@akira-tl/forgerelay 0.6.0 → 0.6.1

package/scripts/release/pack.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { mkdirSync, readdirSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+
+const npmCli = process.env.npm_execpath;
+if (!npmCli) {
+  throw new Error("release:pack must be launched through npm so npm_execpath is available");
+}
+
+const outputDir = resolve(process.cwd(), process.env.RELEASE_ARTIFACT_DIR ?? ".release-artifacts");
+rmSync(outputDir, { recursive: true, force: true });
+mkdirSync(outputDir, { recursive: true });
+
+const result = spawnSync(
+  process.execPath,
+  [npmCli, "pack", "--pack-destination", outputDir],
+  {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: "inherit",
+    windowsHide: true,
+    shell: false,
+  },
+);
+if (result.error) throw result.error;
+if (result.status !== 0) {
+  throw new Error(`npm pack failed with exit ${result.status ?? "unknown"}`);
+}
+
+const packages = readdirSync(outputDir).filter((name) => name.endsWith(".tgz"));
+if (packages.length !== 1) {
+  throw new Error(`release:pack expected exactly one .tgz artifact, found ${packages.length}`);
+}
+console.log(`Verified npm artifact: ${packages[0]}`);

package/scripts/release/publish.mjs

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+const repository = "Akira-TL/forgerelay";
+const releaseTag = requiredEnv("RELEASE_TAG");
+const packageDir = resolve(repoRoot, process.env.RELEASE_PACKAGE_DIR ?? ".release-package");
+const npmCli = process.env.npm_execpath;
+if (!npmCli) {
+  throw new Error("release:publish must be launched through npm so npm_execpath is available");
+}
+
+const pkg = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf8"));
+const expectedTag = `v${pkg.version}`;
+if (releaseTag !== expectedTag) {
+  throw new Error(`release tag ${releaseTag} does not match package version ${pkg.version}; expected ${expectedTag}`);
+}
+
+const head = git(["rev-parse", "HEAD"]);
+const tagHead = git(["rev-parse", `${releaseTag}^{commit}`]);
+if (head !== tagHead) {
+  throw new Error(`checked-out HEAD ${head.slice(0, 12)} does not match ${releaseTag} at ${tagHead.slice(0, 12)}`);
+}
+if (!gitSucceeds(["merge-base", "--is-ancestor", tagHead, "origin/main"])) {
+  throw new Error(`${releaseTag} does not point to a commit contained in origin/main`);
+}
+
+const packages = readdirSync(packageDir).filter((name) => name.endsWith(".tgz"));
+if (packages.length !== 1) {
+  throw new Error(`release package directory must contain exactly one .tgz artifact, found ${packages.length}`);
+}
+const packagePath = join(packageDir, packages[0]);
+const expectedPackageName = `${pkg.name.replace(/^@/, "").replaceAll("/", "-")}-${pkg.version}.tgz`;
+if (basename(packagePath) !== expectedPackageName) {
+  throw new Error(`unexpected release artifact ${basename(packagePath)}; expected ${expectedPackageName}`);
+}
+
+const npmTag = pkg.version.includes("-rc.") ? "next" : "latest";
+const packageSpec = `${pkg.name}@${pkg.version}`;
+if (npmPackageExists(packageSpec)) {
+  console.log(`${packageSpec} is already published; leaving npm unchanged.`);
+} else {
+  console.log(`Publishing verified artifact ${basename(packagePath)} with npm tag ${npmTag}.`);
+  const publishEnv = { ...process.env };
+  if (!publishEnv.NODE_AUTH_TOKEN) delete publishEnv.NODE_AUTH_TOKEN;
+  runNpm(["publish", packagePath, "--access", "public", "--tag", npmTag], "npm publish", publishEnv);
+}
+
+if (ghReleaseExists(releaseTag)) {
+  console.log(`GitHub Release ${releaseTag} already exists; leaving it unchanged.`);
+} else {
+  const notesPath = prepareReleaseNotes(releaseTag);
+  const args = [
+    "release",
+    "create",
+    releaseTag,
+    "--repo",
+    repository,
+    "--verify-tag",
+    "--title",
+    releaseTag,
+    "--notes-file",
+    notesPath,
+  ];
+  if (npmTag === "next") args.push("--prerelease");
+  run("gh", args, "GitHub Release");
+}
+
+function requiredEnv(name) {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+
+function git(args) {
+  return execFileSync("git", args, {
+    cwd: repoRoot,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  }).trim();
+}
+
+function gitSucceeds(args) {
+  const result = spawnSync("git", args, {
+    cwd: repoRoot,
+    stdio: "ignore",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  return result.status === 0;
+}
+
+function npmPackageExists(spec) {
+  const result = spawnSync(process.execPath, [npmCli, "view", spec, "version", "--json"], {
+    cwd: repoRoot,
+    env: process.env,
+    encoding: "utf8",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status === 0) return true;
+  const detail = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+  if (/E404|404 Not Found/i.test(detail)) return false;
+  throw new Error(`npm view failed while checking ${spec}: ${detail.trim() || `exit ${result.status ?? "unknown"}`}`);
+}
+
+function runNpm(args, label, env = process.env) {
+  run(process.execPath, [npmCli, ...args], label, env);
+}
+
+function ghReleaseExists(tag) {
+  const result = spawnSync("gh", ["release", "view", tag, "--repo", repository], {
+    cwd: repoRoot,
+    env: process.env,
+    stdio: "ignore",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  return result.status === 0;
+}
+
+function prepareReleaseNotes(tag) {
+  const manualNotes = join(repoRoot, "docs", "releases", `${tag}.md`);
+  const notes = existsSync(manualNotes)
+    ? readFileSync(manualNotes, "utf8")
+    : execFileSync(process.execPath, ["scripts/release-version.mjs", "notes", tag], {
+        cwd: repoRoot,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "inherit"],
+      });
+  const tempRoot = resolve(process.env.RUNNER_TEMP ?? join(repoRoot, ".forgerelay-debug"));
+  mkdirSync(tempRoot, { recursive: true });
+  const notesPath = join(tempRoot, `release-notes-${tag}.md`);
+  writeFileSync(notesPath, notes.endsWith("\n") ? notes : `${notes}\n`);
+  return notesPath;
+}
+
+function run(command, args, label, env = process.env) {
+  const result = spawnSync(command, args, {
+    cwd: repoRoot,
+    env,
+    stdio: "inherit",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`${label} failed with exit ${result.status ?? "unknown"}`);
+  }
+}

