@dzhechkov/harness-cli 0.8.20 → 0.8.22

package/src/cli.ts

@@ -279,6 +279,8 @@ import {
   isInsideTree,
   signManifest,
   verifyManifest,
+  hashPackBytes,
+  rewriteWorkspaceSpecs,
   listPackFiles,
   listSignablePackFiles,
   assertKeyOutsideTree,
@@ -667,7 +669,7 @@ Usage:
   dz upgrade [--target <name>] [--pubkey <path>] [--require-signing]   (a TAMPERED pack aborts the upgrade)
   dz sign   --pack <dir> --key <path-outside-repo>          (Ed25519 manifest + CycloneDX SBOM for a pack)
   dz verify-pack --pack <dir> [--pubkey <path>]             (signature check; fail-closed; key from the repo, never the pack)
-  dz publish [--filter <name>] [--bump-only] [--claim-check <off|warn|error>] [--require-signing] [--provenance|--no-provenance]   (dry-run by default; pass --yes/--confirm/--no-dry-run to go live; claim-check gate default warn — surfaces README claim findings, never blocks; error fails an offending package)
+  dz publish [--filter <name>] [--bump-only] [--claim-check <off|warn|error>] [--mirror-cmd <cmd>|--no-mirror] [--require-signing] [--provenance|--no-provenance]   (dry-run by default; pass --yes/--confirm/--no-dry-run to go live; claim-check gate default warn — surfaces README claim findings, never blocks; error fails an offending package)
   dz release [--filter <name>] [--tag] [--publish] [--json] [--dry-run] [--no-issue]   (VERIFIED release: 4 HARD gates in FRONT of dz publish — full package test suites, audit >=high, node --check of every dist/bin file, bin smoke-boot via "node <bin> --help" — any red gate STOPS the release (exit 1) + best-effort gh issue; all green ⇒ re-sign reminder, then prints the ready dz publish command (or chains with --publish); never duplicates publish's own gates)
   dz parity [--target <name>] [--json]   (the honest feature×target map, COMPUTED from the capability model — which harness feature is full / manual / absent on each of the ${TARGET_NAMES.length} targets, and via which form)
   dz delivery-check --slug <slug> [--context-only] [--findings <f.json>] [--strict] [--author <model>] [--json]   (portable Step-10 Delivery Gate: prints the 4-plane review brief + artifact probes; --findings classifies a fed-back review into a fail-closed ready|blocked hand-off and writes features/<slug>/10_delivery_review.md; --strict exits 1 on blocked)
@@ -839,6 +841,8 @@ export interface CliIo {
    * without spawning anything.
    */
   readonly releaseRunner?: ReleaseExecRunner;
+  /** Post-publish mirror command seam; production uses synchronous shell execution. */
+  readonly publishMirrorRunner?: PublishMirrorRunner;
   /**
    * Test seam for `dz install`: overrides the `npm install` subprocess (production leaves
    * it unset → real `execSync`, stdio piped). A stub runner that pre-stages a fixture
@@ -858,6 +862,21 @@ export type ReleaseExecRunner = (
   opts: { readonly cwd: string; readonly timeoutMs: number },
 ) => { exitCode: number; stdout: string; stderr: string; timedOut?: boolean };
 
+export type PublishMirrorRunner = (
+  command: string,
+  options: { readonly cwd: string; readonly env: NodeJS.ProcessEnv },
+) => string;
+
+type PublishMirrorState = {
+  readonly status: 'confirmed' | 'unconfirmed' | 'skipped' | 'not-configured';
+  readonly command: string;
+  readonly commit?: string;
+  readonly receipt?: { readonly manifestUrl: string; readonly confirmedAt: string; readonly waitedMs: number };
+  readonly error?: string;
+  readonly reason?: string;
+  readonly warning?: string;
+};
+
 interface ParsedArgs {
   readonly command: string;
   readonly options: Map<string, string>;
@@ -2986,6 +3005,8 @@ function cmdStatusline(
     } else if (data.storeHealth?.verdict === 'unreadable') {
       line += ` ⛔ STORE UNREADABLE${data.storeHealth.unreadableFiles !== undefined && data.storeHealth.unreadableFiles.length > 0
         ? `: ${data.storeHealth.unreadableFiles.join(', ')}` : ''}`;
+    } else if (data.storeHealth?.verdict === 'busy') {
+      line += ' ⏳ STORE BUSY';
     } else if (data.storeHealth?.verdict === 'source-changed') {
       line += ' ⚠ store source changed';
     }
@@ -3634,13 +3655,16 @@ function learningStoreLine(
   ) + (reason ? '  [' + reason + ']' : '');
 }
 
