"_93":2030,"_2031":2032,"_2033":2034,"_2035":3819,"_2037":-5},{"_93":2035,"_2038":699,"_129":130,"_2039":-5,"_431":2040,"_2041":3820,"_2043":2044,"_2045":2046,"_2047":2048,"_2049":2050,"_2051":3821},{"_2053":2054,"_2055":-5},[],[3823,3824],{"_214":2163,"_2062":-5,"_2063":3828,"_2065":-5},{"_214":2061,"_2062":-5,"_2063":3825,"_2065":-5},[3826],{"_2067":853,"_2068":2069,"_656":3827,"_2071":59},[2072,2073,2074,2075,305,2076,2077,2078,2079,2080,2081,2082,2083,305,2084,2085,2086,2087,2088,2089,2090,2091,2092,305,2084,2093,2094,2095,2096,2089,2097,2098,2099,2100,2101,2092,305,2084,2102,2103,2104,2088,2089,2097,2098,2105,2106,2107,2100,2108,2092,305,2084,2109,2103,2110,2111,2112,2097,2098,2105,2106,2107,2100,2108,2092,305,2084,2113,2114,2115,2096,2089,2097,2098,2105,2116,2106,2100,2108,2092,305,2084,2117,2114,2118,2096,2089,2097,2098,2105,2116,2106,2100,2108,2092,305,2084,2119,2114,2120,2096,2089,2097,2098,2105,2116,2121,2106,2107,2100,2108,2092,305,2084,2122,2114,2123,2096,2089,2097,2098,2107,2100,2108,2092,305,2084,2124,2103,2125,2096,2089,2097,2098,2105,2116,2106,2126,2100,2127,2092,305,2084,2128,2103,2129,2096,2089,2097,2098,2105,2130,2131,2121,2106,2132,2100,2127,2092,305,2084,2133,2103,2134,2096,2089,2097,2098,2135,2132,2100,2136,2127,2092,305,2084,2137,2094,2138,2096,2139,2097,2098,2099,2106,2100,2140,2092,305,2084,2141,2114,2142,2096,2089,2097,2098,2105,2116,2106,2100,2127,2092,305,2084,2143,2114,2144,2096,2089,2097,2098,2105,2116,2106,2100,2127,2092,305,2084,2145,2114,2146,2096,2089,2097,2098,2105,2116,2121,2106,2107,2100,2127,2092,305,2084,2147,2114,2148,2096,2089,2097,2098,2105,2116,2107,2106,2100,2127,2092,305,2084,2149,2103,2150,2096,2151,2097,2098,2105,2116,2106,2132,2152,2107,2100,2127,2092,305,2084,2153,2114,2154,2155,2156,2097,2098,2157,2100,2127,2092,305,2084,2158,2114,2159,2160,2156,2097,2098,2157,2100,2127,2092,305,2084,2161,2114,2162,2160,2156,2097,2098,2157,2100,2127,2092],[3829],{"_2067":853,"_2068":2166,"_656":3830,"_2071":59},[2168,305,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,2180,2177,2181,2182,305,2183,2184,305,2185,2186,305,2187,2188,2189,2190,2191,2192,2193,2194,305,2195,2196,2197,2198,2199,305,2200,2201,2202,2203,2204,2205,2206,2207,2208,2209,305,2210,2211,2212,2213,2214,2215,2216,2217,305,2218,2219,2220,2217,305,2221,305,2222,2202,2208,2209,2223,2224,2225,305,2226,2227,2202,2208,2209,2223,2228,2229,2230,2231,2220,2217,2232,2233,2220,2217,2234,305,2235,2236,305,2237,2238,2198,2239,2240,305,2241,2198,2242,305,2243,2244,2198,2245,305,2246,2247,305,2248,2249,305,2250,2251,2252,2253,2254,2255,2256,2257,2258,2259,2260,2261,2262,2260,2263,2264,2260,2265,2266,2267,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2237,2238,2198,2239,305,2271,2272,305,2273,2274,2198,2275,2276,305,2277,2274,2198,2278,2279,305,2280,2274,2198,2281,2282,305,2283,2284,305,2285,2202,2208,2209,2286,2287,2288,2289,2290,2291,2220,2217,2292,305,2293,2294,2198,2295,2296,2297,305,2298,2299,2300,2191,2301,2192,2302,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2303,2304,2202,2208,2305,2306,2307,305,2308,2202,2203,2204,2208,2209,2309,2310,2311,2312,2313,2314,2217,305,2315,2316,2317,2191,2318,2192,2319,2320,2321,2322,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2323,2324,2198,2325,305,2326,2327,2202,2203,2328,2329,2330,2331,2332,2208,2209,2333,305,2334,2335,2336,2337,2338,2339,2340,2341,2342,2343,2214,2215,2344,305,2345,2340,2346,2344,2347,305,2348,2349,2350,2351,2352,2353,2354,2355,2356,2357,2358,305,2359,2360,2361,2362,2363,305,2364,2365,2294,2198,2366,2367,2368,2369,2370,2371,2372,2373,2297,305,2374,2202,2208,2309,2375,2376,2377,2378,2379,2380,2381,2312,305,2382,2383,2384,2191,2385,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2386,2324,2198,2366,2387,305,2388,2202,2208,2209,2389,2390,2391,2392,2393,2394,2395,2396,305,2397,2202,2208,2209,2398,2399,2400,2395,2401,2402,2403,2404,2405,305,2406,2238,2198,2239,305,2280,2274,2198,2281,2407,305,2408,2409,305,2410,2202,2208,2209,2411,2412,2413,2414,2415,2416,2417,2418,2419,2420,2421,2422,2423,2424,2425,2426,2427,305,2428,2202,2208,2429,2430,2431,2432,2433,2434,2217,305,2435,2202,2208,2309,2436,2437,2438,2439,2440,2441,2442,2312,305,2443,2444,2445,2253,2385,2255,2446,2256,2257,2447,2448,2449,2259,2450,2451,2449,2262,2452,2453,2449,2264,2454,2455,2456,2266,305,2195,2457,2197,2198,2199,2268,305,2269,2202,2270,305,2458,2324,2198,2366,2459,305,2460,2461,2202,2203,2462,2463,2464,305,2465,2466,2467,2203,2462,2463,2468,305,2469,2470,2294,2198,2471,2472,2473,2474,305,2475,2476,2477,2478,2385,305,2195,2457,2197,2198,2199,2268,305,2269,2202,2203,2329,2479,305,2458,2324,2198,2366,2459,305,2480,2202,2203,2328,2329,2208,2209,2481,2482,2483,2484,2485,305,2486,2487,2488,2489,2490,2491,2220,2217,2492,305,2493,2202,2203,2328,2329,2208,2209,2494,2495,2482,2483,2484,305,2496,2497,2498,2499,2500,2501,305,2502,2503,2504,2505,2506,2507,2508,305,2509,2510,2511,2505,2512,2513,305,2486,2487,2514,2489,2515,2516,2220,2217,2517,305,2518,2470,2294,2198,2519,2367,2520,2521,2473,2474,305,2522,2523,2524,2191,2318,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2237,2238,2198,2239,305,2280,2274,2198,2281,2407,305,2525,2526,305,2527,2470,2202,2208,2528,2529,2530,305,2531,2532,2533,2478,2534,2535,2536,2537,2538,2539,2540,2541,305,2195,2542,2202,2203,2543,2544,2545,2546,2547,2548,2208,2209,2549,2550,2551,2552,2553,2554,2555,2556,2557,2214,2215,2344,305,2558,2202,2203,2328,2329,2559,2560,2561,2562,2208,2209,2563,2350,2351,2564,2565,2566,2567,2568,2569,2570,2571,2572,2357,2573,2574,305,2309,2575,2437,2576,2577,2578,2579,2580,2581,2582,2583,2584,2437,2585,2312,305,2586,2294,2198,2587,2588,2589],[3832,3833,3834,3835,3836,3837,3838,3839,3840,3841,3842,3843,3844,3845],{"_2017":46,"_46":2627},{"_2017":2606,"_214":2163,"_2067":2625,"_2068":2626},{"_2017":2606,"_214":2163,"_2067":2623,"_2068":2624},{"_2017":2606,"_214":2163,"_2067":2621,"_2068":2622},{"_2017":2606,"_214":2163,"_2067":2620,"_2068":2608},{"_2017":2606,"_214":2061,"_2067":2618,"_2068":2619},{"_2017":46,"_46":2617},{"_2017":2606,"_214":2163,"_2067":2615,"_2068":2616},{"_2017":46,"_46":2614},{"_2017":2606,"_214":2163,"_2067":2612,"_2068":2613},{"_2017":2606,"_214":2163,"_2067":2610,"_2068":2611},{"_2017":46,"_46":2609},{"_2017":2606,"_214":2163,"_2067":2607,"_2068":2608},{"_2017":46,"_46":2605},[4945,4946,4947],[],{"_2022":2023,"_46":2024,"_2025":2026},{"_1997":4936},{"_446":4935},{"_446":3931},{"_411":412,"_401":413,"_414":415,"_416":15,"_417":59,"_418":59,"_419":420,"_421":422,"_423":373,"_424":128,"_425":426,"_427":130,"_428":429,"_430":-5,"_431":-5,"_432":3930,"_434":435,"_436":437,"_438":439,"_440":441},{"_42":124,"_299":300,"_301":302,"_303":15,"_304":305,"_306":307,"_308":3919,"_310":-5,"_311":312,"_313":15,"_314":3920,"_316":305,"_317":305,"_318":3921,"_320":3922,"_322":3923