fix(packaging): bump PKGBUILD to 1.21.18; checklist asset count

[AlexMikhalev]

Post-release follow-up for v1.21.18. Turns main CI green again.

Changes

1. fix(packaging): terraphim-clients-bin PKGBUILD → 1.21.18
   • pkgver=1.21.18.
   • The four musl source digests (agent and grep, x86_64 and aarch64) come from the published v1.21.18 SHA256SUMS, which is byte-identical (cmp) to the sealed stage SHA256SUMS reviewed before promotion.
   • .SRCINFO and the contract-test pins (tests/test_pkgbuild_release_contract.py) move with it.
   • Fixes test_pkgbase_identity_and_version, which has been red on main since before v1.21.17. The test's own comment describes exactly this sequence: fail during the release window, then a follow-up bump once the assets exist.
2. docs(release): checklist expects 17 archives. It said 20 (7/7/6), which predates the Windows removal in fix(manifest): drop Windows zip from required target set (#348) #50/fix(promotion): drop Windows zip from promotion/acceptance target sets (#348) #51. v1.21.17 and v1.21.18 both shipped 17.

Verification

• python3 -m unittest test_pkgbuild_release_contract: OK (1 skipped: the .SRCINFO regeneration check needs makepkg).
• python3 -m unittest test_release_binaries_workflow_contract: OK.
• Full pkgbuilds/terraphim-clients-bin/verify.sh in archlinux:base-devel (linux/amd64), on a copy of the package directory, exits 0:
  • .SRCINFO drift check passes against makepkg --printsrcinfo;
  • the x86_64 sources downloaded from the v1.21.18 release validate against the new sha256sums (Passed);
  • namcap is clean and split ownership is correct;
  • pacman -U installs both packages, pacman -Qkk reports 0 altered files, the installed binaries report 1.21.18, and the package-manager receipt check passes;
  • pacman -R removes both cleanly.

The aarch64 digests are verified by the SHA256SUMS comparison, not by an aarch64 Arch build.

🤖 Generated with Claude Code

[AlexMikhalev]

Pre-merge review of record: pi-rust (openai-codex/gpt-5.5, structural-pr-review skill, read-only tools) on head c660c16.

Structural pre-merge review: PR #53, head c660c16

Scope reviewed strictly against github/main...HEAD for:

• pkgbuilds/terraphim-clients-bin/PKGBUILD
• pkgbuilds/terraphim-clients-bin/.SRCINFO
• tests/test_pkgbuild_release_contract.py
• docs/release-operator-checklist.md

No files modified. No cargo commands run.

Findings

P0

None.

P1

None.

P2

None.

Digest verification

Verified independently by downloading the published release checksum asset:

gh release download v1.21.18 -R terraphim/terraphim-clients -p SHA256SUMS -D /tmp/pkgbuild-review --clobber

All four MUSL archive digests agree across the published SHA256SUMS, PKGBUILD, .SRCINFO, and test pins:

Asset	Published digest	PKGBUILD	.SRCINFO	Test pin	Result
terraphim-agent-1.21.18-x86_64-unknown-linux-musl.tar.gz	767ee6cdaa375f838cf69607a7346cb89195480dbfccc45ecefde7820a89ad4c	pkgbuilds/terraphim-clients-bin/PKGBUILD:48	pkgbuilds/terraphim-clients-bin/.SRCINFO:14	tests/test_pkgbuild_release_contract.py:44	Pass
terraphim-grep-1.21.18-x86_64-unknown-linux-musl.tar.gz	8e463f780e3683e909613a4dd01fb47da36e5736a6a51ea62f36a3ce235b7167	pkgbuilds/terraphim-clients-bin/PKGBUILD:49	pkgbuilds/terraphim-clients-bin/.SRCINFO:15	tests/test_pkgbuild_release_contract.py:48	Pass
terraphim-agent-1.21.18-aarch64-unknown-linux-musl.tar.gz	1f4265ad8756378d101d35dc21d0362460cb858d9be99aa7486aafe83e8caa0f	pkgbuilds/terraphim-clients-bin/PKGBUILD:52	pkgbuilds/terraphim-clients-bin/.SRCINFO:18	tests/test_pkgbuild_release_contract.py:54	Pass
terraphim-grep-1.21.18-aarch64-unknown-linux-musl.tar.gz	1b02796312162b59cd0165aa302aa683e8f57b00c72f283ab0bd15d569d3b395	pkgbuilds/terraphim-clients-bin/PKGBUILD:53	pkgbuilds/terraphim-clients-bin/.SRCINFO:19	tests/test_pkgbuild_release_contract.py:58	Pass

