[thesprockee]

Closes #16. Asked for by Spritz after release-signer #25 (docs/plugin-release.md) replaced the loose-DLL release with a zip.

What

When a release's echo-mod.json names a "package", scripts/inspect_submission.py reads the plugin-release layout (spec §4); otherwise it reads the older one exactly as before, until the first mod ships in the new shape.

• scripts/package_layout.py (new, stdlib only): exactly the three assets <id>-v<ver>-windows.zip, echo-mod.json, SHA256SUMS; the manifest has package = the zip, a source object and no sha256/size; the top-level sums match the zip and echo-mod.json and name nothing else; the zip is flat, holds only the DLL, LICENSE, optional NOTICE, the settings file when declared and SHA256SUMS; no links, special or encrypted entries, no case or Windows-device-name collisions, size caps (DLL 16 MiB); the inner sums cover every entry. Only the DLL is unpacked, to work/unpacked/, for the template's DLL checks and the load test.
• inspect_submission.py: picks the layout (release_layout), runs the template's manifest checks plus tag/prerelease checks, attests all three assets in the new layout, and records layout, package and the DLL's sha256/size in the facts (VirusTotal looks up the DLL, as before). report_submission.py shows layout and package.
• tests/test_package_layout.py (24 tests) builds a fixture release in the new shape; each rule has a negative control.
• .github/workflows/package-layout-tests.yml runs them on PRs.

Not shown

No mod has shipped in the new shape, so the real path (download, attestation, load test of an unpacked DLL) has not run end to end; only the layout rules and the glue are tested, with a stub of the template's check_mod. The template's own check_published still expects the old layout; the new path does not call it. A fork's draft/unsigned-vs-signed difference doesn't matter here: this check looks at the author's repo, whose release is unsigned and attested.

One thing to settle: the new template's release.yml creates a draft. This check lists published releases only (if not r.get("draft")), and a draft in the author's repo is invisible to it, so the author has to publish their own draft before submitting. The README (#15) does not say so yet.

Commands run

$ python3 -I -m unittest discover -s tests
Ran 24 tests in 0.017s
OK

Mutants (one line changed, tests run, file restored from a saved copy):

M1 assets set not enforced          -> FAIL test_exactly_three_assets
M2 folders allowed                  -> FAIL test_zip_is_flat
M3 links allowed                    -> FAIL test_link_entries_refused
M4 inner sums unchecked             -> FAIL test_inner_sums_must_cover_every_entry, test_inner_sums_must_match
M5 outer sums digest not compared   -> FAIL test_outer_sums_must_match_the_zip, test_inner_sums_must_match
M6 case-insensitive duplicate off   -> FAIL test_names_compare_without_case
M7 size cap off                     -> FAIL test_dll_size_cap
M8 tag check off                    -> FAIL test_tag_must_match_the_version
M9 manifest digests allowed         -> FAIL test_manifest_carries_no_digests
restored tree: Ran 24 tests ... OK

Gates from #14 on this branch: title and commits ok: true.

Co-Authored-By: Andrew Bates a@sprock.io