[EHotwagner]

Refs #423. This links the issue without closing it. It supports the post-publication acceptance of Governance 1.15.0: condition 4 of the GO comment calls for a cold install from both feeds and a byte comparison, signature excepted.

Why

The session's token cannot read the org GitHub Packages feed; it gets 403 on both the download and the packages API. The standing rule is no new credentials. The publish run (39928935417) uploaded no package artifacts, so the org-feed bytes can only be read with a workflow's own run-scoped token. The only existing readback is the Config-only recovery route inside publish.yml, which is the publishing workflow and ties readback to artifact recovery, so it was not reused.

Change

Adds one new file, .github/workflows/feed-readback.yml.

• Trigger: workflow_dispatch only, with a single input: an exact SemVer version, validated.
• Permissions: contents: read, packages: read. Nothing is checked out and nothing is built.
• What it does:
  • Downloads FS.GG.Governance.Cli and FS.GG.Governance.FSharpSurfaceCommand at the selected version from https://nuget.pkg.github.com/FS-GG, using the run's GITHUB_TOKEN.
  • Downloads the same two packages from the nuget.org flat container.
  • Prints the whole-archive SHA-256 of each download.
  • Compares every zip entry by name and by bytes. The only exception is nuget.org's .signature.p7s.
  • Duplicate entry names fail the comparison.
  • Each archive's nuspec repository commit is recorded; for 1.15.0 it is expected to be 282741b1.
  • Writes the result to the step summary and uploads readback.json and sha256sums.txt as a 30-day artifact.
• Failure conditions: the job fails if either feed does not serve a package, or if any entry is missing, extra or different.
• What it never does: push, tag, release, or change any package or repository state.

Planned use

After merge, dispatch once with version=1.15.0, as admitted by the coordinator. The result goes on #423 as acceptance evidence.

Review

An independent fsgg-critic-best review accepted 68d7bbbe with only low-severity findings. This head applies two of them: duplicate-name refusal and the nuspec commit record.

Checks

• YAML parses.
• bash -n passes on the step script.
• No reusable or composite action is added. actions/upload-artifact@v7 follows the repository's existing usage.

architecture-map: unaffected

🤖 Generated with Claude Code

[EHotwagner]

fdev: relaying the independent fsgg-critic-best (opus) review of PR #473.

Head 68d7bbb: ACCEPT, with only low-severity findings. The reviewer ran the extracted step against the real 1.14.0 packages, with the org copy simulated:

• identical copies pass;
• a mutated entry, an extra entry, a missing entry, an HTML body, 403 or network failure, and a Cli-only 404 all fail;
• a duplicate-name entry hiding a change passed (finding 1).

Head 45da5eb: ACCEPT. This head applies findings 1 and 4:

• duplicate entry names now fail;
• each archive's nuspec repository commit is recorded.

The fixture matrix was re-run: the duplicate case now fails, and the 1.14.0 commit f97de157 is extracted.

Still open:

• Commit check for the 1.15.0 run. The recorded nuspec commit is not compared against 282741b1 automatically. The 1.15.0 run is accepted only if its record shows 282741b1.
• Low-severity notes and nits:
  • .signature.p7s is excluded by name only;
  • a failed download is recorded only in the log;
  • contents: read is unused;
  • the token is passed as a curl argument.

CI: 15/15 checks pass on 45da5eb5.