Shipwright deployment-contract hardening checklist

Bring the release/IDE deployment into full conformity with the Shipwright contract.

Version / resolution

• VSIX startup calls ensureBinaries (currently defined but not invoked on activation) — [SWR-VSIX-VERIFY]
• Resolution enforces the expected version (a mismatch stops startup with a precise error) — [SWR-VERSION-MATCHING], [SWR-IDE-ERROR]
• Zed extension adds LSP-initialize version enforcement — [SWR-COMPAT]

Supply-chain hardening (shared controls)

• SHA-pin every GitHub Actions uses: to a 40-char commit (no @v4/@stable); add .github/dependabot.yml to keep pins fresh — [SWR-SEC-ACTION-PINNING]
• Top-level permissions: contents: read; grant write / id-token / attestations per-job only — [SWR-SEC-TOKEN-PRIVILEGE]
• Frozen installs (npm ci / --frozen-lockfile / cargo --locked) — [SWR-SEC-FROZEN-INSTALL]
• Build provenance (actions/attest-build-provenance) + CycloneDX SBOM per artifact — [SWR-SEC-PROVENANCE], [SWR-SEC-SBOM]
• One cosign-signed SHA256SUMS over all release assets (retire bare per-asset .sha256) — [SWR-SEC-CHECKSUM]
• Any downloader (Zed / Neovim / host) verifies checksum and signature before executing a fetched binary — [SWR-SEC-CHECKSUM]
• OIDC trusted publishing where supported; retire long-lived registry tokens — [SWR-SEC-OIDC-PUBLISH]

Tracked as a Shipwright deployment-contract conformity checklist (SWR-* IDs). Run the shipwright-compliance skill against this repo for the full per-channel audit. These are hardening items, not active exploits.

Run the shipwright-compliance skill first for the per-channel audit. Inspect VSIX activation and the ensureBinaries entry point, Zed LSP initialization, all GitHub Actions workflows, and add .github/dependabot.yml as specified. Done means every checklist item is satisfied, including version enforcement, pinned and least-privilege workflows, provenance and SBOMs, signed checksums, verified downloads, and OIDC publishing.