@dzhechkov/harness-cli 0.7.0 → 0.7.2

package/.dz-manifest.json

@@ -9,7 +9,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "696aae63a95e8f8726eecc1aa0e68f20d7980e99bb4008b22f2e1058ca67c6c0"
+        "sha256": "ca0d42d114330fe7a2d0833abbf2fe90f3a60221e6cffeb3dc3b7edc7f818ec6"
       },
       {
         "path": "dist/bin.d.ts",
@@ -29,51 +29,51 @@
       },
       {
         "path": "dist/cli.d.ts",
-        "sha256": "3893831e365016b5bd118f7f0ce2e8b106cfd0400689b9e190a5f80aa61b79f5"
+        "sha256": "5aeeec8ab84e3922ce0c7b7ea711fd1cdff67b68e1ded0b66e920a907e6ac267"
       },
       {
         "path": "dist/cli.d.ts.map",
-        "sha256": "ea26d4cfd1265fc9f2397a17055580425ddf1ee312e0f28a06a214804a58906a"
+        "sha256": "f1cc2dc4a5de433a2d3cbd1e0567bf9c7bb5f3d04e90f72d10c54a9ccc5b00ae"
       },
       {
         "path": "dist/cli.js",
-        "sha256": "aa547fee89f14b634fb3b95f95ccbe1bfcc3f29a1c8f11b01a4ecc98ff3e736d"
+        "sha256": "a1154eea12c861e092af90e33b5074d1219401f2194e2205f29ae9deb742834e"
       },
       {
         "path": "dist/cli.js.map",
-        "sha256": "11c89da8d9b115a70397da792e9b2220e32936ecebcd2e26ab03963c14fc56d8"
+        "sha256": "a1fcb5f0f1524e7564bdec11bcf3b1c8d9d41ddb08ea5502dc72bbb3de439baa"
       },
       {
         "path": "dist/core-compat.d.ts",
-        "sha256": "b735a6c18bfbe5adf17bbcfe6e2eeae71477b877e958c36e0a5e73e59f100d6a"
+        "sha256": "4ab523bc0a5f777fd66b8ed44c07a8b240a4cf2ce32da779a3916e6ddc53fa33"
       },
       {
         "path": "dist/core-compat.d.ts.map",
-        "sha256": "bce1ded9ffac15080908af1a9571b67141c141374ec4ba90b987fd6fd8883aab"
+        "sha256": "e378022dd85db141f1d5b4d06d4791072b4caf6900b992dde5781d09b0559c35"
       },
       {
         "path": "dist/core-compat.js",
-        "sha256": "6d052e0a7352e9824bc1d4a319d03b42320f6551210f7dfd360afbdca4e556f0"
+        "sha256": "0c33ad728e7b3b25211d0b16d2803b9ca35d0aae6d3a570b57aa9b8377fcde1f"
       },
       {
         "path": "dist/core-compat.js.map",
-        "sha256": "e95005978fdd733f78208d6d916f62f970123530241739c9da7d3a74154b7a13"
+        "sha256": "342b0c716f6ac9f853e6fb9e10d2d3ae4c643f047becd200d6f8576a84674fb2"
       },
       {
         "path": "dist/index.d.ts",
-        "sha256": "a25d0a97a30fa5abc35473ed4ca1bc32bc5a8bcb8a45c57d7feeb03cb6058e02"
+        "sha256": "936596fd99f3767ca0119a02f07dfabf22b5b1c30e7007c63c3ff21cfced3836"
       },
       {
         "path": "dist/index.d.ts.map",
-        "sha256": "7c554d109fb0aabcf9a2923b0d9ac84723652abdec81202b2cc0a726d38c84bd"
+        "sha256": "9096b181a0164cd59061bddcf9f4bee59123c1ab776e7a12da8b9808bd5b7936"
       },
       {
         "path": "dist/index.js",
-        "sha256": "5b7992e09b843a01c9bf7a05b5db4475ca9abbf893ead79f7bad73f0f92c4249"
+        "sha256": "8225f1de31f005c0d883fa9cf9b3a106f5e244ebbe5b4b3d2375c8127ba821f8"
       },
       {
         "path": "dist/index.js.map",
-        "sha256": "54c8133a172c2ca81c3f5a32e701386812a621198758423fcc7f0bf3db8c1ff7"
+        "sha256": "02b6b6f1b17a53d652a75555d185a20ea5d3e3110aa915ab228bf5521b0ce5fb"
       },
       {
         "path": "keys/README.md",
@@ -85,7 +85,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "c8e09eb658132733bf3fbd6e4b54eaa0e8084264fddcd279e663e32809a9c485"
+        "sha256": "ec93467aada7c720f48874e6f24a5fb57bb77e8f5e01a450a29bc363b81f7b9a"
       },
       {
         "path": "src/bin.ts",
@@ -93,17 +93,17 @@
       },
       {
         "path": "src/cli.ts",
-        "sha256": "b4f400b3e08cb7bb6326f973ca09c87411dd942ae9c8cdcd9d2d27dc562dac1f"
+        "sha256": "a31c2567ee0817e7a01eb034ac4ae8e9c44e18edea85ef722af2d32b4a2dabc4"
       },
       {
         "path": "src/core-compat.ts",
-        "sha256": "5fef10b3d968d299eb7463157e8b164413872f7cc8bf5e9ca1c605e63569a9f7"
+        "sha256": "b6e2b8d73bb492afec8717f39ecfe3638c62b2f1d2479a9be43c493adebf89d6"
       },
       {
         "path": "src/index.ts",
-        "sha256": "76c2dc1598e72d11df59319cc64fb2aa39b8c3af4eb3077f66598f4f2a3323c0"
+        "sha256": "d4258f3b183d03047aa07399ae96bdb2b3af83f0005127a24a39f8932982bf78"
       }
     ]
   },
-  "signature": "6slAUaHVCFomW71+HoDnzbfXrn7eVpZJO/7YI3eqt3cZN1KwhrUZ6gzZC0KVtbNuqZytp+Z+wgS2pTjFVbASAA=="
+  "signature": "VkraAQ/N624hP58XICkV/5LZKWo+DyLBBOFC5Yf7ySORtJ/y/+8RL6XKoyhQhngq6xm/KJgxMtnNwnQ9kvzCDw=="
 }

