#!/bin/sh
set -eu

ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
node "$ROOT/scripts/verify-release-scope.mjs" --require-committed-candidate
# The verifier derives the six-program allowlist from the canonical manifest,
# owns both isolated builds, compares their bytes, and only then publishes.
node "$ROOT/scripts/verify-artifacts.mjs"