package/scripts/release/release-gate.test.mjs

@@ -10,14 +10,25 @@ async function readJson(relativePath) {
   return JSON.parse(await readFile(resolve(repoRoot, relativePath), "utf8"));
 }
 
-test("release tag Hook is a fast proof gate, not a multi-minute CI runner", async () => {
-  const hook = await readJson(".forgerelay/hooks/release-tag-local-ci.json");
+test("release tag Hook is a fast repository-state gate for common origin tag push forms", async () => {
+  const hook = await readJson(".forgerelay/hooks/release-tag-gate.json");
   assert.equal(hook.event, "BeforeTool");
   assert.equal(hook.command, "node scripts/release-proof.mjs check-hook");
   assert.ok(hook.timeoutSeconds <= 30);
+
+  const matcher = new RegExp(hook.matcher.commandRegex);
+  for (const command of [
+    "git push origin v1.2.3",
+    "git push --atomic origin v1.2.3",
+    "git push origin refs/tags/v1.2.3",
+    "git status && git push origin tag v1.2.3 && echo done",
+  ]) {
+    assert.match(command, matcher);
+  }
+  assert.doesNotMatch("git push origin main", matcher);
 });
 
-test("release:verify records proof only after the cloud-equivalent parity gate", async () => {
+test("optional release:verify records proof only after the cloud-equivalent parity gate", async () => {
   const pkg = await readJson("package.json");
   assert.equal(
     pkg.scripts["release:verify"],
@@ -25,19 +36,65 @@ test("release:verify records proof only after the cloud-equivalent parity gate",
   );
 });
 