package/README.md

@@ -1223,7 +1223,12 @@ release STOPPED, exit 1, best-effort `gh issue create` (no `gh`/network ⇒ loud
 note: the issue body embeds first lines of failing output — pass `--no-issue` on public repos when
 test/audit output may carry paths or environment details) → on
 green: re-sign reminder (`dz sign …` — the publish signature gate is refuse-unsigned), then the ready
-`dz publish` command printed **without** `--yes`: live publish stays your explicit act. **When to use:**
+`dz publish` command printed **without** `--yes`: live publish stays your explicit act. The signature
+gate verifies the **artifact** — it packs each package and checks the tarball, not the working tree,
+because the two differ by construction (npm synthesises a `LICENSE`, the packer rewrites
+`package.json`). If the artifact cannot be packed at all, the gate **blocks and says so** rather than
+falling back to the tree: with no artifact, nothing was compared, and a pass would be a claim about
+an object that was never built. **When to use:**
 before a multi-package npm release, or whenever a broken dist/bin must be impossible to ship; keep plain
 `dz publish` for routine pushes. `dz publish` itself is byte-identical whether or not release exists.
 
@@ -4051,6 +4056,14 @@ npx @dzhechkov/p-replicator init
 
 ## Status
 
+`v0.7.2` — **a signature-only republish.** `0.7.0` shipped through `pnpm publish` rather than
+`dz publish`, so the re-signing step was skipped and 17 of 497 files in the published core did not
+match their signed hashes — the content was correct, the manifest was ten hours stale. Nothing in
+the shipped behaviour changes between `0.7.0` and `0.7.2`; the integrity check stops reporting these
+packages as tampered. The one code change is a TEST: the compat case that asserted the workspace
+core sits exactly on `MIN_CORE` is split into an integration half and a boundary half, so a patch
+bump of core no longer reddens it and `MIN_CORE` need not claim a version the CLI does not require.
+
 `v0.7.0` — `dz recall` and `dz vector status` now say what the RUN did rather than what the config
 allows. **One breaking change for scripts:** `dz recall --semantic` exits **1** when no vector could
 serve it — the code the README already documented for the sibling "no engine" case, now applied on

