A tag tells you what Git points at. It does not prove which artifact was published. This skill applies the Release Manifest Specification to bind a release to its source, changelog, decisions, and artifact digests while saying plainly which remote artifacts were never fetched or verified.
Install for Codex
Download the complete skill package or copy and run:
mkdir -p "${CODEX_HOME:-$HOME/.codex}/skills"
curl -fsSL https://wimdy.works/skills/maintain-release-manifest/bundle.tar.gz \
| tar -xz -C "${CODEX_HOME:-$HOME/.codex}/skills"Install for Claude Code
mkdir -p "$HOME/.claude/skills"
curl -fsSL https://wimdy.works/skills/maintain-release-manifest/bundle.tar.gz \
| tar -xz -C "$HOME/.claude/skills"Invoke directly
$maintain-release-manifest verify the worker 1.18.3 release
/maintain-release-manifest verify the worker 1.18.3 releaseOr let ACK construct and validate a draft from pinned evidence:
ack release draft --source file=.ack/releases/worker-1.18.3.yaml