-test("release parity mirrors the cloud CI command surface on Node 22.19 and npm 10.9", async () => {
-  const source = await readFile(resolve(repoRoot, "scripts/release-parity.mjs"), "utf8");
-  assert.match(source, /const NODE_VERSION = "22\.19\.0"/);
-  assert.match(source, /const NPM_VERSION = "10\.9\.3"/);
-  for (const command of [
-    '["npm", "ci", "--no-audit", "--no-fund"]',
-    '["npm", "run", "release:check"]',
-    '["npm", "run", "typecheck"]',
-    '["npm", "test"]',
-    '["npm", "run", "build"]',
-    '["npm", "run", "lsp:interop"]',
-    '["dist/cli.js", "doctor"]',
+test("cross-platform cloud CI delegates to one shell-free verification entrypoint", async () => {
+  const workflow = await readFile(resolve(repoRoot, ".github/workflows/ci.yml"), "utf8");
+  assert.match(workflow, /node-version-file:\s*\.nvmrc/);
+  assert.match(workflow, /run:\s*npm ci/);
+  assert.match(workflow, /run:\s*npm run ci:verify/);
+  assert.doesNotMatch(workflow, /shell:/);
+  assert.doesNotMatch(workflow, /run:\s*\|/);
+  for (const duplicatedCommand of [
+    "npm run release:check",
+    "npm run typecheck",
+    "npm test",
+    "npm run build",
+    "npm run lsp:interop",
+    "node dist/cli.js doctor",
   ]) {
-    assert.ok(source.includes(command), `release parity is missing ${command}`);
+    assert.equal(
+      workflow.includes(`run: ${duplicatedCommand}`),
+      false,
+      `cloud CI must delegate ${duplicatedCommand} through ci:verify`,
+    );
   }
 });
+
+test("release runtime and local parity share the checked-in Node contract", async () => {
+  const nodeVersion = (await readFile(resolve(repoRoot, ".nvmrc"), "utf8")).trim();
+  assert.equal(nodeVersion, "22.19.0");
+
+  const pkg = await readJson("package.json");
+  assert.equal(pkg.scripts["ci:verify"], "node scripts/ci/verify.mjs");
+
+  const source = await readFile(resolve(repoRoot, "scripts/release-parity.mjs"), "utf8");
+  assert.match(source, /readFileSync\(join\(repoRoot, "\.nvmrc"\), "utf8"\)/);
+  assert.match(source, /const NPM_VERSION = "10\.9\.3"/);
+  assert.ok(source.includes('["npm", "ci", "--no-audit", "--no-fund"]'));
+  assert.ok(source.includes('["npm", "run", "ci:verify"]'));
+  assert.ok(source.includes('["npm", "run", "release:pack"]'));
+  assert.doesNotMatch(source, /\["npm", "run", "typecheck"\]/);
+  assert.doesNotMatch(source, /\["npm", "test"\]/);
+});
+
+test("cloud verification produces one reusable npm package on Linux", async () => {
+  const workflow = await readFile(resolve(repoRoot, ".github/workflows/ci.yml"), "utf8");
+  assert.match(workflow, /if:\s*runner\.os == 'Linux'[\s\S]*run:\s*npm run release:pack/);
+  assert.match(workflow, /uses:\s*actions\/upload-artifact@v4/);
+  assert.match(workflow, /name:\s*npm-package/);
+  assert.match(workflow, /include-hidden-files:\s*true/);
+  assert.match(workflow, /overwrite:\s*true/);
+});
+
+test("release workflow is tag-only and promotes the verified npm artifact without rebuilding", async () => {
+  const workflow = await readFile(resolve(repoRoot, ".github/workflows/release.yml"), "utf8");
+  assert.doesNotMatch(workflow, /workflow_dispatch:/);
+  assert.match(workflow, /needs:\s*verify/);
+  assert.match(workflow, /uses:\s*actions\/download-artifact@v5/);
+  assert.match(workflow, /name:\s*npm-package/);
+  assert.match(workflow, /run:\s*npm run release:publish/);
+  assert.match(workflow, /npm install --global npm@11\.19\.1/);
+  assert.doesNotMatch(workflow, /run:\s*npm ci/);
+  assert.doesNotMatch(workflow, /run:\s*npm run build/);
+  assert.doesNotMatch(workflow, /run:\s*\|/);
+  assert.doesNotMatch(workflow, /shell:\s*bash/);
+});