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAA0B,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKtF,OAAO,EA4CL,iBAAiB,EAmBjB,KAAK,oBAAoB,EA8SzB,KAAK,YAAY,EAsClB,MAAM,yBAAyB,CAAC;AAyIjC,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjE;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAk8E9E;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA0BnF;AA0xGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQzG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,SAAkB,GAAG,iBAAiB,CAoB1G;AAwGD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,oBAA+C,EAC3G,KAAK,SAAa,GACjB,iBAAiB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAK/D;AAsiED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAElG;AA4BD,gFAAgF;AAChF,wBAAgB,qBAAqB,IAAI;IAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,MAAM,CAAA;CAAE,CAM7I;AA4gCD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAsB,EAC3B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC,CAI1B;AA8CD,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAEvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAChC,kGAAkG;IAClG,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACA,OAAO,CAAC,eAAe,CAAC,CA8D1B;AAutED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA0M5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAA0B,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKtF,OAAO,EA4CL,iBAAiB,EAmBjB,KAAK,oBAAoB,EA8SzB,KAAK,YAAY,EAsClB,MAAM,yBAAyB,CAAC;AAyIjC,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjE;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAk8E9E;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA0BnF;AAg0GD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQzG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,SAAkB,GAAG,iBAAiB,CAoB1G;AAwGD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,oBAA+C,EAC3G,KAAK,SAAa,GACjB,iBAAiB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAK/D;AAsiED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAElG;AA4BD,gFAAgF;AAChF,wBAAgB,qBAAqB,IAAI;IAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,MAAM,CAAA;CAAE,CAM7I;AAoiCD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAsB,EAC3B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC,CAI1B;AA8CD,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAEvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAChC,kGAAkG;IAClG,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACA,OAAO,CAAC,eAAe,CAAC,CA8D1B;AAutED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA0M5E"}

