From c339872bfe202315983777f2e576d4e2f7355f14 Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Thu, 8 Oct 2026 14:15:00 +0000
Subject: [PATCH] Report PromptKit's v0.2.0 checksum mismatch

---
 docs/roadmap/promptkit-bug-report.md | 69 ++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 docs/roadmap/promptkit-bug-report.md

diff --git a/docs/roadmap/promptkit-bug-report.md b/docs/roadmap/promptkit-bug-report.md
new file mode 100644
index 0000000..93b6541
--- /dev/null
+++ b/docs/roadmap/promptkit-bug-report.md
@@ -0,0 +1,69 @@
+# PromptKit Bug Report: v0.2.0 Module Checksum Mismatch
+
+**Status:** Reproduced by a consumer; cause not yet confirmed.
+
+## Summary
+
+PromptKit cannot add ReleaseKit v0.2.0 as its module-selected maintainer tool
+with Go's normal checksum verification. The `go.mod` bytes served for the
+version produce a checksum that differs from the checksum database's recorded
+`go.mod` checksum. Go stops with a security error.
+
+## PromptKit Context
+
+PromptKit is adopting ReleaseKit v0.2.0 as a Go `tool` dependency, following the
+release's documented module-tooling workflow. The version tag currently points
+to commit
+[`e030794969fb7787e647a90bbc4eb81bd0610f07`](https://gitea.maximumdirect.net/eric/ReleaseKit/commit/e030794969fb7787e647a90bbc4eb81bd0610f07).
+The attempt used Go 1.26.8 with `GOTOOLCHAIN=local`.
+
+## Reproduction
+
+From a Go module, run:
+
+```sh
+GOTOOLCHAIN=local go mod download -json gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0
+```
+
+Go reports:
+
+```text
+verifying gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0/go.mod: checksum mismatch
+	downloaded: h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=
+	go.sum:     h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE=
+
+SECURITY ERROR
+This download does NOT match an earlier download recorded in go.sum.
+```
+
+The conflicting record is visible in the
+[Go checksum database lookup](https://sum.golang.org/lookup/gitea.maximumdirect.net/eric/!release!kit@v0.2.0).
+It records `h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE=` for the module's
+`go.mod`. A diagnostic fetch with `GOSUMDB=off` reports the same v0.2.0 tag
+commit above, archive checksum
+`h1:EACELngRel4RiulR+Ors56nMZ5fA9orJDyhPxn6UVe4=`, and `go.mod` checksum
+`h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=`. Disabling the checksum
+database was used only to inspect the fetched source; it is not a proposed
+consumer workaround.
+
+## Expected Behavior
+
+The published v0.2.0 module metadata and the checksum database record should
+agree, so Go can verify and download the release normally.
+
+## Consumer Impact
+
+PromptKit's dependency preparation stops before it can reliably select
+ReleaseKit v0.2.0 as a tool. Go's warning prevents proceeding with the normal
+integrity check. This does not affect PromptKit's runtime API or behavior; the
+tool dependency is for maintainer workflows.
+
+## Investigation Requested
+
+Please compare the `v0.2.0` tag's `go.mod`, the module proxy's `.mod` response,
+and the checksum database record to determine why their checksums differ. The
+available evidence confirms the mismatch but does not establish whether the
+tagged metadata changed after checksum publication, the proxy is serving
+different metadata, or the checksum record is otherwise inconsistent. Please
+advise on a verified immutable version consumers can select once the cause is
+known.