feat(cactus): SHA-256 integrity verification for fetched model assets#530

Merged

sroussey merged 16 commits into

mainfrom

claude/sweet-edison-NSph2-cactus-integrity

May 22, 2026

Commits on May 22, 2026

feat(cactus): add SHA-256 integrity helper for fetched assets
sroussey
committed
feat(cactus): extend catalog asset spec with sha256 + size
sroussey
committed
feat(cactus): verify SHA-256 in fetchAssetBytes (Node)
sroussey
committed
feat(cactus): verify SHA-256 in fetchAssetBytes (browser)
sroussey
committed
feat(cactus): propagate integrity error message in Download (Node)
sroussey
committed
feat(cactus): propagate integrity error message in Download (browser)
sroussey
committed
test(cactus): integrity helper tests
sroussey
committed
fix(cactus): use path.relative for containment check (root-safe + CodeQL-canonical)
sroussey
committed
fix(cactus): apply spec.size pre-check on Node disk-read cache-hit path
sroussey
committed
fix(cactus): apply spec.size pre-check on browser Cache Storage hit path
sroussey
committed
fix(cactus): reserve filename length for .tmp suffix in atomic write
sroussey
committed
fix(cactus): mirror tightened filename length cap in browser variant
sroussey
committed
test(cactus): move integrity test to packages/test/ for CI discovery
sroussey
committed
test(cactus): add integrity test under packages/test/ for CI discovery
sroussey
committed
test(cactus): expose Cactus_Integrity helpers via _testOnly
sroussey
committed
test(cactus): expose Cactus_Integrity helpers via _testOnly (browser)
sroussey
committed