,"_324":-5,"_325":326,"_327":328,"_329":330,"_331":3924,"_55":-5,"_120":333,"_334":3925,"_336":3926,"_338":339,"_340":15,"_341":15},{"_134":3914},[3856,3857,3858,3859,3860,3861,3862,3863,3864,3865,3866,3867,3868,3869,3870,3871,3872,3873,3874,3875,3876,3877,3878,3879,3880,3881,3882,3883,3884,3885,3886,3887,3888,3889,3890,3891,3892,3893,3894,3895,3896,3897,3898,3899,3900,3901,3902,3903,3904,3905,3906,3907,3908,3909,3910,3911,3912,3913],{"_201":283,"_203":204,"_205":206,"_207":233,"_209":275,"_211":212,"_213":32,"_214":-5},{"_201":281,"_203":204,"_205":206,"_207":233,"_209":282,"_211":212,"_213":32,"_214":-5},{"_201":279,"_203":204,"_205":206,"_207":208,"_209":280,"_211":212,"_213":32,"_214":-5},{"_201":278,"_203":204,"_205":206,"_207":208,"_209":271,"_211":212,"_213":32,"_214":-5},{"_201":276,"_203":204,"_205":206,"_207":270,"_209":271,"_211":212,"_213":277,"_214":-5},{"_201":274,"_203":204,"_205":206,"_207":233,"_209":275,"_211":212,"_213":32,"_214":-5},{"_201":273,"_203":204,"_205":206,"_207":208,"_209":271,"_211":212,"_213":32,"_214":-5},{"_201":269,"_203":204,"_205":206,"_207":270,"_209":271,"_211":212,"_213":272,"_214":-5},{"_201":268,"_203":204,"_205":206,"_207":233,"_209":265,"_211":212,"_213":32,"_214":-5},{"_201":267,"_203":204,"_205":206,"_207":208,"_209":265,"_211":212,"_213":32,"_214":-5},{"_201":266,"_203":204,"_205":206,"_207":233,"_209":265,"_211":212,"_213":32,"_214":-5},{"_201":264,"_203":204,"_205":206,"_207":208,"_209":265,"_211":212,"_213":32,"_214":-5},{"_201":263,"_203":204,"_205":206,"_207":233,"_209":237,"_211":212,"_213":32,"_214":-5},{"_201":262,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":261,"_203":204,"_205":206,"_207":233,"_209":234,"_211":212,"_213":32,"_214":-5},{"_201":260,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":259,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":258,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":257,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":256,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":255,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":254,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":253,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":252,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":251,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":250,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":249,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":248,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":247,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":246,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":245,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":244,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":243,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":242,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":241,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":240,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":239,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":238,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":236,"_203":204,"_205":206,"_207":233,"_209":237,"_211":212,"_213":32,"_214":-5},{"_201":235,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":232,"_203":204,"_205":206,"_207":233,"_209":234,"_211":212,"_213":32,"_214":-5},{"_201":231,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":230,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":229,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":228,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":227,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":226,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":225,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":224,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":223,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":221,"_203":204,"_205":206,"_207":208,"_209":222,"_211":212,"_213":32,"_214":-5},{"_201":220,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":219,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":218,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":217,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":216,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":215,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},{"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":32,"_214":-5},[3915,3916],{"_287":3918,"_289":296},{"_287":3917,"_289":290},{"_291":292,"_93":293,"_120":294},{"_291":297,"_93":293,"_120":298},{"_403":404,"_405":406,"_407":305,"_408":-5,"_409":-5,"_410":-5},[363],{"_363":3927},{"_345":346,"_347":348,"_349":350,"_351":352,"_353":354,"_355":356,"_357":358,"_359":360,"_361":362},{},[],{"_344":59},{"_342":59,"_343":305},{"_42":365,"_291":302,"_366":3928,"_368":369,"_370":371,"_372":373,"_374":375,"_376":377,"_378":379,"_380":64,"_381":15,"_382":-5,"_383":-5,"_384":-5,"_385":-5,"_386":-5,"_387":-5,"_213":388,"_389":-5,"_55":3929},{"_395":396,"_42":397,"_93":398,"_399":400,"_401":402},{"_391":15,"_392":15,"_393":15,"_394":15},{"_395":442,"_291":442,"_443":-5,"_399":444,"_42":445},[3932,3933,3934,3935,3936,3937,3938,3939,3940,3941,3942,3943,3944,3945,3946,3947,3948,3949,3950,3951,3952,3953,3954,3955,3956,3957,3958,3959,3960,3961,3962,3963,3964,3965,3966,3967,3968,3969,3970,3971,3972,3973,3974,3975,3976,3977,3978,3979,3980,3981,3982,3983,3984,3985,3986,3987,3988,3989,3990,3991,3992,3993,3994,3995,3996,3997,3998,3999,4000,4001,4002,4003,4004,4005,4006,4007,4008,4009,4010,4011,4012,4013,4014,4015,4016,4017,4018,4019,4020,4021,4022,4023,4024,4025,4026,4027,4028,4029,4030,4031,4032,4033,4034,4035,4036,4037,4038,4039,4040,4041,4042,4043,4044,4045,4046,4047,4048,4049,4050,4051,4052,4053,4054,4055,4056,4057,4058,4059,4060,4061,4062,4063,4064,4065,4066,4067,4068,4069,4070,4071,4072,4073,4074,4075,4076,4077,4078,4079,4080,4081,4082,4083,4084,4085,4086,4087,4088,4089,4090,4091,4092,4093,4094,4095,4096,4097,4098,4099,4100,4101,4102,4103,4104,4105,4106,4107,4108,4109,4110,4111,4112],{"_207":1969,"_630":4931},{"_207":647,"_630":4928},{"_207":1959,"_630":4925},{"_207":651,"_630":4919},{"_207":651,"_630":4914},{"_207":651,"_630":4909},{"_207":651,"_630":4903},{"_207":651,"_630":4898},{"_207":669,"_630":4893},{"_207":669,"_630":4889},{"_207":651,"_630":4884},{"_207":651,"_630":4881},{"_207":669,"_630":4877},{"_207":651,"_630":4870},{"_207":669,"_630":4866},{"_207":651,"_630":4861},{"_207":651,"_630":4858},{"_207":669,"_630":4854},{"_207":651,"_630":4847},{"_207":669,"_630":4843},{"_207":651,"_630":4837},{"_207":651,"_630":4834},{"_207":651,"_630":4827},{"_207":669,"_630":4823},{"_207":669,"_630":4819},{"_207":651,"_630":4813},{"_207":651,"_630":4810},{"_207":651,"_630":4803},{"_207":669,"_630":4799},{"_207":651,"_630":4794},{"_207":651,"_630":4791},{"_207":651,"_630":4784},{"_207":669,"_630":4780},{"_207":669,"_630":4776},{"_207":651,"_630":4771},{"_207":651,"_630":4768},{"_207":669,"_630":4763},{"_207":651,"_630":4756},{"_207":651,"_630":4753},{"_207":651,"_630":4746},{"_207":669,"_630":4742},{"_207":669,"_630":4738},{"_207":651,"_630":4733},{"_207":651,"_630":4730},{"_207":651,"_630":4723},{"_207":669,"_630":4719},{"_207":651,"_630":4715},{"_207":651,"_630":4712},{"_207":651,"_630":4705},{"_207":651,"_630":4702},{"_207":651,"_630":4695},{"_207":651,"_630":4692},{"_207":651,"_630":4685},{"_207":651,"_630":4682},{"_207":651,"_630":4675},{"_207":651,"_630":4672},{"_207":651,"_630":4669},{"_207":669,"_630":4665},{"_207":651,"_630":4660},{"_207":651,"_630":4657},{"_207":651,"_630":4650},{"_207":669,"_630":4646},{"_207":651,"_630":4642},{"_207":651,"_630":4639},{"_207":651,"_630":4632},{"_207":669,"_630":4628},{"_207":651,"_630":4624},{"_207":651,"_630":4621},{"_207":651,"_630":4618},{"_207":651,"_630":4615},{"_207":651,"_630":4608},{"_207":669,"_630":4604},{"_207":651,"_630":4600},{"_207":651,"_630":4597},{"_207":651,"_630":4594},{"_207":651,"_630":4591},{"_207":651,"_630":4584},{"_207":669,"_630":4580},{"_207":651,"_630":4576},{"_207":651,"_630":4573},{"_207":651,"_630":4570},{"_207":651,"_630":4567},{"_207":651,"_630":4560},{"_207":669,"_630":4556},{"_207":651,"_630":4551},{"_207":651,"_630":4548},{"_207":669,"_630":4544},{"_207":651,"_630":4537},{"_207":669,"_630":4533},{"_207":651,"_630":4529},{"_207":651,"_630":4526},{"_207":651,"_630":4519},{"_207":669,"_630":4515},{"_207":669,"_630":4511},{"_207":651,"_630":4506},{"_207":651,"_630":4503},{"_207":669,"_630":4499},{"_207":651,"_630":4492},{"_207":669,"_630":4488},{"_207":651,"_630":4483},{"_207":651,"_630":4480},{"_207":669,"_630":4476},{"_207":651,"_630":4469},{"_207":669,"_630":4465},{"_207":651,"_630":4460},{"_207":651,"_630":4457},{"_207":669,"_630":4451},{"_207":651,"_630":4444},{"_207":669,"_630":4440},{"_207":651,"_630":4435},{"_207":651,"_630":4432},{"_207":669,"_630":4427},{"_207":651,"_630":4420},{"_207":669,"_630":4416},{"_207":651,"_630":4411},{"_207":651,"_630":4408},{"_207":651,"_630":4401},{"_207":669,"_630":4397},{"_207":669,"_630":4393},{"_207":651,"_630":4388},{"_207":651,"_630":4385},{"_207":669,"_630":4381},{"_207":651,"_630":4374},{"_207":669,"_630":4370},{"_207":651,"_630":4365},{"_207":651,"_630":4362},{"_207":669,"_630":4358},{"_207":651,"_630":4351},{"_207":669,"_630":4347},{"_207":651,"_630":4342},{"_207":651,"_630":4339},{"_207":651,"_630":4332},{"_207":669,"_630":4328},{"_207":651,"_630":4323},{"_207":651,"_630":4320},{"_207":669,"_630":4315},{"_207":651,"_630":4308},{"_207":669,"_630":4304},{"_207":651,"_630":4299},{"_207":651,"_630":4296},{"_207":651,"_630":4289},{"_207":669,"_630":4285},{"_207":669,"_630":4281},{"_207":651,"_630":4276},{"_207":651,"_630":4273},{"_207":651,"_630":4266},{"_207":669,"_630":4262},{"_207":669,"_630":4258},{"_207":651,"_630":4253},{"_207":651,"_630":4250},{"_207":651,"_630":4243},{"_207":669,"_630":4239},{"_207":669,"_630":4235},{"_207":651,"_630":4230},{"_207":651,"_630":4227},{"_207":651,"_630":4220},{"_207":669,"_630":4216},{"_207":669,"_630":4212},{"_207":651,"_630":4207},{"_207":651,"_630":4204},{"_207":651,"_630":4197},{"_207":669,"_630":4193},{"_207":669,"_630":4189},{"_207":651,"_630":4184},{"_207":651,"_630":4181},{"_207":651,"_630":4174},{"_207":669,"_630":4170},{"_207":669,"_630":4166},{"_207":651,"_630":4162},{"_207":651,"_630":4159},{"_207":651,"_630":4152},{"_207":669,"_630":4148},{"_207":669,"_630":4144},{"_207":651,"_630":4139},{"_207":651,"_630":4136},{"_207":669,"_630":4132},{"_207":651,"_630":4125},{"_207":669,"_630":4123},{"_207":651,"_630":4118},{"_207":647,"_630":4116},{"_207":629,"_630":4113},{"_632":633,"_88":4114},{"_635":636,"_637":638,"_104":-5,"_42":639,"_640":4115,"_642":643,"_644":645,"_646":114},[],{"_646":4117,"_632":633},{"_93":650},{"_653":4119,"_632":633,"_655":639},{"_656":4120,"_658":-5,"_42":659,"_660":4121,"_662":663,"_97":94,"_93":664},[4122],{"_665":639},{"_46":667,"_93":668},{"_671":672,"_653":4124,"_632":633,"_655":639},{"_42":659,"_662":663,"_46":667,"_93":674},{"_653":4126,"_632":633,"_655":639},{"_677":678,"_42":-5,"_660":4127,"_291":-5,"_680":4128,"_93":682},{"_665":639},{"_421":4129,"_684":-5},[4130,4131],{"_46":689,"_93":688},{"_46":687,"_93":688},{"_671":691,"_653":4133,"_632":633,"_655":639},{"_693":687,"_694":695,"_696":4134,"_698":699,"_637":32,"_700":32,"_42":701,"_702":703,"_704":705,"_646":114,"_93":706},[4135],{"_694":708,"_93":709},{"_653":4137,"_632":633,"_655":639},{"_677":678,"_42":712,"_713":714,"_660":4138,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4140,"_632":633,"_655":639},{"_656":-5,"_721":722,"_42":723,"_660":4141,"_725":4142,"_93":727},{"_665":639},[4143],{"_46":729,"_93":730},{"_671":732,"_653":4145,"_632":633,"_655":639},{"_656":4146,"_42":723,"_725":4147,"_93":727},[],[729],{"_671":737,"_653":4149,"_632":633,"_655":639},{"_693":739,"_694":740,"_696":4150,"_698":699,"_637":742,"_700":32,"_42":743,"_702":744,"_704":705,"_646":114,"_93":706},[4151],{"_694":746,"_93":709},{"_653":4153,"_632":633,"_655":639},{"_677":749,"_42":-5,"_660":4154,"_291":-5,"_680":4155,"_93":682},{"_665":639},{"_421":4156,"_684":-5},[4157,4158],{"_46":755,"_93":688},{"_46":739,"_93":688},{"_653":4160,"_632":633,"_655":639},{"_677":749,"_42":758,"_713":759,"_660":4161,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4163,"_632":633,"_655":639},{"_656":-5,"_721":763,"_42":764,"_660":4164,"_725":4165,"_93":727},{"_665":639},[],{"_671":768,"_653":4167,"_632":633,"_655":639},{"_656":4168,"_42":764,"_725":4169,"_93":727},[],[],{"_671":773,"_653":4171,"_632":633,"_655":639},{"_693":-5,"_694":775,"_696":4172,"_698":699,"_637":777,"_700":32,"_42":778,"_702":779,"_704":705,"_646":114,"_93":706},[4173],{"_694":781,"_93":709},{"_653":4175,"_632":633,"_655":639},{"_677":784,"_42":-5,"_660":4176,"_291":-5,"_680":4177,"_93":682},{"_665":639},{"_421":4178,"_684":-5},[4179,4180],{"_46":790,"_93":688},{"_46":305,"_93":688},{"_653":4182,"_632":633,"_655":639},{"_677":784,"_42":793,"_713":794,"_660":4183,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4185,"_632":633,"_655":639},{"_656":-5,"_721":798,"_42":799,"_660":4186,"_725":4187,"_93":727},{"_665":639},[4188],{"_46":803,"_93":730},{"_671":805,"_653":4190,"_632":633,"_655":639},{"_656":4191,"_42":799,"_725":4192,"_93":727},[],[803],{"_671":810,"_653":4194,"_632":633,"_655":639},{"_693":812,"_694":813,"_696":4195,"_698":699,"_637":815,"_700":32,"_42":816,"_702":817,"_704":705,"_646":114,"_93":706},[4196],{"_694":819,"_93":709},{"_653":4198,"_632":633,"_655":639},{"_677":822,"_42":-5,"_660":4199,"_291":-5,"_680":4200,"_93":682},{"_665":639},{"_421":4201,"_684":-5},[4202,4203],{"_46":828,"_93":688},{"_46":812,"_93":688},