Shipwright deployment-contract hardening checklist

Bring the release/IDE deployment into full conformity with the Shipwright contract.

Version / resolution

• VSIX bundles and verifies the server binary before startup (no silent continue on a missing/mismatched binary) — [SWR-IDE-RESOLUTION], [SWR-VSIX-VERIFY]
• Profiler helper is declared in the product shipwright.json manifest — [SWR-ARCH-LIBRARIES]
• Zed extension performs handshake-level (LSP initialize) version verification, since it cannot preflight --version — [SWR-COMPAT]

Supply-chain hardening (shared controls)

• SHA-pin every GitHub Actions uses: to a 40-char commit (no @v4/@stable); add .github/dependabot.yml to keep pins fresh — [SWR-SEC-ACTION-PINNING]
• Top-level permissions: contents: read; grant write / id-token / attestations per-job only — [SWR-SEC-TOKEN-PRIVILEGE]
• Frozen installs (npm ci / --frozen-lockfile / cargo --locked) — [SWR-SEC-FROZEN-INSTALL]
• Build provenance (actions/attest-build-provenance) + CycloneDX SBOM per artifact — [SWR-SEC-PROVENANCE], [SWR-SEC-SBOM]
• One cosign-signed SHA256SUMS over all release assets (retire bare per-asset .sha256) — [SWR-SEC-CHECKSUM]
• Any downloader (Zed / Neovim / host) verifies checksum and signature before executing a fetched binary — [SWR-SEC-CHECKSUM]
• OIDC trusted publishing where supported; retire long-lived registry tokens — [SWR-SEC-OIDC-PUBLISH]

Tracked as a Shipwright deployment-contract conformity checklist (SWR-* IDs). Run the shipwright-compliance skill against this repo for the full per-channel audit. These are hardening items, not active exploits.

Start by running the shipwright-compliance skill against the repository, then inspect the release/IDE deployment channels, product shipwright.json, GitHub Actions workflows, and .github/dependabot.yml. Review the Zed, Neovim, and host download paths for the stated verification requirements. Done means every SWR checklist item is implemented and the full per-channel audit passes.