-function inspectLearningStore(projectRoot: string): {
+function inspectLearningStore(
+  projectRoot: string,
+  countOptions?: { readonly busyTimeoutMs?: number; readonly attempts?: number },
+): {
   mark: StoreMark | undefined;
   health: StoreHealth;
   rows: ReturnType<typeof countLearningStoreRowsReadonly>;
 } {
   const mark = readStoreMark(projectRoot);
-  const rows = countLearningStoreRowsReadonly(projectRoot);
+  const rows = countLearningStoreRowsReadonly(projectRoot, countOptions);
   return { mark, rows, health: checkStoreHealth({ projectRoot, ...rows, mark }) };
 }
 
@@ -3737,7 +3761,8 @@ function refreshLearningStoreMark(
     const rows = countLearningStoreRowsReadonly(projectRoot);
     const counts = observedRows(rows);
     if (counts === undefined) {
-      writeErr(`⚠ dz store guard: ${options.reader ? 'reader observation' : 'store operation'} completed but the external mark was not updated — a store tier is unreadable`);
+      const busy = rows.lexicalRows === 'busy' || rows.vectorRows === 'busy';
+      writeErr(`⚠ dz store guard: ${options.reader ? 'reader observation' : 'store operation'} completed but the external mark was not updated — ${busy ? 'store busy; health not measured this run' : 'a store tier is unreadable'}`);
       return;
     }
     writeStoreMark(projectRoot, {
@@ -3771,7 +3796,7 @@ function allowLearningStoreWrite(
 ): boolean {
   let inspection: ReturnType<typeof inspectLearningStore>;
   try {
-    inspection = inspectLearningStore(projectRoot);
+    inspection = inspectLearningStore(projectRoot, { busyTimeoutMs: 250, attempts: 3 });
   } catch (error) {
     const health: StoreHealth = {
       verdict: 'unreadable',
@@ -3787,6 +3812,10 @@ function allowLearningStoreWrite(
     // own row had landed.
     return true;
   }
+  if (inspection.health.verdict === 'busy') {
+    writeErr(`dz store guard: NOT MEASURED — ${inspection.health.reason}`);
+    return true;
+  }
   if (inspection.health.verdict === 'source-changed') {
     const counts = observedRows(inspection.rows);
     if (counts === undefined) return false;
@@ -3826,6 +3855,7 @@ function warnLearningStoreRead(projectRoot: string, writeErr: WriteErr, command:
       for (const line of lexicalSourceLines(rows)) writeErr(line);
       return;
     }
+    if (health.verdict === 'busy') return;
     const counts = observedRows(rows);
     if (counts !== undefined && counts.lexicalRows + counts.vectorRows > 0
       && (mark === undefined || mark.lexicalLast !== counts.lexicalRows || mark.vectorLast !== counts.vectorRows
@@ -6855,7 +6885,37 @@ function cmdSbom(options: Map<string, string>, flags: Set<string>, cwd: string,
   return 0;
 }
 