{"_653":4205,"_632":633,"_655":639},{"_677":822,"_42":831,"_713":832,"_660":4206,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4208,"_632":633,"_655":639},{"_656":-5,"_721":836,"_42":837,"_660":4209,"_725":4210,"_93":727},{"_665":639},[4211],{"_46":841,"_93":730},{"_671":843,"_653":4213,"_632":633,"_655":639},{"_656":4214,"_42":837,"_725":4215,"_93":727},[],[841],{"_671":848,"_653":4217,"_632":633,"_655":639},{"_693":850,"_694":740,"_696":4218,"_698":699,"_637":852,"_700":853,"_42":854,"_702":855,"_704":705,"_646":856,"_93":706},[4219],{"_694":746,"_93":709},{"_653":4221,"_632":633,"_655":639},{"_677":860,"_42":-5,"_660":4222,"_291":-5,"_680":4223,"_93":682},{"_665":639},{"_421":4224,"_684":-5},[4225,4226],{"_46":866,"_93":688},{"_46":850,"_93":688},{"_653":4228,"_632":633,"_655":639},{"_677":860,"_42":869,"_713":759,"_660":4229,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4231,"_632":633,"_655":639},{"_656":-5,"_721":873,"_42":874,"_660":4232,"_725":4233,"_93":727},{"_665":639},[4234],{"_46":878,"_93":730},{"_671":880,"_653":4236,"_632":633,"_655":639},{"_656":4237,"_42":874,"_725":4238,"_93":727},[],[878],{"_671":885,"_653":4240,"_632":633,"_655":639},{"_693":-5,"_694":887,"_696":4241,"_698":699,"_637":889,"_700":32,"_42":890,"_702":891,"_704":705,"_646":114,"_93":706},[4242],{"_694":893,"_93":709},{"_653":4244,"_632":633,"_655":639},{"_677":896,"_42":-5,"_660":4245,"_291":-5,"_680":4246,"_93":682},{"_665":639},{"_421":4247,"_684":-5},[4248,4249],{"_46":902,"_93":688},{"_46":305,"_93":688},{"_653":4251,"_632":633,"_655":639},{"_677":896,"_42":905,"_713":906,"_660":4252,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4254,"_632":633,"_655":639},{"_656":-5,"_721":910,"_42":911,"_660":4255,"_725":4256,"_93":727},{"_665":639},[4257],{"_46":915,"_93":730},{"_671":917,"_653":4259,"_632":633,"_655":639},{"_656":4260,"_42":911,"_725":4261,"_93":727},[],[915],{"_671":922,"_653":4263,"_632":633,"_655":639},{"_693":924,"_694":925,"_696":4264,"_698":699,"_637":927,"_700":853,"_42":928,"_702":929,"_704":705,"_646":856,"_93":706},[4265],{"_694":931,"_93":709},{"_653":4267,"_632":633,"_655":639},{"_677":934,"_42":-5,"_660":4268,"_291":-5,"_680":4269,"_93":682},{"_665":639},{"_421":4270,"_684":-5},[4271,4272],{"_46":940,"_93":688},{"_46":924,"_93":688},{"_653":4274,"_632":633,"_655":639},{"_677":934,"_42":943,"_713":944,"_660":4275,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4277,"_632":633,"_655":639},{"_656":-5,"_721":948,"_42":949,"_660":4278,"_725":4279,"_93":727},{"_665":639},[4280],{"_46":953,"_93":730},{"_671":955,"_653":4282,"_632":633,"_655":639},{"_656":4283,"_42":949,"_725":4284,"_93":727},[],[953],{"_671":960,"_653":4286,"_632":633,"_655":639},{"_693":962,"_694":963,"_696":4287,"_698":699,"_637":965,"_700":853,"_42":966,"_702":967,"_704":705,"_646":856,"_93":706},[4288],{"_694":969,"_93":709},{"_653":4290,"_632":633,"_655":639},{"_677":972,"_42":-5,"_660":4291,"_291":-5,"_680":4292,"_93":682},{"_665":639},{"_421":4293,"_684":-5},[4294,4295],{"_46":978,"_93":688},{"_46":962,"_93":688},{"_653":4297,"_632":633,"_655":639},{"_677":972,"_42":981,"_713":982,"_660":4298,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4300,"_632":633,"_655":639},{"_656":-5,"_721":986,"_42":987,"_660":4301,"_725":4302,"_93":727},{"_665":639},[4303],{"_46":991,"_93":730},{"_671":993,"_653":4305,"_632":633,"_655":639},{"_656":4306,"_42":987,"_725":4307,"_93":727},[],[991],{"_653":4309,"_632":633,"_655":639},{"_677":999,"_42":-5,"_660":4310,"_291":-5,"_680":4311,"_93":682},{"_665":639},{"_421":4312,"_684":-5},[4313,4314],{"_46":689,"_93":688},{"_46":1005,"_93":688},{"_671":1007,"_653":4316,"_632":633,"_655":639},{"_693":1005,"_694":1009,"_696":4317,"_698":699,"_637":32,"_700":32,"_42":1011,"_702":1012,"_704":705,"_646":114,"_93":706},[4318,4319],{"_694":1019,"_291":1020,"_214":1021,"_93":1018},{"_694":1015,"_291":1016,"_214":1017,"_93":1018},{"_653":4321,"_632":633,"_655":639},{"_677":999,"_42":1024,"_713":1025,"_660":4322,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4324,"_632":633,"_655":639},{"_656":-5,"_721":1029,"_42":1030,"_660":4325,"_725":4326,"_93":727},{"_665":639},[4327],{"_46":1034,"_93":730},{"_671":1036,"_653":4329,"_632":633,"_655":639},{"_656":4330,"_42":1030,"_725":4331,"_93":727},[],[1034],{"_653":4333,"_632":633,"_655":639},{"_677":1042,"_42":-5,"_660":4334,"_291":-5,"_680":4335,"_93":682},{"_665":639},{"_421":4336,"_684":-5},[4337,4338],{"_46":1049,"_93":688},{"_46":1048,"_93":688},{"_653":4340,"_632":633,"_655":639},{"_677":1042,"_42":1052,"_713":1053,"_660":4341,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4343,"_632":633,"_655":639},{"_656":-5,"_721":1057,"_42":1058,"_660":4344,"_725":4345,"_93":727},{"_665":639},[4346],{"_46":1062,"_93":730},{"_671":1064,"_653":4348,"_632":633,"_655":639},{"_656":4349,"_42":1058,"_725":4350,"_93":727},[],[1062],{"_653":4352,"_632":633,"_655":639},{"_677":1070,"_42":-5,"_660":4353,"_291":-5,"_680":4354,"_93":682},{"_665":639},{"_421":4355,"_684":-5},[4356,4357],{"_46":689,"_93":688},{"_46":1076,"_93":688},{"_671":1078,"_653":4359,"_632":633,"_655":639},{"_693":1076,"_694":1080,"_696":4360,"_698":699,"_637":32,"_700":32,"_42":1082,"_702":1083,"_704":705,"_646":114,"_93":706},[4361],{"_694":1085,"_93":709},{"_653":4363,"_632":633,"_655":639},{"_677":1070,"_42":1088,"_713":1089,"_660":4364,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4366,"_632":633,"_655":639},{"_656":-5,"_721":1093,"_42":1094,"_660":4367,"_725":4368,"_93":727},{"_665":639},[4369],{"_46":1098,"_93":730},{"_671":1100,"_653":4371,"_632":633,"_655":639},{"_656":4372,"_42":1094,"_725":4373,"_93":727},[],[1098],{"_653":4375,"_632":633,"_655":639},{"_677":1106,"_42":-5,"_660":4376,"_291":-5,"_680":4377,"_93":682},{"_665":639},{"_421":4378,"_684":-5},[4379,4380],{"_46":689,"_93":688},{"_46":1112,"_93":688},{"_671":1114,"_653":4382,"_632":633,"_655":639},{"_693":1112,"_694":1116,"_696":4383,"_698":699,"_637":32,"_700":32,"_42":1118,"_702":1119,"_704":705,"_646":114,"_93":706},[4384],{"_694":1121,"_93":709},{"_653":4386,"_632":633,"_655":639},{"_677":1106,"_42":1124,"_713":1125,"_660":4387,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4389,"_632":633,"_655":639},{"_656":-5,"_721":1129,"_42":1130,"_660":4390,"_725":4391,"_93":727},{"_665":639},[4392],{"_46":1134,"_93":730},{"_671":1136,"_653":4394,"_632":633,"_655":639},{"_656":4395,"_42":1130,"_725":4396,"_93":727},[],[1134],{"_671":1141,"_653":4398,"_632":633,"_655":639},{"_693":1143,"_694":1144,"_696":4399,"_698":699,"_637":1146,"_700":32,"_42":1147,"_702":1148,"_704":705,"_646":114,"_93":706},[4400],{"_694":1150,"_93":709},{"_653":4402,"_632":633,"_655":639},{"_677":1153,"_42":-5,"_660":4403,"_291":-5,"_680":4404,"_93":682},{"_665":639},{"_421":4405,"_684":-5},[4406,4407