Why the checks are PREFETCH steps

⛔⛔ This is the whole design, and it is not stylistic. Every one of these tools reports failure the same way: a non-zero exit. signature.verify, file.test_gzip and archive.list_tar are all exit_code_handling: zero_is_success with no captured output — so a failed check is a failed step. And a failed sequential step ends the run (errors.push(log.error); break;), which would mean a recipe whose entire job is to record a failure could never record one.

optional: true — the flag that turns a step failure into a null result and lets the run continue — is honoured only in prefetch (prefetch.ts:232; the sequential runner has no equivalent). So the checks run as optional prefetch steps, and the sequential half reads which ones survived.

⚠ Prefetch steps run in PARALLEL and cannot read each other, so every check takes its inputs from {{config.*}} — never from another step. That is why you pass the path, the signature and the key here rather than having the recipe read them off the artifact row.

Reading the result

⚠ A skipped check and a failed check both land as null. They are told apart by whether the check was APPLICABLE, which is computed from your config: Archive kind decides whether the listing and integrity checks apply, and a blank Signature file means no signature check was asked for. A check that was applicable and came back null is a failure; one that was never applicable is reported as not-run. The card shows both counts separately.

⚠ verified requires every applicable check to pass AND at least one to have run. An artifact with no checksum, no signature and no archive kind runs zero checks and is recorded failed with a note — because "nothing was checked" must never read as "nothing was wrong".

⛔ Digests are compared case-insensitively but exactly. Paste the sender's checksum whole; a truncated prefix will not match and is not treated as a partial pass.

⚠ This reads a path on your disk that you name. The ops are read-only — digest, verify, test, list — and none of them extracts, writes or executes anything. Nothing is uploaded.