[verification] HIGH: Witness signature verification fails — all platform manifests report every entry missing

Summary

Running the witness verification script (plugins/ruflo-core/scripts/witness/verify.mjs) against all three platform manifests (macOS, Linux, Windows) reports that every manifest entry is missing because the verification environment is a source-only checkout with no built dist/ artifacts.

Impact

Integrity verification of distributed artifacts is completely blocked. It is not possible to confirm that the published binaries match signed manifests in any automated verification run against a fresh clone. The check cannot pass until either a build step is added to the verification workflow or the script is updated to handle source-only environments gracefully.

Expected

Ed25519 signature valid: yes
pass=N
drift=0
regressed=0
missing=0

(for each of macos, linux, windows)

Actual

verify.mjs: every manifest entry is missing and the manifest references
dist/ artifacts. The checkout appears to be source-only (no build run).

Fix: from the repo root, run `npm ci && npm run build` (or the
equivalent for the workspaces witness markers reference) before
invoking this script. See #1880 for the full diagnosis.

Output was identical for verification/macos/manifest.md.json, verification/linux/manifest.md.json, and verification/windows/manifest.md.json.

Recommended Fix

One of:

1. Add npm ci && npm run build to the verification job before invoking verify.mjs
2. Update verify.mjs to emit missing=0 SKIP (non-fatal) when dist/ is absent and document that builds are required for full verification

The script itself references #1880 for full diagnosis.

Commit SHA

db4991967c45c6f72133dff0bb80b0a492960fc1

Timestamp UTC

2026-09-05T07:04:00Z