-function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: string, writeOutput: Write): number {
+function mirrorCommandFromConfig(cwd: string): { command?: string; warning?: string } {
+  const configPath = join(cwd, '.dz', 'config.json');
+  if (!existsSync(configPath)) return {};
+  try {
+    const config = JSON.parse(readFileSync(configPath, 'utf8')) as { publish?: { mirrorCommand?: unknown } };
+    const command = typeof config.publish?.mirrorCommand === 'string' ? config.publish.mirrorCommand.trim() : '';
+    return command === '' ? {} : { command };
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return { warning: `.dz/config.json unreadable — ${reason}` };
+  }
+}
+
+function mirrorShellToken(value: string): string {
+  if (value === '') return "''";
+  if (!/^[A-Za-z0-9@/.,+_-]+$/.test(value)) throw new Error('published package/version list is not shell-safe');
+  return value;
+}
+
+function mirrorFailureMessage(error: unknown): string {
+  if (error instanceof Error && error.message.trim() !== '') return error.message.trim().split(/\r?\n/, 1)[0] ?? 'mirror command failed';
+  return String(error);
+}
+
+function cmdPublish(
+  options: Map<string, string>,
+  flags: Set<string>,
+  cwd: string,
+  writeOutput: Write,
+  mirrorRunner?: PublishMirrorRunner,
+): number {
   const json = flags.has('json');
   // Under --json stdout carries exactly one JSON document, so every human line — guard notes, refusals,
   // progress — goes to stderr instead of being dropped: a refusal that prints nothing is the silent
@@ -6863,9 +6923,9 @@ function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: strin
   const write: Write = json ? (line) => { process.stderr.write(`${line}\n`); } : writeOutput;
   // Reject unknown flags/options so a typo (e.g. `--dry-rum`) can NEVER be
   // silently swallowed and flip the command into live-publish mode.
-  const allowedFlags = new Set(['dry-run', 'no-dry-run', 'yes', 'confirm', 'bump-only', 'help', 'require-signing', 'provenance', 'no-provenance', 'json']);
-  const allowedOptions = new Set(['filter', 'claim-check', 'no-guard', 'sign-key']);
-  const allowedHelp = '  allowed: --dry-run (default), --yes/--confirm/--no-dry-run (go live), --bump-only, --filter <substr>, --claim-check <off|warn|error>, --no-guard "<reason>" (skip the guard pre-flight; logged)';
+  const allowedFlags = new Set(['dry-run', 'no-dry-run', 'yes', 'confirm', 'bump-only', 'help', 'require-signing', 'provenance', 'no-provenance', 'json', 'no-mirror']);
+  const allowedOptions = new Set(['filter', 'claim-check', 'no-guard', 'sign-key', 'mirror-cmd']);
+  const allowedHelp = '  allowed: --dry-run (default), --yes/--confirm/--no-dry-run (go live), --bump-only, --filter <substr>, --claim-check <off|warn|error>, --mirror-cmd <cmd>, --no-mirror, --no-guard "<reason>" (skip the guard pre-flight; logged)';
   for (const flag of flags) {
     if (!allowedFlags.has(flag)) {
       write(`dz publish: unknown option --${flag}`);
@@ -7045,7 +7105,7 @@ function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: strin
   // longer exist. Default to the same path `dz sign --init` writes, so the ordinary operator needs no
   // new flag; `--sign-key` overrides it.
   const signKey = (options.get('sign-key') ?? join(homedir(), '.dz', 'keys', 'dz.key')).trim();
-  const report = publishPackages(cwd, {
+  const publishReport = publishPackages(cwd, {
     provenance,
     dryRun,
     filter,
@@ -7125,9 +7185,82 @@ function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: strin
     },
   });
 
