feat(updater): add a monotonic research feed publisher

[TimeToBuildBob]

Research updates need a monotonic feed that stays separate from standard releases. This adds a manual publisher for research-updates/latest-research.json: it validates a supplied manifest against the public immutable research release, prepares a reviewable commit by default, and pushes only with --publish.

The publisher requires all five release targets and their public signatures, exact edition/version/release URLs, and valid updater metadata. It rejects rollback and conflicting equal-version content; identical replay is a no-op. Parent checks at fetch and Git's advertised-parent/receive stages reject racing creation, advancement, deletion, and rewind without force-pushing, while preserving existing push hooks.

This is independent of #1442 (no overlapping files). scripts/package/RESEARCH_FEED.md documents preparation, explicit publication, and retry behavior. Live feed provisioning, signing/payload verification, installed-client migration, and real upgrades remain release-owner gates. No automatic release trigger is added.

Validation: 61 publisher/generator tests passed on Python 3.9; Ruff, actionlint, and commit hooks passed. Tests use temporary Git remotes, including a race after parent advertisement and existing-hook refusal. Independent review findings around updater metadata and immutable releases were fixed and regression-tested. No live feed was published.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with the sole previous finding fully fixed and no new actionable issue introduced since the prior review.

Summary

• Validates manifest metadata, the complete platform matrix, immutable GitHub release assets, and public signatures.
• Creates a reviewable commit by default and publishes only when explicitly requested.
• Protects branch history against stale parents and concurrent updates while preserving existing pre-push hooks.
• Adds focused CI coverage and operational documentation.
• The latest revision fixes the previously reported malformed platforms handling by requiring an object before comparing keys, with a regression test for array input.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Load supplied manifest] --> B[Fetch immutable public release]
    B --> C[Validate metadata, targets, URLs, assets, and signatures]
    C --> D[Verify expected remote parent]
    D --> E{Existing feed?}
    E -- No --> F[Create orphan feed commit]
    E -- Yes --> G[Compare current and candidate SemVer]
    G --> H{Rollback or conflicting replay?}
    H -- Yes --> I[Refuse publication]
    H -- No --> J[Create commit on expected parent]
    F --> K{--publish supplied?}
    J --> K
    K -- No --> L[Leave reviewable local candidate]
    K -- Yes --> M[Check advertised parent and existing pre-push hook]
    M --> N[Normal non-force Git push]

Loading

[TimeToBuildBob]

@greptileai review

[TimeToBuildBob]

The malformed-platforms finding is fixed at 5a7370e with a regression test. Greptile's current-head review is 5/5, all CI checks pass, and the superseded review thread is resolved. This account has pull-only access here, so the remaining step is maintainer review/merge.

[ErikBjare]

@TimeToBuildBob Merged together with #1442

[TimeToBuildBob]

Thanks. Verified both landed: #1442 as 83381d4 and this publisher as 8a47169, with all checks green. The four #1443 files on master are byte-identical to the reviewed head.

I closed the publisher implementation task and handed the landed scripts/package/RESEARCH_FEED.md invocation to the updater umbrella. I did not provision or publish research-updates: that remains gated on the research-only updater keypair, existing-client containment, and the real signed-upgrade acceptance run.