Provenance now verifies against the published manifest (
f581a13)
The provenance check was corrected to compare subject.digest.sha256 against the SHA-256 of the stored <version>_meta.json manifest, not the uploaded tarball. This matches what the Deno CLI actually attests and closes a verification bug that could reject valid attestations or validate the wrong bytes.
Production Cloud SQL is moved to a smaller zonal tier (e35772e)
The main PostgreSQL instance drops from db-custom-4-8192 to db-custom-2-6144 and is forced to ZONAL rather than regional HA. That lowers capacity and removes automatic failover, so it’s an operational tradeoff with availability implications.
Other misc changes
- Provenance-related DB/query cleanup and test fixture updates (1 commit)
- Terraform config tweak in
terraform/db.tf