+  const configMirror = mirrorCommandFromConfig(cwd);
+  const configuredCommand = (options.get('mirror-cmd') ?? configMirror.command ?? '').trim();
+  const publishedVersions = publishReport.packages
+    .filter((pkg) => pkg.status === 'published')
+    .map((pkg) => `${pkg.name}@${pkg.newVersion}`);
+  const expected = publishedVersions.join(',');
+  const fullMirrorCommand = configuredCommand === ''
+    ? ''
+    : `${configuredCommand} --expect ${mirrorShellToken(expected)} --json`;
+  let mirror: PublishMirrorState;
+
+  // This exact conjunction is the Step-7/8 mutation anchor: an epilogue is eligible only after a
+  // live sweep that actually landed at least one package. Other explicit skip states are handled
+  // before command resolution so each reason remains distinguishable in text and JSON.
+  const mirrorEligible = !dryRun && publishReport.published >= 1;
+  if (bumpOnly) {
+    mirror = { status: 'skipped', command: fullMirrorCommand, reason: 'bump-only' };
+  } else if (!mirrorEligible) {
+    mirror = {
+      status: 'skipped',
+      command: fullMirrorCommand,
+      reason: dryRun ? 'dry-run' : 'published=0',
+    };
+  } else if (flags.has('no-mirror')) {
+    mirror = { status: 'skipped', command: fullMirrorCommand, reason: '--no-mirror' };
+  } else if (configMirror.warning !== undefined && options.get('mirror-cmd') === undefined) {
+    mirror = { status: 'not-configured', command: '', warning: configMirror.warning };
+  } else if (configuredCommand === '') {
+    mirror = { status: 'not-configured', command: '' };
+  } else {
+    const runMirror: PublishMirrorRunner = mirrorRunner
+      ?? ((command, runnerOptions) => execSync(command, {
+        cwd: runnerOptions.cwd,
+        env: runnerOptions.env,
+        encoding: 'utf8',
+        stdio: 'pipe',
+      }));
+    try {
+      const stdout = runMirror(fullMirrorCommand, {
+        cwd,
+        env: { ...process.env, DZ_PUBLISHED: expected },
+      });
+      const parsed = JSON.parse(stdout) as {
+        ok?: unknown;
+        commit?: unknown;
+        receipt?: { manifestUrl?: unknown; confirmedAt?: unknown; waitedMs?: unknown };
+        error?: unknown;
+      };
+      if (parsed.ok !== true) throw new Error(typeof parsed.error === 'string' ? parsed.error : 'mirror command returned ok:false');
+      if (typeof parsed.commit !== 'string' || parsed.commit === '') throw new Error('mirror command returned no commit');
+      if (typeof parsed.receipt?.manifestUrl !== 'string'
+        || typeof parsed.receipt.confirmedAt !== 'string'
+        || typeof parsed.receipt.waitedMs !== 'number') {
+        throw new Error('mirror command returned no live-manifest receipt');
+      }
+      mirror = {
+        status: 'confirmed',
+        command: fullMirrorCommand,
+        commit: parsed.commit,
+        receipt: {
+          manifestUrl: parsed.receipt.manifestUrl,
+          confirmedAt: parsed.receipt.confirmedAt,
+          waitedMs: parsed.receipt.waitedMs,
+        },
+      };
+    } catch (error) {
+      mirror = { status: 'unconfirmed', command: fullMirrorCommand, error: mirrorFailureMessage(error) };
+    }
+  }
+
+  const report = { ...publishReport, mirror };
+  const exitCode = report.errors > 0 ? 1 : mirror.status === 'unconfirmed' ? 3 : 0;
+
   if (json) {
     writeOutput(JSON.stringify(report));
-    return report.errors > 0 ? 1 : 0;
+    return exitCode;
   }
 
   write(`\ndz publish${dryRun ? ' --dry-run' : ''}${bumpOnly ? ' --bump-only' : ''}${claimCheckOpt !== 'warn' ? ` --claim-check ${claimCheckOpt}` : ''}`);
@@ -7177,7 +7310,21 @@ function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: strin
       for (const item of pkg.notVerified) write(`         · ${item}`);
     }
   }
-  return report.errors > 0 ? 1 : 0;
+  for (const warning of report.warnings ?? []) write(`  ⚠ warning: ${warning}`);
+  for (const path of report.releaseLineSynced ?? []) write(`  ↳ release line synced: ${path}`);
+  if (mirror.status === 'confirmed') {
+    write(`  ✓ mirror: confirmed — ${mirror.commit} (${mirror.receipt?.manifestUrl})`);
+  } else if (mirror.status === 'not-configured') {
+    if (mirror.warning !== undefined) write(`  ⚠ mirror: ${mirror.warning}`);
+    else write('  ℹ mirror: not configured');
+  } else if (mirror.status === 'skipped') {
+    write(`  ℹ mirror: skipped (${mirror.reason})`);
+  } else {
+    write(`  ✗ mirror: unconfirmed — ${mirror.error}`);
+    const rerun = mirror.command || 'configure publish.mirrorCommand, then run it';
+    write(`dz publish: published, mirror NOT confirmed — ${mirror.error}; re-run: ${rerun}`);
+  }
+  return exitCode;
 }
 
