Enforce canonical hosted release origin

.github/workflows/ci.yml

@@ -26,12 +26,12 @@ jobs:
           - ubuntu-24.04
     steps:
       - name: Check out source
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Install Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
 

.github/workflows/release.yml

@@ -20,12 +20,12 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Check out the tagged source
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Install Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
 
@@ -89,7 +89,7 @@ jobs:
           "$BUN_INSTALL/bin/hra" doctor --offline --json | bun -e 'const value = JSON.parse(await Bun.stdin.text()); if (value?.ok !== true || value?.data?.offline !== true) throw new Error("offline doctor failed");'
 
       - name: Generate the artifact identity SPDX SBOM
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         env:
           SYFT_SOURCE_NAME: hra
           SYFT_SOURCE_VERSION: ${{ env.HRA_RELEASE_VERSION }}
@@ -113,7 +113,7 @@ jobs:
           if (!exact.checksums.some((entry) => entry && typeof entry === "object" && entry.algorithm === "SHA256" && entry.checksumValue === expected)) throw new Error("artifact SPDX checksum does not bind the tarball");'
 
       - name: Generate the Ubuntu 24.04 x64 runtime SPDX SBOM
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         env:
           SYFT_SOURCE_NAME: hra-ubuntu-24.04-x64-runtime
           SYFT_SOURCE_VERSION: ${{ env.HRA_RELEASE_VERSION }}
@@ -149,7 +149,7 @@ jobs:
           git rev-parse 'HEAD^{commit}' > release/RELEASE_COMMIT
 
       - name: Preserve verified release artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: hra-release-${{ github.ref_name }}
           path: |
@@ -171,7 +171,7 @@ jobs:
       contents: write
     steps:
       - name: Download verified release artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: hra-release-${{ github.ref_name }}
           path: release

docs/beta-release.md

@@ -1,6 +1,6 @@
 # Beta release
 
-The `v0.1.0` release has one explicit irreversible step. GitHub Actions verifies the exact current `main` commit, builds and accepts the tarball, generates both SPDX records, creates or resumes one draft release, replaces its four assets with the accepted bytes, reads every asset back, and stops. The built-in Actions token never publishes the draft because it cannot read the repository's immutable-release setting.
+The `v0.1.0` release has two explicit irreversible steps. Pushing the protected `v0.1.0` tag is the version-identity commit point because repository rules provide no supported update or deletion rollback. Undrafting the accepted release then makes its metadata and assets immutable. GitHub Actions verifies the exact current `main` commit, builds and accepts the tarball, generates both SPDX records, creates or resumes one draft release, replaces its four assets with the accepted bytes, reads every asset back, and stops. The built-in Actions token never publishes the draft because it cannot read the repository's immutable-release setting.
 
 Publish only from a clean checkout of the accepted commit with an authenticated GitHub CLI session that can read repository administration settings. Do not copy a broad personal token into Actions.
 
@@ -26,9 +26,9 @@ bun run release:publish -- publish \
 
 Before publication, the operator downloads the exact one-day Actions artifact; validates its exact file set, checksums, artifact-identity SPDX record, Ubuntu 24.04 x64 runtime SPDX inventory, package tree, and isolated install; compares every draft asset and all release metadata; requires the REST release record to be `draft: true` and `immutable: false`; re-resolves the fully qualified tag and `heads/main`; reads immutable-release enforcement with the local admin session; and requires a direct nonredirecting HTTP 200 from the canonical `hra.sh` generation-1 marker at `N_COMMIT`.
 
-Undrafting is the commit point. The operator PATCHes the numeric release ID whose metadata and assets it just accepted; it never resolves the tag again for the mutation. It then requires that same REST release record to be `draft: false` and `immutable: true`, with unchanged metadata and bytes, anonymously downloads and digest-verifies the public tarball, and performs the exact-URL install, version check, production-tree policy, and offline doctor in isolated state.
+Undrafting is the publication commit point; the protected tag push is the earlier version-identity commit point. The operator PATCHes the numeric release ID whose metadata and assets it just accepted; it never resolves the tag again for the mutation. It then requires that same REST release record to be `draft: false` and `immutable: true`, with unchanged metadata and bytes, anonymously downloads and digest-verifies the public tarball, and performs the exact-URL install, version check, production-tree policy, and offline doctor in isolated state.
 
-Success prints one bounded JSON value with status `published`. A refusal before the commit point reports phase `before_publication` and leaves the draft reversible. An ambiguous undraft reports `publication_unknown`; inspect the exact release before doing anything else.
+Success prints one bounded JSON value with status `published`. A refusal in phase `before_publication` proves only that this invocation did not send the undraft PATCH. Read the exact numeric release and its current draft and immutable fields before any cleanup; another actor or a prior interrupted invocation may already have crossed the publication commit point. An ambiguous undraft reports `publication_unknown`; inspect the exact release before doing anything else.
 
 ## Acceptance recovery
 
@@ -43,6 +43,6 @@ bun run release:publish -- accept \
   --gh-cli /opt/homebrew/bin/gh
 ```
 
-The Actions artifact is retained for one day. Publish or complete acceptance while it remains available. If it expires before the commit point, rerun the exact tag workflow, record the new exact run attempt, and repeat the checks.
+The Actions artifact is retained for one day. Publish or complete acceptance while it remains available. If it expires before the publication commit point, rerun the exact tag workflow, record the new exact run attempt, and repeat the checks.
 
 The staging workflow safely resumes one exact draft and replaces the four expected assets with accepted bytes. If the draft has wrong metadata or unexpected extra assets, first read its numeric ID, tag, draft state, and asset list through the GitHub API. Delete only that confirmed unpublished `v0.1.0` draft, leave the tag untouched, rerun the tag workflow, and use its new exact run attempt. Never use this cleanup path after publication.

docs/hosted-sync.md

@@ -33,10 +33,10 @@ The provider identity guard pins the intended Convex team to numeric ID `513923`
 `bun run hosted:configure` accepts one strict JSON object with exactly these fields:
 
 ```json
-{"authEmailFrom":"HRA Auth <auth@example.com>","resendApiKey":"<secret>","siteUrl":"https://example.com"}
+{"authEmailFrom":"HRA Auth <auth@example.com>","resendApiKey":"<secret>","siteUrl":"https://hra.sh"}
 ```
 
-`siteUrl` must be one HTTPS origin. `resendApiKey` must be a Resend key. `authEmailFrom` must be the verified sender accepted by Resend. The helper generates a fresh 2048-bit RS256 private key, its matching public JWKS, and a 256-bit HMAC secret locally with WebCrypto.
+`siteUrl` must be one HTTPS origin. For the HRA `v0.1.0` authority it is exactly `https://hra.sh`, the final canonical origin. Do not substitute `https://try-hra.vercel.app` or an automatic deployment hostname: configuration is one-shot, while staging aliases move and rehearsal may replace candidate deployments. `resendApiKey` must be a Resend key. `authEmailFrom` must be the verified sender accepted by Resend. The helper generates a fresh 2048-bit RS256 private key, its matching public JWKS, and a 256-bit HMAC secret locally with WebCrypto.
 
 Pass the JSON from a protected secret source through standard input: