WordPress 7.1 fails its checksum check after wp core download

What you see

You installed WordPress with wp core download, and either wp core verify-checksums fails or a security scanner flags changed core files. The checksum check names files under wp-includes/php-ai-client that it cannot find:

Why it happens

WordPress 7.1 added a library under wp-includes/php-ai-client whose file paths are long: sixteen of them pass 100 characters even counted from the site folder. wp core download fetches a tar archive and unpacks it, and on our test servers the files with the longest paths came out with their names cut short. The file is there under the wrong name, so WordPress cannot load it and the checksum check reports it missing.

Nothing was tampered with. It is a broken install, not a hacked one, but it fails the same checks a hacked one does, and the cut-short names can turn into fatal errors when that code runs.

The fix: install core from the official zip

1. Back up first if the site already has content: the database (wp db export) and wp-content.
2. As the user that owns the site (not root), download the zip of the same version into a temporary folder and unpack it.
3. Copy everything except wp-content over the site, so wp-admin and wp-includes are replaced and your themes, plugins and uploads are left alone.
4. Remove the files with cut-short names: they now sit next to the right ones. The checksum check lists them as files that should not exist in wp-includes; delete those.
5. Run wp core verify-checksums again. It must end with Success.

For new installs

Skip wp core download and start from the zip: curl -fsSLO https://wordpress.org/latest.zip, unzip, move the contents of wordpress/ into the site folder, then wp config create and wp core install as usual. Check with wp core verify-checksums before you put anything on the site.