{"record":{"id":"fb73708a3e83f16a","repo":"Yeachan-Heo/oh-my-codex","slug":"native-assets-cache-publication-verification-fai","errorCode":null,"errorMessage":"[native-assets] cache publication verification failed: ${final.state}","messagePattern":"\\[native-assets\\] cache publication verification failed: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/cli/native-assets.ts","lineNumber":658,"sourceCode":"    await revalidatePublicationPaths();\n    if (platform !== 'win32') await chmod(tempBinary, 0o755);\n    const binary = await readOpenedFile(tempBinary, true, true);\n    const sidecar = `${binary.digest}\\n`;\n    const handle = await open(tempSidecar, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);\n    try { await handle.writeFile(sidecar, 'utf8'); } finally { await handle.close(); }\n    if ((await readOpenedFile(tempSidecar, true, false, MAX_SIDECAR_BYTES)).text !== sidecar) throw new Error('[native-assets] temporary checksum verification failed');\n    await revalidatePublicationPaths();\n    await quarantineInvalid(destination);\n    await revalidatePublicationPaths();\n    await quarantineInvalid(sidecarPath(destination));\n    await revalidatePublicationPaths();\n    await rename(tempBinary, destination);\n    await revalidatePublicationPaths();\n    await rename(tempSidecar, sidecarPath(destination));\n    await revalidatePublicationPaths();\n    const final = await inspectManagedNativeBinary(destination, env);\n    await revalidatePublicationPaths();\n    if (final.state !== 'verified') throw new Error(`[native-assets] cache publication verification failed: ${final.state}`);\n    return final.path;\n  } catch (error) {\n    primaryError = error;\n    throw error;\n  } finally {\n    const cleanupFailures: string[] = [];\n    try { await revalidatePublicationPaths(); } catch (error) {\n      cleanupFailures.push(`revalidate publication paths: ${error instanceof Error ? error.message : String(error)}`);\n    }\n    for (const temporary of [tempBinary, tempSidecar]) {\n      try { await rm(temporary, { force: true }); } catch (error) {\n        cleanupFailures.push(`remove ${temporary}: ${error instanceof Error ? error.message : String(error)}`);\n      }\n    }\n    const lockCleanup = await releaseCacheLock(lock);\n    if (lockCleanup) cleanupFailures.push(`${lockCleanup.state}: publication lock was retained`);\n    if (cleanupFailures.length > 0) {\n      const evidence = `[native-assets] cleanup evidence: ${cleanupFailures.join('; ')}`;","sourceCodeStart":640,"sourceCodeEnd":676,"githubUrl":"https://github.com/Yeachan-Heo/oh-my-codex/blob/3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2/src/cli/native-assets.ts#L640-L676","documentation":"After atomically renaming the binary and sidecar into place, inspectManagedNativeBinary did not report state 'verified' for the published path. Publication is verified end-to-end (existence, digest match vs sidecar); any other state means the final artifact failed its own post-publication inspection.","triggerScenarios":"publishManagedNativeBinary when the post-rename inspection returns e.g. 'digest-mismatch', 'missing-sidecar', or 'stale' — caused by tampering, filesystem races, or an external process deleting/altering files immediately after publication.","commonSituations":"Concurrent cache pruning by another process; antivirus quarantining freshly written executables; multi-process installs racing on the same destination.","solutions":["Stop concurrent cache writers/pruners, clear the specific cache entry, retry once.","Add cache directory exclusions to antivirus/sync tooling.","Serialize installs or pre-hydrate caches to avoid post-publication races."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await hydrateNativeBinary(); } catch (e) { if (/cache publication verification failed/.test(String(e))) { /* stop other cache writers, clear entry, retry once */ } throw e; }","preventionTips":["Serialize cache writes across processes","Exclude published binaries from antivirus quarantine","Pre-hydrate caches to eliminate runtime publication"],"tags":["native-assets","cache","verification","race-condition"],"backgroundTag":"file-corruption","analyzedSha":"3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2","analyzedAt":"2026-08-27T22:18:39.783Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}