Fix published index: restore signatures on retained connector versions, gate unsigned publishes

[maciejwitowski]

Problem

The 2026-07-13 05:13Z publish (first success since Jun 11, revived by #93) shipped a connector-index.json where 10 retained (superseded) connector versions have no artifactSignature. The installer hard-fails on missing Sigstore metadata, so every consumer install is broken: all unity-surfaces Vercel deploys and any fresh pnpm install die on

[resolve-connectors] ERROR: Connector artifact chatgpt-playwright@2.0.0 is missing Sigstore bundle metadata

(unity-surfaces pins 5 of the 10 affected versions; GH Actions only stay green because they set SKIP_CONNECTOR_FETCH=1.)

Root cause

Signatures are attached at publish time, and only along two paths: rebuilt current versions, and retained versions of a connector being bumped in that same publish (materializeRetainedArtifact). When a connector is not bumped, its retained versions are carried verbatim from the committed index — which never stores signatures. Today's publish took that path for all 10.

The bump-time materialization also hides a second landmine (very likely why the Jun 25/29 publish runs failed): retained tarballs aren't byte-reproducible, so the raw.githubusercontent copies no longer match the recorded artifactSha256. For github-playwright@1.2.0 the committed sha, the pinned raw bytes, and the signed June release bytes are three different values. Only the last published release assets are both signed and self-consistent.

Fix

• connector-index.json — point the 9 restorable retained entries back at the connectors-3f944c668395 release (artifactUrl, artifactSha256, releaseId, sourceCommit/sourceTag, artifactSignature); all those assets are live (HTTP 200) and their sha256s verify. Drop github-playwright@1.4.0: added while publishing was broken, never in any successful release, no signature bundle exists anywhere for it (same precedent as Fix publish: drop retained claude-export 1.0.0 #87's drop of retained claude-export 1.0.0). Nothing pins it.
• generate-connector-index.mjs — run retained versions through materializeRetainedArtifact on the preserved-current-version path too, making retention handling symmetric with the bump path (no-op in local/commit mode; inert for entries that already carry release URLs + signatures).
• Signature gate — assertConnectorIndexSigned (in connector-artifact-contract.mjs, called from the generator when CONNECTOR_ENABLE_SIGSTORE_METADATA=1): refuse to emit an index with unsigned entries. A future regression fails the publish loudly instead of shipping a broken index to every consumer.

Verification

• node --test contract tests: 18/18 (2 new for the signature gate)
• Local regeneration is byte-stable; --check + the full contract-guardrails battery pass locally
• Publish simulation (CONNECTOR_USE_RELEASE_ASSETS=1 + CONNECTOR_ENABLE_SIGSTORE_METADATA=1): 26/26 entries signed, all 52 artifact+bundle URLs return 200
• End-to-end: unity-surfaces' installer flow (loadConnectorIndex → generateLock → installFromLock) against the simulated published index resolves, downloads, and Sigstore-verifies all 13 pinned connectors

Notes / follow-ups

• Merging this re-triggers the publish workflow, which unblocks unity-surfaces deploys immediately.
• The rebuilt entries' releaseId comes out as github-<full-sha> (workflow sets release_id=github-${GITHUB_SHA}) while everything else uses connectors-<sha12> — intentional? Left untouched here.
• Longer-term, consider re-uploading retained artifacts (fetched from their pinned release, not rebuilt) into each new immutable release so every release is self-contained.

🤖 Generated with Claude Code

[github-actions]

Schema Health Check — Non-blocking inherited issues

44/50 scopes consistent | 6 inherited Gateway gap(s) | no new blocking issues in this PR