],{"_46":1160,"_93":688},{"_46":1159,"_93":688},{"_653":4409,"_632":633,"_655":639},{"_677":1153,"_42":1163,"_713":1164,"_660":4410,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4412,"_632":633,"_655":639},{"_656":-5,"_721":1168,"_42":1169,"_660":4413,"_725":4414,"_93":727},{"_665":639},[4415],{"_46":1173,"_93":730},{"_671":1175,"_653":4417,"_632":633,"_655":639},{"_656":4418,"_42":1169,"_725":4419,"_93":727},[],[1173],{"_653":4421,"_632":633,"_655":639},{"_677":1181,"_42":-5,"_660":4422,"_291":-5,"_680":4423,"_93":682},{"_665":639},{"_421":4424,"_684":-5},[4425,4426],{"_46":689,"_93":688},{"_46":1187,"_93":688},{"_671":1189,"_653":4428,"_632":633,"_655":639},{"_1191":4429,"_42":1193,"_646":114,"_93":1194},[4430],{"_431":1196,"_9":4431,"_214":1198},{"_1199":-5,"_93":1200},{"_653":4433,"_632":633,"_655":639},{"_677":1181,"_42":1203,"_713":1204,"_660":4434,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4436,"_632":633,"_655":639},{"_656":-5,"_721":1208,"_42":1209,"_660":4437,"_725":4438,"_93":727},{"_665":639},[4439],{"_46":1213,"_93":730},{"_671":1215,"_653":4441,"_632":633,"_655":639},{"_656":4442,"_42":1209,"_725":4443,"_93":727},[],[1213],{"_653":4445,"_632":633,"_655":639},{"_677":1221,"_42":-5,"_660":4446,"_291":-5,"_680":4447,"_93":682},{"_665":639},{"_421":4448,"_684":-5},[4449,4450],{"_46":689,"_93":688},{"_46":1227,"_93":688},{"_671":1229,"_653":4452,"_632":633,"_655":639},{"_693":1227,"_694":1231,"_696":4453,"_698":699,"_637":32,"_700":32,"_42":1233,"_702":1234,"_704":705,"_646":114,"_93":706},[4454,4455,4456],{"_694":1246,"_291":1247,"_214":1198,"_93":1018},{"_694":1243,"_291":1244,"_214":1245,"_93":1018},{"_694":1238,"_214":1239,"_1240":1241,"_93":1242},{"_653":4458,"_632":633,"_655":639},{"_677":1221,"_42":1250,"_713":1251,"_660":4459,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4461,"_632":633,"_655":639},{"_656":-5,"_721":1255,"_42":1256,"_660":4462,"_725":4463,"_93":727},{"_665":639},[4464],{"_46":1260,"_93":730},{"_671":1262,"_653":4466,"_632":633,"_655":639},{"_656":4467,"_42":1256,"_725":4468,"_93":727},[],[1260],{"_653":4470,"_632":633,"_655":639},{"_677":1268,"_42":-5,"_660":4471,"_291":-5,"_680":4472,"_93":682},{"_665":639},{"_421":4473,"_684":-5},[4474,4475],{"_46":689,"_93":688},{"_46":1274,"_93":688},{"_671":1276,"_653":4477,"_632":633,"_655":639},{"_693":1274,"_694":1278,"_696":4478,"_698":699,"_637":32,"_700":32,"_42":1280,"_702":1281,"_704":705,"_646":114,"_93":706},[4479],{"_694":1283,"_214":1284,"_1240":1285,"_93":1242},{"_653":4481,"_632":633,"_655":639},{"_677":1268,"_42":1288,"_713":1289,"_660":4482,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4484,"_632":633,"_655":639},{"_656":-5,"_721":1293,"_42":1294,"_660":4485,"_725":4486,"_93":727},{"_665":639},[4487],{"_46":1298,"_93":730},{"_671":1300,"_653":4489,"_632":633,"_655":639},{"_656":4490,"_42":1294,"_725":4491,"_93":727},[],[1298],{"_653":4493,"_632":633,"_655":639},{"_677":1306,"_42":-5,"_660":4494,"_291":-5,"_680":4495,"_93":682},{"_665":639},{"_421":4496,"_684":-5},[4497,4498],{"_46":689,"_93":688},{"_46":1312,"_93":688},{"_671":1314,"_653":4500,"_632":633,"_655":639},{"_693":1312,"_694":1316,"_696":4501,"_698":699,"_637":32,"_700":32,"_42":1318,"_702":1319,"_704":705,"_646":114,"_93":706},[4502],{"_694":1321,"_291":1322,"_214":1323,"_93":1018},{"_653":4504,"_632":633,"_655":639},{"_677":1306,"_42":1326,"_713":1327,"_660":4505,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4507,"_632":633,"_655":639},{"_656":-5,"_721":1331,"_42":1332,"_660":4508,"_725":4509,"_93":727},{"_665":639},[4510],{"_46":1336,"_93":730},{"_671":1338,"_653":4512,"_632":633,"_655":639},{"_656":4513,"_42":1332,"_725":4514,"_93":727},[],[1336],{"_671":1343,"_653":4516,"_632":633,"_655":639},{"_693":1345,"_694":1144,"_696":4517,"_698":699,"_637":1347,"_700":853,"_42":1348,"_702":1349,"_704":705,"_646":856,"_93":706},[4518],{"_694":1150,"_93":709},{"_653":4520,"_632":633,"_655":639},{"_677":1353,"_42":-5,"_660":4521,"_291":-5,"_680":4522,"_93":682},{"_665":639},{"_421":4523,"_684":-5},[4524,4525],{"_46":1360,"_93":688},{"_46":1359,"_93":688},{"_653":4527,"_632":633,"_655":639},{"_677":1353,"_42":1363,"_713":1364,"_660":4528,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4530,"_632":633,"_655":639},{"_656":-5,"_721":1368,"_42":1369,"_660":4531,"_725":4532,"_93":727},{"_665":639},[],{"_671":1373,"_653":4534,"_632":633,"_655":639},{"_656":4535,"_42":1369,"_725":4536,"_93":727},[],[],{"_653":4538,"_632":633,"_655":639},{"_677":1379,"_42":-5,"_660":4539,"_291":-5,"_680":4540,"_93":682},{"_665":639},{"_421":4541,"_684":-5},[4542,4543],{"_46":1386,"_93":688},{"_46":1385,"_93":688},{"_671":1388,"_653":4545,"_632":633,"_655":639},{"_693":1385,"_694":1390,"_696":4546,"_698":699,"_637":853,"_700":32,"_42":1392,"_702":1393,"_704":705,"_646":114,"_93":706},[4547],{"_694":1395,"_93":709},{"_653":4549,"_632":633,"_655":639},{"_677":1379,"_42":1398,"_713":1399,"_660":4550,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4552,"_632":633,"_655":639},{"_656":-5,"_721":1403,"_42":1404,"_660":4553,"_725":4554,"_93":727},{"_665":639},[4555],{"_46":1408,"_93":730},{"_671":1410,"_653":4557,"_632":633,"_655":639},{"_656":4558,"_42":1404,"_725":4559,"_93":727},[],[1408],{"_653":4561,"_632":633,"_655":639},{"_677":1416,"_42":-5,"_660":4562,"_680":4563,"_93":1419},{"_665":639},{"_421":4564,"_684":-5},[4565,4566],{"_46":1424,"_93":688},{"_46":1423,"_93":688},{"_653":4568,"_632":633,"_655":639},{"_1427":1428,"_677":1416,"_42":1429,"_660":4569,"_291":1431,"_717":-5,"_93":1432},{"_665":639},{"_653":4571,"_632":633,"_655":639},{"_677":1435,"_42":-5,"_660":4572,"_291":-5,"_680":1437,"_93":682},{"_665":639},{"_653":4574,"_632":633,"_655":639},{"_677":1435,"_42":1440,"_713":1364,"_660":4575,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4577,"_632":633,"_655":639},{"_656":-5,"_721":1444,"_42":1445,"_660":4578,"_725":4579,"_93":727},{"_665":639},[],{"_671":1449,"_653":4581,"_632":633,"_655":639},{"_656":4582,"_42":1445,"_725":4583,"_93":727},[],[],{"_653":4585,"_632":633,"_655":639},{"_677":1455,"_42":-5,"_660":4586,"_680":4587,"_93":1419},{"_665":639},{"_421":4588,"_684":-5},[4589,4590],{"_46":1462,"_93":688},{"_46":1461,"_93":688},{"_653":4592,"_632":633,"_655":639},{"_1427":1465,"_677":1455,"_42":1466,"_660":4593,"_291":1431,"_717":-5,"_93":1432},{"_665":639},{"_653":4595,"_632":633,"_655":639},{"_677":1470,"_42":-5,"_660":4596,"_291":-5,"_680":1472,"_93":682},{"_665":639},{"_653":4598,"_632":633,"_655":639},{"_677":1470,"_42":1475,"_713":1364,"_660":4599,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4601,"_632":633,"_655":639},{"_656":-5,"_721":1479,"_42":1480,"_660":4602,"_725":4603,"_93":727},{"_665":639},[],{"_671":1484,"_653":4605,"_632":633,"_655":639},{"_656":4606,"_42":1480,"_725":4607,"_93":727},[],[],{"_653":4609,"_632":633,"_655":639},{"_677":1490,"_42":-5,"_660":4610,"_680":4611,"_93":1419},{"_665":639},{"_421":4612,"_684":-5},[4613,4614],{"_46":1424,"_93":688},{"_46":1496,"_93":688},{"_653":4616,"_632":633,"_655":639},{"_1427":1499,"_677":1490,"_42":1500,"_660":4617,"_291":1431,"_717":-5,"_93":1432},{"_665":639},{"_653":4619,"_632":633,"_655":639},{"_677":1504,"_42":-5,"_660":4620,"_291":-5,"_680":1506,"_93":682},{"_665":639},{"_653":4622,"_632":633,"_655":639},{"_677":1504,"_42":1509,"_713":1364,"_660":4623,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4625,"_632":633,"_655":639},{"_656":-5,"_721":1513,"_42":1514,"_660":4626,"_725":4627,"_93":727},{"_665":639},[],{"_671":1518,"_653":4629,"_632":633,"_655":639},{"_656":4630,"_42":1514,"_725":4631,"_93":727},[],[],{"_653":4633,"_632":633,"_655":639},{"_677":1524,"_42":-5,"_660":4634,"_291":-5,"_680":4635,"_93":682},{"_665":639},{"_421":4636,"_684":-5},[4637,4638],{"_46":1531,"_93":688},{"_46":1530,"_93":688},{"_653":4640,"_632":633,"_655":639},{"_677":1524,"_42":1534,"_713":1535,"_660":4641,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4643,"_632":633,"_655":639},{"_656":-5,"_721":1539,"_42":1540,"_660":4644,"_725":4645,"_93":727},{"_665":639},[],{"_671":1544,"_653":4647,"_632":633,"_655":639},{"_656":4648,"_42":1540,"_725":4649,"_93":727},[],[],{"_653":4651,"_632":633,"_655":639},{"_677":1550,"_42":-5,"_660":4652,"_680":4653,"_93":1419},{"_665":639},{"_421":4654,"_684":-5},[4655,4656],{"_46":1049,"_93":688},{"_46":305,"_93":688},{"_653":4658,"_632":633,"_655":639},{"_1427":1558,"_677":1550,"_42":1559,"_660":4659,"_291":1431,"_717":-5,"_93":1432},{"_665":639},{"_653":4661,"_632":633,"_655":639},{"_656":-5,"_721":1563,"_42":1564,"_660":4662,"_725":4663,"_93":727},{"_665":639},[4664],{"_46":1568,"_93":730},{"_671":1570,"_653":4666,"_632":633,"_655":639},{"_656":4667,"_42":1564,"_725":4668,"_93":727},[],[1568],{"_653":4670,"_632":633,"_655":639},{"_677":1576,"_42":-5,"_660":4671,"_291":-5,"_680":1578,"_93":682},{"_665":639},{"_653":4673,"_632":633,"_655":639},{"_677":1576,"_42":1581,"_713":1582,"_660":4674,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4676,"_632":633,"_655":639},{"_677":1586,"_42":-5,"_660":4677,"_291":-5,"_680":4678,"_93":682},{"_665":639},{"_421":4679,"_684":-5},[4680,4681],{"_46":1531,"_93":688},{"_46":305,"_93":688},{"_653":4683,"_632":633,"_655":639},{"_677":1586,"_42":1594,"_713":1595,"_660":4684,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4686,"_632":633,"_655":639},{"_677":1599,"_42":-5,"_660":4687,"_291":-5,"_680":4688,"_93":682},{"_665":639},{"_421":4689,"_684":-5},[4690,4691],{"_46":1531,"_93":688},{"_46":305,"_93":688},{"_653":4693,"_632":633,"_655":639},{"_677":1599,"_42":1607,"_713":1608,"_660":4694,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4696,"_632":633,"_655":639},{"_677":1612,"_42":-5,"_660":4697,"_291":-5,"_680":4698,"_93":682},{"_665":639},{"_421":4699,"_684":-5},[4700,4701],{"_46":1531,"_93":688},{"_46":305,"_93":688},{"_653":4703,"_632":633,"_655":639},{"_677":1612,"_42":1620,"_713":1608,"_660":4704,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4706,"_632":633,"_655":639},{"_677":1624,"_42":-5,"_660":4707,"_291":-5,"_680":4708,"_93":682},{"_665":639},{"_421":4709,"_684":-5},[4710,4711],{"_46":1531,"_93":688},{"_46":305,"_93":688},{"_653":4713,"_632":633,"_655":639},{"_677":1624,"_42":1632,"_713":1608,"_660":4714,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4716,"_632":633,"_655":639},{"_656":-5,"_721":1636,"_42":1637,"_660":4717,"_725":4718,"_93":727},{"_665":639},[],{"_671":1641,"_653":4720,"_632":633,"_655":639},{"_656":4721,"_42":1637,"_725":4722,"_93":727},[],[],{"_653":4724,"_632":633,"_655":639},{"_677":1647,"_42":-5,"_660":4725,"_291":-5,"_680":4726,"_93":682},{"_665":639},{"_421":4727,"_684":-5},[4728,4729],{"_46":1654,"_93":688},{"_46":1653,"_93":688},{"_653":4731,"_632":633,"_655":639},{"_677":1647,"_42":1657,"_713":1658,"_660":4732,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4734,"_632":633,"_655":639},{"_656":-5,"_721":1662,"_42":1663,"_660":4735,"_725":4736,"_93":727},{"_665":639},[4737],{"_46":1667,"_93":730},{"_671":1669,"_653":4739,"_632":633,"_655":639},{"_656":4740,"_42":1663,"_725":4741,"_93":727},[],[1667],{"_671":1674,"_653":4743,"_632":633,"_655":639},{"_693":1676,"_694":1677,"_696":4744,"_698":699,"_637":1679,"_700":32,"_42":1680,"_702":1681,"_704":705,"_646":114,"_93":706},[4745],{"_694":1683,"_93":709},{"_653":4747,"_632":633,"_655":639},{"_677":1686,"_42":-5,"_660":4748,"_291":-5,"_680":4749,"_93":682},{"_665":639},{"_421":4750,"_684":-5},[4751,4752],{"_46":1692,"_93":688},{"_46":1676,"_93":688},{"_653":4754,"_632":633,"_655":639},{"_677":1686,"_42":1695,"_713":1696,"_660":4755,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4757,"_632":633,"_655":639},{"_677":1700,"_42":-5,"_660":4758,"_291":-5,"_680":4759,"_93":682},{"_665":639},{"_421":4760,"_684":-5},[4761,4762],{"_46":1706,"_93":688},{"_46":1187,"_93":688},{"_671":1708,"_653":4764,"_632":633,"_655":639},{"_1191":4765,"_42":1711,"_646":114,"_93":1194},[4766],{"_431":1713,"_9":4767,"_214":1323},{"_1199":-5,"_93":1200},{"_653":4769,"_632":633,"_655":639},{"_677":1700,"_42":1717,"_713":1718,"_660":4770,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4772,"_632":633,"_655":639},{"_656":-5,"_721":1722,"_42":1723,"_660":4773,"_725":4774,"_93":727},{"_665":639},[4775],{"_46":1727,"_93":730},{"_671":1729,"_653":4777,"_632":633,"_655":639},{"_656":4778,"_42":1723,"_725":4779,"_93":727},[],[1727],{"_671":1734,"_653":4781,"_632":633,"_655":639},{"_693":1736,"_694":1737,"_696":4782,"_698":699,"_637":1739,"_700":32,"_42":1740,"_702":1741,"_704":705,"_646":114,"_93":706},[4783],{"_694":1743,"_93":709},{"_653":4785,"_632":633,"_655":639},{"_677":1746,"_42":-5,"_660":4786,"_291":-5,"_680":4787,"_93":682},{"_665":639},{"_421":4788,"_684":-5},[4789,4790],{"_46":1752,"_93":688},{"_46":1736,"_93":688},{"_653":4792,"_632":633,"_655":639},{"_677":1746,"_42":1755,"_713":1756,"_660":4793,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4795,"_632":633,"_655":639},{"_656":-5,"_721":1760,"_42":1761,"_660":4796,"_725":4797,"_93":727},{"_665":639},[4798],{"_46":1765,"_93":730},{"_671":1767,"_653":4800,"_632":633,"_655":639},{"_656":4801,"_42":1761,"_725":4802,"_93":727},[],[1765],{"_653":4804,"_632":633,"_655":639},{"_677":1773,"_42":-5,"_660":4805,"_291":-5,"_680":4806,"_93":682},{"_665":639},{"_421":4807,"_684":-5},[4808,4809],{"_46":1780,"_93":688},{"_46":1779,"_93":688},{"_653":4811,"_632":633,"_655":639},{"_677":1773,"_42":1783,"_713":1784,"_660":4812,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4814,"_632":633,"_655":639},{"_656":-5,"_721":1788,"_42":1789,"_660":4815,"_725":4816,"_93":727},{"_665":639},[4817,