fix: align r17 installer ref with verifier pins

Author: vibeforge1111

docs/AGENTS.md

@@ -129,7 +129,7 @@ Spark Swarm network submission and hosted workspace review are upcoming private
 
 ## Current Installer Pins
 
-- Spark CLI commit: `c4b9a909402ff1a14d810529b5625802a4d47f28`
+- Spark CLI commit: `8ebbc64bcf650f45b4be4141a7f6c97604f8f2eb`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/install-safety.md

@@ -23,8 +23,8 @@ If you are non-technical, ask your coding assistant to open this page, run the d
 ## Current Hashes
 
 ```text
-e8056c6eb553e1268cb14c51d2a64d1296822669fde8f3a46c5a9ffd6f5d6c52  install.sh
-75d590d596144f36d0d8b351dabdace4c304ed1f53af3131973520f53129f9a9  install.ps1
+7efef6795bd280e52c69920adaa3eaa6bb4abeb8fc682850c81ab362f5b50b48  install.sh
+d499f5f5e36fca402d2daeeaf8764d77cf9129144c45edf4b8d01bedfb630a5e  install.ps1
 ```
 
 ## Safe Procedure
@@ -113,7 +113,7 @@ Users can change this later in Telegram with `/access 1`, `/access 2`, `/access
 
 ## Pinned Parts
 
-- Spark CLI commit: `c4b9a909402ff1a14d810529b5625802a4d47f28`
+- Spark CLI commit: `8ebbc64bcf650f45b4be4141a7f6c97604f8f2eb`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/llms-full.txt

@@ -139,7 +139,7 @@ Do not send Telegram tokens or LLM keys to websites.
 
 ## Current Installer Pins
 
-- Spark CLI commit: `c4b9a909402ff1a14d810529b5625802a4d47f28`
+- Spark CLI commit: `8ebbc64bcf650f45b4be4141a7f6c97604f8f2eb`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/pages/index.md

@@ -71,7 +71,7 @@ The installer has checksums, a release manifest, pinned managed runtimes, immuta
 Current public installer state:
 
 - Release: `spark-cli-public-installer-2026-05-29-r17`
-- Installed Spark CLI runtime commit: `c4b9a909402ff1a14d810529b5625802a4d47f28`
+- Installed Spark CLI runtime commit: `8ebbc64bcf650f45b4be4141a7f6c97604f8f2eb`
 - Local installer hashes match the committed release manifest.
 - Hosted installer verification passed after deploy.
 - Windows and WSL sandbox install checks are part of the release gate.

docs/pages/install-safety.md

@@ -50,8 +50,8 @@ Only then run the real install.
 ## Current Hashes
 
 ```text
-e8056c6eb553e1268cb14c51d2a64d1296822669fde8f3a46c5a9ffd6f5d6c52  install.sh
-75d590d596144f36d0d8b351dabdace4c304ed1f53af3131973520f53129f9a9  install.ps1
+7efef6795bd280e52c69920adaa3eaa6bb4abeb8fc682850c81ab362f5b50b48  install.sh
+d499f5f5e36fca402d2daeeaf8764d77cf9129144c45edf4b8d01bedfb630a5e  install.ps1
 ```
 
 ## Safe Human Procedure

docs/updates.md

@@ -41,5 +41,5 @@ The expected Spark CLI release is:
 
 ```text
 spark-cli-public-installer-2026-05-29-r17
-c4b9a909402ff1a14d810529b5625802a4d47f28
+8ebbc64bcf650f45b4be4141a7f6c97604f8f2eb
 ```

docs/updates/index.html

@@ -66,7 +66,7 @@ <h3>Spark Swarm comes later</h3>
     <section class="doc-section">
       <h2>Verify the release.</h2>
       <pre class="docs-code">spark verify --installers --hosted-installers</pre>
-      <p>Expected release: <code>spark-cli-public-installer-2026-05-29-r17</code> at <code>c4b9a909402ff1a14d810529b5625802a4d47f28</code>.</p>
+      <p>Expected release: <code>spark-cli-public-installer-2026-05-29-r17</code> at <code>8ebbc64bcf650f45b4be4141a7f6c97604f8f2eb</code>.</p>
     </section>
   </article>
 </main>