package/scripts/release-parity.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
 import { execFileSync, spawnSync } from "node:child_process";
-import { cpSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { cpSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-const NODE_VERSION = "22.19.0";
 const NPM_VERSION = "10.9.3";
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const NODE_VERSION = readFileSync(join(repoRoot, ".nvmrc"), "utf8").trim();
 const debugRoot = join(repoRoot, ".forgerelay-debug");
 const sandbox = mkdtempSync(join(ensureDirectory(debugRoot), "release-parity-node22-"));
 const npx = process.platform === "win32" ? "npx.cmd" : "npx";
@@ -29,15 +29,11 @@ try {
     ["npm", "ci", "--no-audit", "--no-fund"],
     `Node ${NODE_VERSION} / npm ${NPM_VERSION} install`,
   );
-  runNodeNpm(sandbox, env, ["npm", "run", "release:check"], "Release metadata");
-  runNodeNpm(sandbox, env, ["npm", "run", "typecheck"], "Typecheck");
-  runNodeNpm(sandbox, env, ["npm", "test"], "Full test suite");
-  runNodeNpm(sandbox, env, ["npm", "run", "build"], "Build");
-  runNodeNpm(sandbox, env, ["npm", "run", "lsp:interop"], "Optional LSP interoperability");
-  runNode(sandbox, env, ["dist/cli.js", "doctor"], "Doctor");
+  runNodeNpm(sandbox, env, ["npm", "run", "ci:verify"], "Cloud verification entrypoint");
+  runNodeNpm(sandbox, env, ["npm", "run", "release:pack"], "Cloud release packaging");
 
   console.log(
-    `Release parity passed with the cloud CI command surface on Node ${NODE_VERSION} / npm ${NPM_VERSION}.`,
+    `Release parity passed through ci:verify and release:pack on Node ${NODE_VERSION} / npm ${NPM_VERSION}.`,
   );
 } finally {
   rmSync(sandbox, {
@@ -92,10 +88,6 @@ function runNodeNpm(cwd, env, command, label) {
   );
 }
 
-function runNode(cwd, env, args, label) {
-  run(cwd, env, ["--yes", `node@${NODE_VERSION}`, ...args], label);
-}
-
 function run(cwd, env, args, label) {
   console.log(`\n== ${label} ==`);
   const result = spawnSync(npx, args, {

package/scripts/release-proof.mjs

@@ -42,15 +42,15 @@ function currentHead() {
   return git(["rev-parse", "HEAD"]);
 }
 
-function assertReleaseTreeClean() {
+function assertReleaseTreeClean(context) {
   const status = git(["status", "--porcelain", "--untracked-files=all"]);
   if (status) {
-    throw new Error("working tree differs from HEAD or contains untracked files; commit or remove every release input before running release:verify");
+    throw new Error(`working tree differs from HEAD or contains untracked files; commit or remove every release input before ${context}`);
   }
 }
 
 function writeProof() {
-  assertReleaseTreeClean();
+  assertReleaseTreeClean("running release:verify");
   const proof = {
     proofVersion: PROOF_VERSION,
     head: currentHead(),
@@ -90,28 +90,37 @@ function hookTag() {
   } catch {
     throw new Error("FORGERELAY_HOOK_PAYLOAD is not valid JSON");
   }
-  const command = typeof payload.command === "string" ? payload.command : "";
-  const match = /git\s+push\s+origin\s+(v\d+\.\d+\.\d+(?:-rc\.\d+)?)/.exec(command);
-  if (!match?.[1]) {
+  const command = typeof payload.originalCommand === "string"
+    ? payload.originalCommand
+    : typeof payload.command === "string"
+      ? payload.command
+      : "";
+  const pushMatch = /git\s+push\b([^;&|\n]*)/.exec(command);
+  if (!pushMatch?.[0] || !/\borigin\b/.test(pushMatch[0])) {
+    throw new Error("release Hook payload does not contain an origin release tag push");
+  }
+  const pushCommand = pushMatch[0];
+  if (/(?:^|\s)(?:-f|--force(?:-with-lease)?)(?:=\S*)?(?=$|\s)/.test(pushCommand)
+    || /(?:^|\s)\+(?:refs\/tags\/)?v\d+\.\d+\.\d+(?:-rc\.\d+)?(?=$|\s)/.test(pushCommand)) {
+    throw new Error("force push is not allowed for release tags");
+  }
+  if (/(?:^|\s)(?:-d|--delete)(?=$|\s)/.test(pushCommand)) {
+    throw new Error("deleting a release tag is not allowed");
+  }
+  const tagMatch = /(?:^|\s)(?:tag\s+)?(?:refs\/tags\/)?(v\d+\.\d+\.\d+(?:-rc\.\d+)?)(?=$|\s)/.exec(pushCommand);
+  if (!tagMatch?.[1]) {
     throw new Error("release Hook payload does not contain a release tag push");
   }
-  return match[1];
+  return tagMatch[1];
 }
 