4818],{"_46":1795,"_93":730},{"_46":1794,"_93":730},{"_671":1797,"_653":4820,"_632":633,"_655":639},{"_656":4821,"_42":1789,"_725":4822,"_93":727},[],[1795,1794],{"_671":1802,"_653":4824,"_632":633,"_655":639},{"_693":1804,"_694":1805,"_696":4825,"_698":699,"_637":1807,"_700":32,"_42":1808,"_702":1809,"_704":705,"_646":114,"_93":706},[4826],{"_694":1811,"_93":709},{"_653":4828,"_632":633,"_655":639},{"_677":1814,"_42":-5,"_660":4829,"_291":-5,"_680":4830,"_93":682},{"_665":639},{"_421":4831,"_684":-5},[4832,4833],{"_46":1820,"_93":688},{"_46":1804,"_93":688},{"_653":4835,"_632":633,"_655":639},{"_677":1814,"_42":1823,"_713":1824,"_660":4836,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4838,"_632":633,"_655":639},{"_656":-5,"_721":1828,"_42":1829,"_660":4839,"_725":4840,"_93":727},{"_665":639},[4841,4842],{"_46":1835,"_93":730},{"_46":1834,"_93":730},{"_671":1837,"_653":4844,"_632":633,"_655":639},{"_656":4845,"_42":1829,"_725":4846,"_93":727},[],[1835,1834],{"_653":4848,"_632":633,"_655":639},{"_677":1843,"_42":-5,"_660":4849,"_291":-5,"_680":4850,"_93":682},{"_665":639},{"_421":4851,"_684":-5},[4852,4853],{"_46":1386,"_93":688},{"_46":1849,"_93":688},{"_671":1851,"_653":4855,"_632":633,"_655":639},{"_693":1849,"_694":1853,"_696":4856,"_698":699,"_637":32,"_700":32,"_42":1855,"_702":1856,"_704":705,"_646":114,"_93":706},[4857],{"_694":1858,"_93":709},{"_653":4859,"_632":633,"_655":639},{"_677":1843,"_42":1861,"_713":1862,"_660":4860,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4862,"_632":633,"_655":639},{"_656":-5,"_721":1866,"_42":1867,"_660":4863,"_725":4864,"_93":727},{"_665":639},[4865],{"_46":1871,"_93":730},{"_671":1873,"_653":4867,"_632":633,"_655":639},{"_656":4868,"_42":1867,"_725":4869,"_93":727},[],[1871],{"_653":4871,"_632":633,"_655":639},{"_677":1879,"_42":-5,"_660":4872,"_291":-5,"_680":4873,"_93":682},{"_665":639},{"_421":4874,"_684":-5},[4875,4876],{"_46":1886,"_93":688},{"_46":1885,"_93":688},{"_671":1888,"_653":4878,"_632":633,"_655":639},{"_693":1885,"_694":1890,"_696":4879,"_698":699,"_637":32,"_700":32,"_42":1892,"_702":1893,"_704":705,"_646":114,"_93":706},[4880],{"_694":1895,"_93":709},{"_653":4882,"_632":633,"_655":639},{"_677":1879,"_42":1898,"_713":1899,"_660":4883,"_291":716,"_717":-5,"_646":114,"_93":718},{"_665":639},{"_653":4885,"_632":633,"_655":639},{"_656":-5,"_721":1903,"_42":1904,"_660":4886,"_725":4887,"_93":727},{"_665":639},[4888],{"_46":1908,"_93":730},{"_671":1910,"_653":4890,"_632":633,"_655":639},{"_656":4891,"_42":1904,"_725":4892,"_93":727},[],[1908],{"_671":1915,"_653":4894,"_632":633,"_655":639},{"_1917":-5,"_656":4895,"_42":1919,"_93":1920},[4896],{"_46":1922,"_1923":4897,"_93":46},[],{"_653":4899,"_632":633,"_655":639},{"_656":4900,"_658":-5,"_42":-5,"_660":4901,"_662":-5,"_97":432,"_93":664},[4902],{"_665":639},{"_46":1922,"_93":688},{"_653":4904,"_632":633,"_655":639},{"_656":4905,"_658":-5,"_42":-5,"_660":4906,"_662":-5,"_97":432,"_93":664},[4907,4908],{"_665":639},{"_46":1937,"_93":688},{"_46":1936,"_93":688},{"_653":4910,"_632":633,"_655":639},{"_656":4911,"_658":-5,"_42":-5,"_660":4912,"_662":-5,"_97":1942,"_93":664},[4913],{"_665":639},{"_46":1944,"_93":688},{"_653":4915,"_632":633,"_655":639},{"_656":4916,"_658":-5,"_42":-5,"_660":4917,"_662":-5,"_97":1942,"_93":664},[4918],{"_665":639},{"_46":1950,"_93":688},{"_653":4920,"_632":633,"_655":639},{"_656":4921,"_658":-5,"_42":-5,"_660":4922,"_662":-5,"_97":1942,"_93":664},[4923,4924],{"_665":639},{"_46":1958,"_93":688},{"_46":1957,"_93":688},{"_632":633,"_88":4926},{"_104":-5,"_42":639,"_640":4927,"_642":643,"_644":645,"_646":1963},[],{"_646":4929,"_632":633},{"_1966":4930,"_93":1968},[],{"_1971":4932},{"_1973":-5,"_1974":-5,"_1975":1976,"_1977":645,"_698":699,"_1978":15,"_1979":-5,"_1980":-5,"_1981":-5,"_1982":1983,"_42":633,"_1984":1985,"_291":-5,"_1986":-5,"_214":1987,"_1988":305,"_1989":645,"_1990":633,"_704":1991,"_646":4933,"_1993":-5,"_78":4934,"_1995":645},{"_93":650},[],[],[4937],{"_42":2000,"_2001":4938,"_2003":2004,"_2005":2004,"_656":4939,"_646":2007,"_658":-5,"_2008":32,"_2009":4940,"_2011":406,"_2012":-5},{"_97":432,"_291":-5,"_2009":4944},{"_2017":46,"_2018":4943},{"_2013":4941},{"_2015":4942},[],[2020],{},{"_93":664,"_97":94,"_656":4960},{"_93":2056,"_2057":4951},{"_93":2030,"_2031":2032,"_2033":2034,"_2035":4948,"_2037":-5},{"_93":2035,"_2038":699,"_129":130,"_2039":-5,"_431":2040,"_2041":4949,"_2043":2044,"_2045":2046,"_2047":2048,"_2049":2050,"_2051":4950},{"_2053":2054,"_2055":-5},[],[4952,4953],{"_214":2163,"_2062":-5,"_2063":4957,"_2065":-5},{"_214":2061,"_2062":-5,"_2063":4954,"_2065":-5},[4955],{"_2067":853,"_2068":2069,"_656":4956,"_2071":59},[2072,2073,2074,2075,305,2076,2077,2078,2079,2080,2081,2082,2083,305,2084,2085,2086,2087,2088,2089,2090,2091,2092,305,2084,2093,2094,2095,2096,2089,2097,2098,2099,2100,2101,2092,305,2084,2102,2103,2104,2088,2089,2097,2098,2105,2106,2107,2100,2108,2092,305,2084,2109,2103,2110,2111,2112,2097,2098,2105,2106,2107,2100,2108,2092,305,2084,2113,2114,2115,2096,2089,2097,2098,2105,2116,2106,2100,2108,2092,305,2084,2117,2114,2118,2096,2089,2097,2098,2105,2116,2106,2100,2108,2092,305,2084,2119,2114,2120,2096,2089,2097,2098,2105,2116,2121,2106,2107,2100,2108,2092,305,2084,2122,2114,2123,2096,2089,2097,2098,2107,2100,2108,2092,305,2084,2124,2103,2125,2096,2089,2097,2098,2105,2116,2106,2126,2100,2127,2092,305,2084,2128,2103,2129,2096,2089,2097,2098,2105,2130,2131,2121,2106,2132,2100,2127,2092,305,2084,2133,2103,2134,2096,2089,2097,2098,2135,2132,2100,2136,2127,2092,305,2084,2137,2094,2138,2096,2139,2097,2098,2099,2106,2100,2140,2092,305,2084,2141,2114,2142,2096,2089,2097,2098,2105,2116,2106,2100,2127,2092,305,2084,2143,2114,2144,2096,2089,2097,2098,2105,2116,2106,2100,2127,2092,305,2084,2145,2114,2146,2096,2089,2097,2098,2105,2116,2121,2106,2107,2100,2127,2092,305,2084,2147,2114,2148,2096,2089,2097,2098,2105,2116,2107,2106,2100,2127,2092,305,2084,2149,2103,2150,2096,2151,2097,2098,2105,2116,2106,2132,2152,2107,2100,2127,2092,305,2084,2153,2114,2154,2155,2156,2097,2098,2157,2100,2127,2092,305,2084,2158,2114,2159,2160,2156,2097,2098,2157,2100,2127,2092,305,2084,2161,2114,2162,2160,2156,2097,2098,2157,2100,2127,2092],[4958],{"_2067":853,"_2068":2166,"_656":4959,"_2071":59},[2168,305,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,2180,2177,2181,2182,305,2183,2184,305,2185,2186,305,2187,2188,2189,2190,2191,2192,2193,2194,305,2195,2196,2197,2198,2199,305,2200,2201,2202,2203,2204,2205,2206,2207,2208,2209,305,2210,2211,2212,2213,2214,2215,2216,2217,305,2218,2219,2220,2217,305,2221,305,2222,2202,2208,2209,2223,2224,2225,305,2226,2227,2202,2208,2209,2223,2228,2229,2230,2231,2220,2217,2232,2233,2220,2217,2234,305,2235,2236,305,2237,2238,2198,2239,2240,305,2241,2198,2242,305,2243,2244,2198,2245,305,2246