Verify marketplace candidates against the exact release commit #251

🤖 Generated by the Agentic Engineer

Problem

Marketplace preparation produces review artifacts, but there is no executable check binding those artifacts to the exact release commit. A stale, edited, or incomplete candidate could be used after source movement, or a release commit could include changes beyond the proposed marketplace versions.

Proposed direction

Add an opt-in offline verifier that regenerates a candidate from immutable source history, compares its entire artifact set, and verifies the release commit contains precisely the proposed manifests and no unrelated tree changes. Initial publication may use its unchanged source commit. A subsequent release must be a direct, single-parent manifest-only commit. Return a machine-readable assessment that explicitly grants no publication authority.

Acceptance criteria

• Reject tampered plans, notes, manifests, extra files, symlinks, no-release plans, and missing artifacts.
• Reject wrong or stale parentage, unrelated content or mode changes, wrong manifest versions, and invalid commit identifiers.
• Read committed objects only, preserve the working tree and refs, and retain the preparation tool's offline/history guarantees.
• Exercise initial and incremental release commits with real Git histories, deterministic output, and failure cases in CI.
• Document the manual review flow and separate remote freshness, CI, review, tag reservation, publication, and consumer verification gates.

Size: M. Part of #101. Publication remains a separate increment.