package/dist/cli.js

@@ -4692,23 +4692,43 @@ function cmdPublish(options, flags, cwd, write) {
             const manifestPath = join(pk.dir, MANIFEST_NAME);
             const manifestPresent = existsSync(manifestPath);
             let verifyOk = false;
+            let artifactUnavailable = false;
             if (trustRootPresent && manifestPresent) {
+                // Verify the ARTIFACT, through the SAME extraction `dz sign` uses. This used to walk the
+                // source TREE narrowed to a shipped-path list — a different object by construction, because
+                // npm synthesises a LICENSE into the pack of a package whose tree has none and pnpm rewrites
+                // package.json at pack time. So the gate named two failures that were both true about the
+                // tree and both wrong about what ships, for EVERY package, and a fail-closed gate no input
+                // can satisfy is a gate that gets routed around — it was: the 0.7.0 release went out through
+                // `pnpm publish` and skipped re-signing (ADR-001, features/publish-gate-verifies-the-tarball).
+                let cleanupGate = null;
                 try {
                     const signed = JSON.parse(readFileSync(manifestPath, 'utf8'));
-                    let shippedForGate;
+                    let extracted;
                     try {
-                        shippedForGate = npmPackedPaths(pk.dir);
+                        extracted = extractPublishTarball(pk.dir);
+                        cleanupGate = extracted.cleanup;
                     }
-                    catch {
-                        shippedForGate = undefined;
+                    catch (err) {
+                        // Cross-family review (codex `gpt-5.6-sol`, 2026-08-22): falling back to the working
+                        // TREE here fails the gate OPEN. The gate's whole claim is "what ships matches the
+                        // signature"; with no artifact, nothing was compared, and reporting a pass would be a
+                        // claim about an object that was never built. Say why, and block.
+                        write(`dz publish: could not pack ${pk.name} (${err.message.split('\n')[0]}) — the artifact was never built, so its signature was not checked`);
+                        artifactUnavailable = true;
                     }
-                    verifyOk = verifyManifest(pk.dir, signed, readFileSync(trustRoot, 'utf8'), shippedForGate).ok;
+                    verifyOk =
+                        extracted !== undefined &&
+                            verifyManifest(extracted.dir, signed, readFileSync(trustRoot, 'utf8')).ok;
                 }
                 catch {
                     verifyOk = false;
                 }
+                finally {
+                    cleanupGate?.();
+                }
             }
-            const decision = decidePublishGate({ trustRootPresent, manifestPresent, verifyOk, requireSigning });
+            const decision = decidePublishGate({ trustRootPresent, manifestPresent, verifyOk, requireSigning, artifactUnavailable });
             if (decision.action === 'block') {
                 write(`dz publish: BLOCKED ${pk.name} — ${decision.reason}`);
                 blocked++;
@@ -4738,23 +4758,34 @@ function cmdPublish(options, flags, cwd, write) {
             // Verify the OUTCOME against the trust root a CONSUMER would use — an existing key may be the
             // WRONG key, and enumerating that state is a losing game (round-1 review). The pack NAME travels
             // with the verdict so a pass about a different artifact cannot be mistaken for this one.
+            // The identity must be the one the PUBLISHER uses — the npm package name — or the check
+            // compares two vocabularies and can never agree. It did: `basename(packDir)` is `memory`
+            // where the publisher says `@dzhechkov/memory`, so every scoped package (all of them here)
+            // was refused as "a pass about another artifact", and the release routed around the gate
+            // instead. MEASURED 2026-08-22 by running `dz publish --filter memory --yes`.
             const trustRoot = resolve(cwd, TRUST_ROOT_REL);
+            const identity = packNpmName(packDir);
+            const id = identity === undefined ? {} : { pack: identity };
             if (!existsSync(trustRoot))
-                return { ok: false, trustRootPresent: false, pack: basename(packDir) };
+                return { ok: false, trustRootPresent: false, ...id };
+            // Verify the SAME OBJECT `reSign` hashed: the extracted tarball. Walking the source tree here
+            // compares a manifest built from the artifact against files npm rewrites at pack time, so it
+            // reported "does not verify — most likely the WRONG signing key" about a correctly signed pack
+            // (MEASURED 2026-08-22, `dz publish --filter memory --yes`). That message sends the operator
+            // hunting for a key problem that does not exist; the object was simply the wrong one.
+            let cleanup = null;
             try {
                 const signed = JSON.parse(readFileSync(join(packDir, MANIFEST_NAME), 'utf8'));
-                let shipped;
-                try {
-                    shipped = npmPackedPaths(packDir);
-                }
-                catch {
-                    shipped = undefined;
-                }
-                const res = verifyManifest(packDir, signed, readFileSync(trustRoot, 'utf8'), shipped);
-                return { ok: res.ok, trustRootPresent: true, pack: basename(packDir) };
+                const extracted = extractPublishTarball(packDir);
+                cleanup = extracted.cleanup;
+                const res = verifyManifest(extracted.dir, signed, readFileSync(trustRoot, 'utf8'));
+                return { ok: res.ok, trustRootPresent: true, ...id };
             }
             catch {
-                return { ok: false, trustRootPresent: true, pack: basename(packDir) };
+                return { ok: false, trustRootPresent: true, ...id };
+            }
+            finally {
+                cleanup?.();
             }
         },
         reSign: (packDir, keyPath) => {
@@ -9053,6 +9084,19 @@ function scanOneReqeRoot(featuresDir, keyMatchesDir, out, addMalformed) {
  * authority on what `files[]` ships; reimplementing its globbing would put a second, divergent answer
  * next to the real one — which is the class of defect this whole change exists to remove.
  */
+/**
+ * The npm name of a pack on disk — the identity a publisher, a registry and a consumer all use.
+ * `undefined` when it cannot be read, so an unestablished identity is never asserted as a match.
+ */
+function packNpmName(packDir) {
+    try {
+        const name = JSON.parse(readFileSync(join(packDir, 'package.json'), 'utf8')).name;
+        return typeof name === 'string' && name !== '' ? name : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function npmPackedPaths(packDir) {
     // `pnpm`, not `npm`: the PUBLISHER is `pnpm publish` (see `publishArgv`), and the two packers do not
     // agree. MEASURED 2026-08-21 on `skills-news`: `npm pack` emits a 1051-byte package.json identical
@@ -9077,6 +9121,20 @@ function npmPackedPaths(packDir) {
  */
 function extractPublishTarball(packDir) {
     const tmp = mkdtempSync(join(tmpdir(), 'dz-sign-pack-'));
+    try {
+        return extractIntoTempDir(packDir, tmp);
+    }
+    catch (err) {
+        // The caller never receives a cleanup for a throw, so the directory this function created must
+        // be removed HERE or it leaks once per failed pack (cross-family review, 2026-08-22).
+        try {
+            rmSync(tmp, { recursive: true, force: true });
+        }
+        catch { /* best-effort */ }
+        throw err;
+    }
+}
+function extractIntoTempDir(packDir, tmp) {
     const out = execFileSync('pnpm', ['pack', '--pack-destination', tmp, '--json'], {
         cwd: packDir,
         encoding: 'utf-8',