-function checkHookProof() {
-  assertReleaseTreeClean();
-  const proof = readProof();
+function checkHookTag() {
+  assertReleaseTreeClean("pushing a release tag");
   const head = currentHead();
   const version = packageVersion();
   const tag = hookTag();
   const expectedTag = `v${version}`;
 
-  if (proof.head !== head) {
-    throw new Error(`release proof is for ${proof.head.slice(0, 12)}, but current HEAD is ${head.slice(0, 12)}; rerun npm run release:verify`);
-  }
-  if (proof.packageVersion !== version) {
-    throw new Error(`release proof is for package ${proof.packageVersion}, but package.json is ${version}; rerun npm run release:verify`);
-  }
   if (tag !== expectedTag) {
     throw new Error(`tag ${tag} does not match package version ${version}; expected ${expectedTag}`);
   }
@@ -123,16 +132,16 @@ function checkHookProof() {
     throw new Error(`local tag ${tag} does not exist or does not resolve to a commit`);
   }
   if (tagHead !== head) {
-    throw new Error(`tag ${tag} points to ${tagHead.slice(0, 12)}, but verified HEAD is ${head.slice(0, 12)}`);
+    throw new Error(`tag ${tag} points to ${tagHead.slice(0, 12)}, but current HEAD is ${head.slice(0, 12)}`);
   }
 
-  console.log(`Release proof OK: ${tag} -> ${head.slice(0, 12)} (${proof.verifiedAt}).`);
+  console.log(`Release tag gate OK: ${tag} -> ${head.slice(0, 12)}; cloud CI will perform release verification.`);
 }
 
 const action = process.argv[2];
 try {
   if (action === "write") writeProof();
-  else if (action === "check-hook") checkHookProof();
+  else if (action === "check-hook") checkHookTag();
   else throw new Error("usage: node scripts/release-proof.mjs <write|check-hook>");
 } catch (error) {
   fail(error instanceof Error ? error.message : String(error));

package/scripts/release-proof.test.mjs

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
-import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -21,7 +21,7 @@ async function runProof(cwd, action, env = {}) {
   });
 }
 
-test("release proof binds a successful local verification to the exact tag HEAD", async (t) => {
+test("release tag hook gate uses repository facts instead of requiring a local proof", async (t) => {
   const root = await mkdtemp(join(tmpdir(), "forgerelay-release-proof-"));
   t.after(() => rm(root, { recursive: true, force: true }));
   await writeFile(join(root, "package.json"), JSON.stringify({ version: "1.2.3" }) + "\n");
@@ -34,12 +34,37 @@ test("release proof binds a successful local verification to the exact tag HEAD"
 
   const written = await runProof(root, "write");
   assert.match(written.stdout, /Release verification proof recorded/);
+  await rm(join(root, ".git", "forgerelay", "release-proof.json"));
   await git(root, ["tag", "v1.2.3"]);
 