install.ps1

@@ -1,7 +1,7 @@
 param(
     [string]$Prefix = "$HOME\.spark",
     [string]$Source = "https://github.com/vibeforge1111/spark-cli",
-    [string]$Ref = "c4b9a909402ff1a14d810529b5625802a4d47f28",
+    [string]$Ref = "8ebbc64bcf650f45b4be4141a7f6c97604f8f2eb",
     [string]$NodeVersion = "22.18.0",
     [string]$PythonVersion = "3.11",
     [string]$UvVersion = "0.11.7",

install.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 SPARK_PREFIX="${SPARK_PREFIX:-$HOME/.spark}"
 SPARK_CLI_SOURCE="${SPARK_CLI_SOURCE:-https://github.com/vibeforge1111/spark-cli}"
 SPARK_CLI_RELEASE_NAME="${SPARK_CLI_RELEASE_NAME:-spark-cli-public-installer-2026-05-29-r17}"
-SPARK_DEFAULT_CLI_REF="c4b9a909402ff1a14d810529b5625802a4d47f28"
+SPARK_DEFAULT_CLI_REF="8ebbc64bcf650f45b4be4141a7f6c97604f8f2eb"
 SPARK_CLI_REF_USER_SET=0
 if [ -n "${SPARK_CLI_REF:-}" ]; then
   SPARK_CLI_REF_USER_SET=1

install/attestations.md

@@ -24,7 +24,7 @@ The manifest includes the immutable Spark CLI commit, managed Node version, mana
 
 ```bash
 curl -fsSL https://agent.sparkswarm.ai/install.sh -o ./install.sh
-expected='e8056c6eb553e1268cb14c51d2a64d1296822669fde8f3a46c5a9ffd6f5d6c52'
+expected='7efef6795bd280e52c69920adaa3eaa6bb4abeb8fc682850c81ab362f5b50b48'
 actual=$(if command -v sha256sum >/dev/null 2>&1; then sha256sum ./install.sh | awk '{print $1}'; elif command -v shasum >/dev/null 2>&1; then shasum -a 256 ./install.sh | awk '{print $1}'; else echo 'Missing sha256sum or shasum'; exit 1; fi)
 test "$actual" = "$expected" || { echo 'spark installer checksum mismatch'; exit 1; }
 gh attestation verify ./install.sh --repo vibeforge1111/Spark-Agent-Site --signer-workflow vibeforge1111/Spark-Agent-Site/.github/workflows/install-hardening.yml --source-ref refs/heads/main
@@ -36,7 +36,7 @@ bash ./install.sh --dry-run
 
 ```powershell
 iwr https://agent.sparkswarm.ai/install.ps1 -OutFile .\install.ps1
-if ((Get-FileHash .\install.ps1 -Algorithm SHA256).Hash.ToLowerInvariant() -ne '75d590d596144f36d0d8b351dabdace4c304ed1f53af3131973520f53129f9a9') { throw 'install.ps1 checksum mismatch' }
+if ((Get-FileHash .\install.ps1 -Algorithm SHA256).Hash.ToLowerInvariant() -ne 'd499f5f5e36fca402d2daeeaf8764d77cf9129144c45edf4b8d01bedfb630a5e') { throw 'install.ps1 checksum mismatch' }
 gh attestation verify .\install.ps1 --repo vibeforge1111/Spark-Agent-Site --signer-workflow vibeforge1111/Spark-Agent-Site/.github/workflows/install-hardening.yml --source-ref refs/heads/main
 Get-Content .\install.ps1
 powershell -NoProfile -ExecutionPolicy Bypass -File .\install.ps1 -DryRun