,2247,305,2248,2249,305,2250,2251,2252,2253,2254,2255,2256,2257,2258,2259,2260,2261,2262,2260,2263,2264,2260,2265,2266,2267,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2237,2238,2198,2239,305,2271,2272,305,2273,2274,2198,2275,2276,305,2277,2274,2198,2278,2279,305,2280,2274,2198,2281,2282,305,2283,2284,305,2285,2202,2208,2209,2286,2287,2288,2289,2290,2291,2220,2217,2292,305,2293,2294,2198,2295,2296,2297,305,2298,2299,2300,2191,2301,2192,2302,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2303,2304,2202,2208,2305,2306,2307,305,2308,2202,2203,2204,2208,2209,2309,2310,2311,2312,2313,2314,2217,305,2315,2316,2317,2191,2318,2192,2319,2320,2321,2322,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2323,2324,2198,2325,305,2326,2327,2202,2203,2328,2329,2330,2331,2332,2208,2209,2333,305,2334,2335,2336,2337,2338,2339,2340,2341,2342,2343,2214,2215,2344,305,2345,2340,2346,2344,2347,305,2348,2349,2350,2351,2352,2353,2354,2355,2356,2357,2358,305,2359,2360,2361,2362,2363,305,2364,2365,2294,2198,2366,2367,2368,2369,2370,2371,2372,2373,2297,305,2374,2202,2208,2309,2375,2376,2377,2378,2379,2380,2381,2312,305,2382,2383,2384,2191,2385,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2386,2324,2198,2366,2387,305,2388,2202,2208,2209,2389,2390,2391,2392,2393,2394,2395,2396,305,2397,2202,2208,2209,2398,2399,2400,2395,2401,2402,2403,2404,2405,305,2406,2238,2198,2239,305,2280,2274,2198,2281,2407,305,2408,2409,305,2410,2202,2208,2209,2411,2412,2413,2414,2415,2416,2417,2418,2419,2420,2421,2422,2423,2424,2425,2426,2427,305,2428,2202,2208,2429,2430,2431,2432,2433,2434,2217,305,2435,2202,2208,2309,2436,2437,2438,2439,2440,2441,2442,2312,305,2443,2444,2445,2253,2385,2255,2446,2256,2257,2447,2448,2449,2259,2450,2451,2449,2262,2452,2453,2449,2264,2454,2455,2456,2266,305,2195,2457,2197,2198,2199,2268,305,2269,2202,2270,305,2458,2324,2198,2366,2459,305,2460,2461,2202,2203,2462,2463,2464,305,2465,2466,2467,2203,2462,2463,2468,305,2469,2470,2294,2198,2471,2472,2473,2474,305,2475,2476,2477,2478,2385,305,2195,2457,2197,2198,2199,2268,305,2269,2202,2203,2329,2479,305,2458,2324,2198,2366,2459,305,2480,2202,2203,2328,2329,2208,2209,2481,2482,2483,2484,2485,305,2486,2487,2488,2489,2490,2491,2220,2217,2492,305,2493,2202,2203,2328,2329,2208,2209,2494,2495,2482,2483,2484,305,2496,2497,2498,2499,2500,2501,305,2502,2503,2504,2505,2506,2507,2508,305,2509,2510,2511,2505,2512,2513,305,2486,2487,2514,2489,2515,2516,2220,2217,2517,305,2518,2470,2294,2198,2519,2367,2520,2521,2473,2474,305,2522,2523,2524,2191,2318,305,2195,2222,2197,2198,2199,2268,305,2269,2202,2270,305,2237,2238,2198,2239,305,2280,2274,2198,2281,2407,305,2525,2526,305,2527,2470,2202,2208,2528,2529,2530,305,2531,2532,2533,2478,2534,2535,2536,2537,2538,2539,2540,2541,305,2195,2542,2202,2203,2543,2544,2545,2546,2547,2548,2208,2209,2549,2550,2551,2552,2553,2554,2555,2556,2557,2214,2215,2344,305,2558,2202,2203,2328,2329,2559,2560,2561,2562,2208,2209,2563,2350,2351,2564,2565,2566,2567,2568,2569,2570,2571,2572,2357,2573,2574,305,2309,2575,2437,2576,2577,2578,2579,2580,2581,2582,2583,2584,2437,2585,2312,305,2586,2294,2198,2587,2588,2589],[4961,4962,4963,4964,4965,4966,4967,4968,4969,4970,4971,4972,4973,4974],{"_2017":46,"_46":2627},{"_2017":2606,"_214":2163,"_2067":2625,"_2068":2626},{"_2017":2606,"_214":2163,"_2067":2623,"_2068":2624},{"_2017":2606,"_214":2163,"_2067":2621,"_2068":2622},{"_2017":2606,"_214":2163,"_2067":2620,"_2068":2608},{"_2017":2606,"_214":2061,"_2067":2618,"_2068":2619},{"_2017":46,"_46":2617},{"_2017":2606,"_214":2163,"_2067":2615,"_2068":2616},{"_2017":46,"_46":2614},{"_2017":2606,"_214":2163,"_2067":2612,"_2068":2613},{"_2017":2606,"_214":2163,"_2067":2610,"_2068":2611},{"_2017":46,"_46":2609},{"_2017":2606,"_214":2163,"_2067":2607,"_2068":2608},{"_2017":46,"_46":2605},[4977,4978,4979,4980,4981,4982,4983,4984,4985,4986,4987,4988,4989,4990,4991,4992,4993,4994,4995,4996,4997],{"_2637":2638,"_368":369,"_2639":412,"_380":-5,"_2038":363,"_2640":-5,"_2641":-5,"_2642":2643,"_2644":2645,"_2646":-5,"_2647":-5,"_2648":2649,"_2650":15,"_2651":59,"_2652":54,"_2653":15},{"_93":664,"_97":432,"_656":4998},{"_419":420,"_421":422,"_2711":426,"_2712":130,"_428":-5,"_93":2713},{"_93":2675,"_421":2710,"_214":-5,"_2677":-5,"_2678":-5},{"_93":2675,"_421":2709,"_214":-5,"_2677":-5,"_2678":-5},{"_93":2675,"_421":2708,"_214":-5,"_2677":-5,"_2678":-5},{"_93":2675,"_421":2706,"_214":2163,"_2677":2680,"_2678":2707},{"_93":2675,"_421":2705,"_214":2163,"_2677":2680,"_2678":2689},{"_93":2675,"_421":2703,"_214":2163,"_2677":2680,"_2678":2704},{"_93":2675,"_421":2701,"_214":2163,"_2677":2680,"_2678":2702},{"_93":2675,"_421":2699,"_214":2695,"_2677":2680,"_2678":2700},{"_93":2675,"_421":2697,"_214":2695,"_2677":2680,"_2678":2698},{"_93":2675,"_421":2694,"_214":2695,"_2677":2680,"_2678":2696},{"_93":2675,"_421":2691,"_214":2692,"_2677":2680,"_2678":2693},{"_93":2675,"_421":2690,"_214":2686,"_2677":2680,"_2678":-5},{"_93":2675,"_421":2688,"_214":2686,"_2677":2680,"_2678":2689},{"_93":2675,"_421":2685,"_214":2686,"_2677":2680,"_2678":2687},{"_93":2675,"_421":2684,"_214":-5,"_2677":-5,"_2678":-5},{"_93":2675,"_421":2683,"_214":-5,"_2677":-5,"_2678":-5},{"_93":2675,"_421":2682,"_214":-5,"_2677":-5,"_2678":-5},{"_93":2675,"_421":2679,"_214":2163,"_2677":2680,"_2678":2681},{"_93":2675,"_421":2676,"_214":-5,"_2677":-5,"_2678":-5},[4999],{"_2017":46,"_46":2716},"task_e_6a71c4c6a35c8333af4c04b5ab344485",1785840838.63825,"GitHub Mention: fix(release): prove one staged candidate set before publication","has_generated_title","has_unread_turn","denormalized_metadata",{"_5030":32,"_5031":5032,"_5033":-5,"_5034":-5,"_5024":5035,"_5036":-5,"_5037":-5,"_5038":-5,"_5039":-5},"task_status_display",{"_5019":5020,"_5021":302,"_131":128,"_5022":-5,"_5023":2030},"creator_workspace","external_pull_requests",[5012],{"_42":5013,"_5014":84,"_5015":5016,"_5017":130},"github-1243957878-391","assistant_turn_id","pull_request",{"_411":412,"_401":413,"_414":415,"_416":15,"_417":59,"_418":59,"_419":420,"_421":422,"_423":373,"_424":128,"_425":426,"_427":130,"_428":429,"_430":-5,"_431":-5,"_432":5018,"_434":435,"_436":437,"_438":439,"_440":441},"codex_updated_sha",{"_395":442,"_291":442,"_443":-5,"_399":444,"_42":445},"latest_turn_status_display",{"_665":84,"_113":114,"_5024":5025,"_95":5026,"_5027":-5,"_5028":-5,"_5029":2030,"_115":-5},"environment_label","fix_task_id","initial_intent","diff_stats",{"_2043":2044,"_2045":2046,"_2047":2048},[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_2043":-5,"_2045":-5,"_2047":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","dd",{"_5052":5053,"_5054":5055},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","paidCampaignAppRedirect","statsigGateEvaluationsPromise",["P",5051],"traceId","7899061547126732640","traceTime",1786086910880]