Arch-to-asset mapping is correct:

• source_x86_64 maps to the two x86_64-unknown-linux-musl archives: PKGBUILD:35-38, .SRCINFO:12-15.
• source_aarch64 maps to the two aarch64-unknown-linux-musl archives: PKGBUILD:39-42, .SRCINFO:16-19.

.SRCINFO consistency

.SRCINFO matches the changed PKGBUILD values for the reviewed fields:

• pkgver = 1.21.18: PKGBUILD:21, .SRCINFO:3
• pkgrel = 1: PKGBUILD:22, .SRCINFO:4
• arch, license, options: PKGBUILD:24-27, .SRCINFO:6-11
• source URLs and digests for both supported architectures: PKGBUILD:35-53, .SRCINFO:12-19
• split package metadata remains aligned: PKGBUILD:61-87, .SRCINFO:21-31

Release asset count check

Checked:

gh release view v1.21.18 -R terraphim/terraphim-clients --json assets

The release has 17 archive assets plus SHA256SUMS, matching the checklist update at docs/release-operator-checklist.md:36-38:

• terraphim-agent: 6 archives
• terraphim-grep: 6 archives
• terraphim-cli: 5 archives
• Windows zip targets are absent, consistent with the checklist note.

Test evidence

Ran the permitted test command:

python3 -m unittest tests/test_pkgbuild_release_contract.py

Result:

Ran 7 tests in 0.002s

OK (skipped=1)

The skip is the existing makepkg-dependent .SRCINFO drift assertion path when makepkg is unavailable.

Mermaid verification flow

flowchart TD
    A["GitHub release v1.21.18"] --> B["SHA256SUMS"]
    A --> C["Release assets JSON"]

    B --> D["Four MUSL archive digests"]
    D --> E["PKGBUILD sha256sums"]
    D --> F[".SRCINFO sha256sums"]
    D --> G["test_pkgbuild_release_contract.py ASSETS"]

    E --> H["All digest pins agree"]
    F --> H
    G --> H

    C --> I["17 archive assets"]
    I --> J["6 agent, 6 grep, 5 cli"]
    J --> K["Checklist matches release shape"]

    H --> L["No blocking findings"]
    K --> L

Loading

Per-file overview

• pkgbuilds/terraphim-clients-bin/PKGBUILD

  • Correctly bumps pkgver from 1.21.16 to 1.21.18.
  • Correctly updates the four MUSL SHA-256 digests from the published v1.21.18 SHA256SUMS.
  • Source ordering and digest ordering are consistent for agent then grep on both architectures.

• pkgbuilds/terraphim-clients-bin/.SRCINFO

  • Consistent with the reviewed PKGBUILD fields.
  • URLs, version, and checksums match the corresponding PKGBUILD arrays.

• tests/test_pkgbuild_release_contract.py

  • PKGVER and all four pinned digest values match PKGBUILD, .SRCINFO, and the published release checksum asset.
  • Unit test run passed.

• docs/release-operator-checklist.md

  • Checklist now states 17 archives: 6 agent, 6 grep, 5 cli.
  • This matches the v1.21.18 release asset inventory returned by GitHub.

Confidence: 5/5.

---

Author verification: no findings to dispute. The reviewer independently re-downloaded the published SHA256SUMS and matched all four digests across PKGBUILD, .SRCINFO and the test pins.