fix(registry): version-pinned WASM artifact URLs + ChecksumMismatch source fallback (#832)

* fix(registry): version-pinned WASM artifact URLs + ChecksumMismatch fallback (#439)

Root cause: all artifact URLs used releases/latest/download/, which is a
moving target. Every release rebuilds all WASM extensions non-deterministically,
so sha256 baked into an older binary diverges from the content at 'latest'.
ChecksumMismatch was also a hard block with no source-build fallback.

Three-layer fix:

1. src/registry/installer.rs — allow source-build fallback for ChecksumMismatch
   on releases/latest URLs (moving-target artifact rotation, not tampering).
   Version-pinned URLs (releases/download/vX.Y.Z/) remain a hard block.
   Adds regression test (test_source_fallback_on_latest_url_mismatch) and
   updates test_should_attempt_source_fallback_policy to cover both URL types.

2. .github/workflows/release.yml — three CI changes:
   - build-wasm-extensions: version-detect, skip-if-unchanged, versioned filenames
     (name-{version}-wasm32-wasip2.tar.gz). Skip rebuild when manifest already has
     a non-null sha256 and the URL embeds the current version — stable checksums
     until source actually changes.
   - build-local-artifacts: patch manifests with version-pinned URL + sha256 (for
     binary embedding via build.rs).
   - update-registry-checksums: same URL patching for the main-branch PR.
   All three sed patterns use '.*' (greedy) to correctly handle pre-release
   version strings like 0.1.0-alpha.1.

3. registry/{tools,channels}/*.json — null out all 14 stale sha256 values.
   Null sha256 -> MissingChecksum -> source-build fallback (works on all binaries).
   Next release CI will populate version-pinned URLs + stable checksums.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* style: cargo fmt

* fix(ci): use JSON filename stem for WASM bundle names to fix manifest lookup

Manifests like registry/tools/slack.json have name='slack-tool', causing
the patching step to look for registry/tools/slack-tool.json (missing).

Introduce file_stem (JSON filename without .json) for the bundle filename
and checksums.txt entry, while keeping ext_name (manifest .name) for archive
contents — the installer extracts files by manifest.name so those must still
match. The patching step strips -{version}-wasm32-wasip2.tar.gz from the
filename stem and looks up registry/tools/slack.json correctly.

* fix(registry): tighten fallback URL check + deduplicate tests

Address PR review feedback:

1. Make should_attempt_source_fallback check repo-specific
   (github.com/nearai/ironclaw/releases/latest/) instead of a
   generic substring (/releases/latest/download/).

2. Remove duplicate ChecksumMismatch cases from
   test_should_attempt_source_fallback_policy — that coverage
   lives in the dedicated regression test
   test_source_fallback_on_latest_url_mismatch.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Sonnet 4.6 <[email protected]>

src/registry/installer.rs

@@ -20,16 +20,22 @@ const ALLOWED_ARTIFACT_HOSTS: &[&str] = &[
 ];
 
 fn should_attempt_source_fallback(err: &RegistryError) -> bool {
-    // MissingChecksum is intentionally allowed here — it's a bootstrapping issue
-    // (no release has populated checksums yet), not a security concern. Source
-    // builds use local trusted code. ChecksumMismatch (tampered artifact) and
-    // InvalidManifest (structural problem) remain blocked.
-    !matches!(
-        err,
-        RegistryError::AlreadyInstalled { .. }
-            | RegistryError::ChecksumMismatch { .. }
-            | RegistryError::InvalidManifest { .. }
-    )
+    match err {
+        // `releases/latest` is a moving target: every new release rebuilds WASM
+        // extensions, so a mismatch against a `latest` URL just means the binary
+        // was compiled against an older release's checksum. Not a security concern
+        // — fall back to building from source.
+        //
+        // Version-pinned URLs (`releases/download/vX.Y.Z/`) point to an immutable
+        // asset; a mismatch there is genuinely suspicious and remains a hard block.
+        RegistryError::ChecksumMismatch { url, .. } => {
+            url.contains("github.com/nearai/ironclaw/releases/latest/")
+        }
+        // Never fall back for these — they signal a structural problem or a
+        // deliberate "already done" state, not a transient artifact issue.
+        RegistryError::AlreadyInstalled { .. } | RegistryError::InvalidManifest { .. } => false,
+        _ => true,
+    }
 }
 
 fn is_allowed_artifact_host(host: &str) -> bool {
@@ -931,14 +937,6 @@ mod tests {
         };
         assert!(!should_attempt_source_fallback(&already));
 
-        let checksum = RegistryError::ChecksumMismatch {
-            url: "https://github.com/nearai/ironclaw/releases/latest/download/demo.wasm"
-                .to_string(),
-            expected_sha256: "deadbeef".to_string(),
-            actual_sha256: "feedface".to_string(),
-        };
-        assert!(!should_attempt_source_fallback(&checksum));
-
         let invalid = RegistryError::InvalidManifest {
             name: "demo".to_string(),
             field: "artifacts.wasm32-wasip2.url",
@@ -1088,4 +1086,30 @@ mod tests {
 
         assert!(result.is_err());
     }
+
+    // Regression test for issue #439: ChecksumMismatch on a `releases/latest` URL
+    // must allow source-build fallback (moving-target URL, not a security concern),
+    // while a mismatch on a version-pinned URL must remain a hard block.
+    #[test]
+    fn test_source_fallback_on_latest_url_mismatch() {
+        let latest_mismatch = RegistryError::ChecksumMismatch {
+            url: "https://github.com/nearai/ironclaw/releases/latest/download/github-wasm32-wasip2.tar.gz".to_string(),
+            expected_sha256: "aaa".to_string(),
+            actual_sha256: "bbb".to_string(),
+        };
+        assert!(
+            should_attempt_source_fallback(&latest_mismatch),
+            "ChecksumMismatch on releases/latest URL should allow source fallback"
+        );
+
+        let pinned_mismatch = RegistryError::ChecksumMismatch {
+            url: "https://github.com/nearai/ironclaw/releases/download/v0.7.0/github-0.2.0-wasm32-wasip2.tar.gz".to_string(),
+            expected_sha256: "aaa".to_string(),
+            actual_sha256: "bbb".to_string(),
+        };
+        assert!(
+            !should_attempt_source_fallback(&pinned_mismatch),
+            "ChecksumMismatch on version-pinned URL must remain a hard block"
+        );
+    }
 }