v2.7.0 — raw/ integrity + FAILED_HOOK observability + async Stop + install verify
Four hardening improvements from a security/reliability review.
(1) /haze verify-raw — sha256-based tamper detection for haze-wiki/raw/.
Every captured transcript now gets a hash stamp in wiki/.manifest.json's
raw_integrity object. Sub-command flags MODIFIED / NEW / MISSING files.
--bootstrap registers hashes for pre-v2.7 files. --diff shows changes.
Detection only — pair with git for true tamper-prevention.
(2) Hook FAILED_HOOK observability — every hook logs START / OK /
FAILED_HOOK exit=<code> to haze-wiki/log.md. Silent timeouts
(PostToolUse 5s, Stop 10s) no longer invisible.
(3) Async Stop hook (opt-in via async_stop_hook: true in config) —
capture-transcript.sh re-forks in background so session-end doesn't
block. Default off (orphaned-child tradeoff requires explicit opt-in).
(4) README Verify-install section + canonical hashes published here:
install.sh sha256: 99fa1ae824ff9f634a025b6a593839a878844309434ab5fdc3cb0037a373204c
cursor-install.sh sha256: 58f5c29acd5581164cd5da35692703a31f6caad7ca7ba934a3e5a7a381116bd7
Verify before running:
curl -fsSL https://haze-gitlab.sssjiwjs.app/haze-public/haze-wiki/-/raw/main/install.sh -o /tmp/install.sh
shasum -a 256 /tmp/install.sh # compare against the hash above
bash /tmp/install.sh