mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-14 14:43:16 -06:00
8d66e47773
Codex review: version existence alone does not prove the npm registry serves the tarball this tag's preflight built — the same version could have been published from a different artifact and npm versions are immutable. The resume resolver now downloads the preflight manifest, requires its releaseSha to match the target, and compares the published registry tarball's sha256 against the manifest before skipping the core dispatch; mismatches abort with correction-tag guidance.