   const checked = await runProof(root, "check-hook", {
     FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push origin v1.2.3" }),
   });
-  assert.match(checked.stdout, /Release proof OK: v1\.2\.3/);
+  assert.match(checked.stdout, /Release tag gate OK: v1\.2\.3/);
+
+  for (const command of [
+    "git push --atomic origin v1.2.3",
+    "git push origin refs/tags/v1.2.3",
+    "git status && git push origin tag v1.2.3 && echo done",
+  ]) {
+    const alternative = await runProof(root, "check-hook", {
+      FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command, originalCommand: command }),
+    });
+    assert.match(alternative.stdout, /Release tag gate OK: v1\.2\.3/);
+  }
+
+  await assert.rejects(
+    () => runProof(root, "check-hook", {
+      FORGERELAY_HOOK_PAYLOAD: JSON.stringify({
+        command: "git push origin v1.2.3",
+        originalCommand: "git push --force origin v1.2.3",
+      }),
+    }),
+    (error) => {
+      assert.match(String(error.stderr ?? error), /force push is not allowed for release tags/);
+      return true;
+    },
+  );
 
   await writeFile(join(root, "tracked.txt"), "changed after verification\n");
   await assert.rejects(
@@ -71,13 +96,13 @@ test("release proof binds a successful local verification to the exact tag HEAD"
       FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push origin v1.2.3" }),
     }),
     (error) => {
-      assert.match(String(error.stderr ?? error), /release proof is for .* current HEAD is/);
+      assert.match(String(error.stderr ?? error), /tag v1\.2\.3 points to .* current HEAD is/);
       return true;
     },
   );
 });
 
-test("release proof accepts an rc tag for the verified package version", async (t) => {
+test("release tag hook gate accepts an rc tag for the package version", async (t) => {
   const root = await mkdtemp(join(tmpdir(), "forgerelay-release-proof-"));
   t.after(() => rm(root, { recursive: true, force: true }));
   await writeFile(join(root, "package.json"), JSON.stringify({ version: "0.6.0-rc.1" }) + "\n");
@@ -86,16 +111,15 @@ test("release proof accepts an rc tag for the verified package version", async (
   await git(root, ["config", "user.name", "Release Proof Test"]);
   await git(root, ["add", "."]);
   await git(root, ["commit", "-m", "release 0.6.0-rc.1"]);
-  await runProof(root, "write");
   await git(root, ["tag", "v0.6.0-rc.1"]);
 
   const checked = await runProof(root, "check-hook", {
     FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push origin v0.6.0-rc.1" }),
   });
-  assert.match(checked.stdout, /Release proof OK: v0\.6\.0-rc\.1/);
+  assert.match(checked.stdout, /Release tag gate OK: v0\.6\.0-rc\.1/);
 });
 
-test("release proof rejects a mismatched tag without invoking a remote", async (t) => {
+test("release tag hook gate rejects a mismatched tag without invoking a remote", async (t) => {
   const root = await mkdtemp(join(tmpdir(), "forgerelay-release-proof-"));
   t.after(() => rm(root, { recursive: true, force: true }));
   await writeFile(join(root, "package.json"), JSON.stringify({ version: "2.0.0" }) + "\n");
@@ -104,7 +128,6 @@ test("release proof rejects a mismatched tag without invoking a remote", async (
   await git(root, ["config", "user.name", "Release Proof Test"]);
   await git(root, ["add", "."]);
   await git(root, ["commit", "-m", "release 2.0.0"]);
-  await runProof(root, "write");
   await git(root, ["tag", "v2.0.0"]);
 
   await assert.rejects(
@@ -117,6 +140,4 @@ test("release proof rejects a mismatched tag without invoking a remote", async (
     },
   );
 
-  const proof = JSON.parse(await readFile(join(root, ".git", "forgerelay", "release-proof.json"), "utf8"));
-  assert.equal(proof.packageVersion, "2.0.0");
 });

package/scripts/release-version.mjs

@@ -171,7 +171,7 @@ async function prepareRelease(state, nextVersion, dryRun) {
 
   console.log(`${state.pkg.version} -> ${nextVersion}`);
   console.log("updated package.json, package-lock.json, and CHANGELOG.md");
-  console.log("next: review the diff, commit the release-ready tree, run npm run release:verify on that clean HEAD, then push the matching release tag");
+  console.log("next: review the diff, commit and push the release-ready tree, then push the matching release tag; cloud CI is the authoritative release verification");
 }
 
 function promoteUnreleased(changelog, nextVersion) {