[davidiach]

Summary

• generate build/SHA256SUMS for llmos.img after CI image checks
• upload the checksum manifest alongside llmos.img
• download the uploaded artifact during successful workflow runs and verify the manifest against the downloaded payload

Why

The workflow uploaded the bootable image artifact without a payload-level checksum. Adding a manifest makes downloaded artifacts independently verifiable, and the in-workflow download/check verifies the uploaded artifact layout matches the manifest.

Review notes

• The manifest is generated from inside build/, so it records llmos.img rather than build/llmos.img; this matches the extracted artifact layout.
• Checksum generation keeps the existing failure-artifact behavior with success() || failure() and only runs when build/llmos.img exists.
• Download and verification use normal success gating so failed jobs do not produce noisy secondary artifact-check failures.

Validation

• git diff --check -- .github/workflows/build.yml
• wsl.exe -d Ubuntu make ci-check
• WSL checksum simulation: generate build/SHA256SUMS, verify it, copy llmos.img plus SHA256SUMS to a clean directory, and verify again with sha256sum -c

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[davidiach]

Self-review pass in progress.

Current checks:

• Manifest generation runs from inside build, so SHA256SUMS points at llmos.img, matching the artifact extraction directory.
• The upload still runs with success() || failure() to preserve diagnostic image uploads after late failures.
• Download and verification use normal success gating through the explicit steps.upload-image.outcome == 'success' expression, so unrelated failed checks do not cause noisy secondary artifact failures.

Local validation is green: git diff --check -- .github/workflows/build.yml, wsl.exe -d Ubuntu make ci-check, and a WSL checksum copy simulation.