# PromptKit Bug Report: v0.2.0 Module Checksum Mismatch

**Status:** Reproduced by a consumer; cause not yet confirmed.

## Summary

PromptKit cannot add ReleaseKit v0.2.0 as its module-selected maintainer tool
with Go's normal checksum verification. The `go.mod` bytes served for the
version produce a checksum that differs from the checksum database's recorded
`go.mod` checksum. Go stops with a security error.

## PromptKit Context

PromptKit is adopting ReleaseKit v0.2.0 as a Go `tool` dependency, following the
release's documented module-tooling workflow. The version tag currently points
to commit
[`e030794969fb7787e647a90bbc4eb81bd0610f07`](https://gitea.maximumdirect.net/eric/ReleaseKit/commit/e030794969fb7787e647a90bbc4eb81bd0610f07).
The attempt used Go 1.26.8 with `GOTOOLCHAIN=local`.

## Reproduction

From a Go module, run:

```sh
GOTOOLCHAIN=local go mod download -json gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0
```

Go reports:

```text
verifying gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0/go.mod: checksum mismatch
	downloaded: h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=
	go.sum:     h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
```

The conflicting record is visible in the
[Go checksum database lookup](https://sum.golang.org/lookup/gitea.maximumdirect.net/eric/!release!kit@v0.2.0).
It records `h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE=` for the module's
`go.mod`. A diagnostic fetch with `GOSUMDB=off` reports the same v0.2.0 tag
commit above, archive checksum
`h1:EACELngRel4RiulR+Ors56nMZ5fA9orJDyhPxn6UVe4=`, and `go.mod` checksum
`h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=`. Disabling the checksum
database was used only to inspect the fetched source; it is not a proposed
consumer workaround.

## Expected Behavior

The published v0.2.0 module metadata and the checksum database record should
agree, so Go can verify and download the release normally.

## Consumer Impact

PromptKit's dependency preparation stops before it can reliably select
ReleaseKit v0.2.0 as a tool. Go's warning prevents proceeding with the normal
integrity check. This does not affect PromptKit's runtime API or behavior; the
tool dependency is for maintainer workflows.

## Investigation Requested

Please compare the `v0.2.0` tag's `go.mod`, the module proxy's `.mod` response,
and the checksum database record to determine why their checksums differ. The
available evidence confirms the mismatch but does not establish whether the
tagged metadata changed after checksum publication, the proxy is serving
different metadata, or the checksum record is otherwise inconsistent. Please
advise on a verified immutable version consumers can select once the cause is
known.