{"version":"2.1.238","anchor":"artifact-publish-pins-the-source-file-by-content-hash","canonical_anchor":"artifact-publish-pins-the-source-file-by-content-hash","heading":"Artifact publish pins the source file by content hash","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/artifact-publish-pins-the-source-file-by-content-hash","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Artifact publish pins the source file by content hash\n\nApproving an artifact publish pins the exact file contents, so changed files are refused.\n\n**What**\n\nWhen you approve an artifact publish, the approval now records the file's SHA-256, the resolved publish root and a one-time nonce. If the file changed, the nonce no longer matches, or the publish root moved between approval and execution, the publish is refused rather than going ahead with different content.\n\n**Details**\n\n- The pin also carries the root spelling and base, and publish records which tool call it consumed.\n- Refusals report `source_unverified`.\n- Telemetry adds `artifact_publish_resume` with a `carried` flag.\n- Reachable on any publish that has a tool call id.\n\n**Evidence**\n\n`\"source_unverified\"`\n\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}