mweinbach7/6/2026, 2:53:28 PM

Desktop packaging now prefers hash-verified prebuilt helper downloads over
compiling crates/cowork-win-sandbox (cargo git deps + LTO dominate release
wall-clock time). A checked-in prebuilt.lock.json pins a win-sandbox-v* release
tag, a CRLF-normalized content fingerprint of the crate build inputs, and
sha256 hashes for each per-target zip and exe. Soft misses (no lock,
fingerprint drift, unavailable asset) fall back to the cargo build; a hash
mismatch with a matching fingerprint fails hard instead of masking a tampered
release asset. COWORK_WIN_SANDBOX_PREBUILT=0 and --force-windows-sandbox-build
skip prebuilt downloads entirely.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Parent78c82bc