 /* ------------------------------------------------------------------ */
@@ -9635,21 +9782,52 @@ function gatherGuardFacts(op: string, root: string, text: string | undefined, st
     // a resolvable workspace dep becomes its real semver (safe → the rule passes); an UNRESOLVABLE one (points at
     // no workspace package, or not a pnpm workspace) stays `workspace:*` so the rule catches a dep that WOULD ship
     // raw. That is the genuinely dangerous case the rule exists for.
-    type Manifest = { name?: string; version?: string; private?: boolean; license?: string; licenseHold?: unknown; dependencies?: Record<string, string>; devDependencies?: Record<string, string> };
+    type Manifest = { name?: string; version?: string; private?: boolean; license?: string; licenseHold?: unknown; dependencies?: Record<string, string>; devDependencies?: Record<string, string>; peerDependencies?: Record<string, string>; optionalDependencies?: Record<string, string> };
     const manifests: Manifest[] = [];
-    const located: { dir: string; m: Manifest }[] = [];
+    const located: { dir: string; m: Manifest; text: string }[] = [];
     try {
       const out = volumeGitText(root, ['ls-files', 'packages/@dzhechkov/*/package.json']);
       for (const rel of out.split('\n').map((s) => s.trim()).filter(Boolean)) {
         try {
-          const m = JSON.parse(readFileSync(join(root, rel), 'utf8')) as Manifest;
+          const packageJsonText = readFileSync(join(root, rel), 'utf8');
+          const m = JSON.parse(packageJsonText) as Manifest;
           manifests.push(m);
-          located.push({ dir: rel.replace(/\/package\.json$/, ''), m });
+          located.push({ dir: rel.replace(/\/package\.json$/, ''), m, text: packageJsonText });
         } catch { /* skip unreadable */ }
       }
     } catch { /* not a git repo */ }
     const versionByName = new Map<string, string>();
     for (const m of manifests) if (m.name && typeof m.version === 'string') versionByName.set(m.name, m.version);
+    // release-line-in-sync: filesystem access belongs in the CLI gatherer. The core evaluator receives
+    // only immutable evidence, so evaluateGuard(facts) stays deterministic and independent of cwd.
+    const coreManifestPath = join(root, 'packages', '@dzhechkov', 'harness-core', 'package.json');
+    const cliManifestPath = join(root, 'packages', '@dzhechkov', 'harness-cli', 'package.json');
+    if (existsSync(coreManifestPath) || existsSync(cliManifestPath)) {
+      const readText = (path: string): string | null => {
+        try { return readFileSync(path, 'utf8'); } catch { return null; }
+      };
+      const readVersion = (path: string): string | null => {
+        const raw = readText(path);
+        if (raw === null) return null;
+        try {
+          const parsed = JSON.parse(raw) as { version?: unknown };
+          return typeof parsed.version === 'string' && /^\d+\.\d+\.\d+$/.test(parsed.version)
+            ? parsed.version
+            : null;
+        } catch { return null; }
+      };
+      facts['releaseLines'] = {
+        coreVersion: readVersion(coreManifestPath),
+        cliVersion: readVersion(cliManifestPath),
+        readmes: [
+          { path: 'README.md', text: readText(join(root, 'README.md')) },
+          {
+            path: 'packages/@dzhechkov/harness-cli/README.md',
+            text: readText(join(root, 'packages', '@dzhechkov', 'harness-cli', 'README.md')),
+          },
+        ],
+      };
+    }
     publishPackageRoots.push(...located
       .filter(({ dir, m }) => m.private !== true && (
         publishFilter === undefined
@@ -9811,22 +9989,136 @@ function gatherGuardFacts(op: string, root: string, text: string | undefined, st
       }
     } catch { /* нечитаемо — правило молчит */ }
     facts['counts'] = gatherReadmeCounts(root);
-    // readme-first: from the WORKING-TREE diff (publishes happen pre-commit here), per package: does the
-    // change set contain its package.json (the version-bump signal) without its README.md?
+    // One package-scoped WORKING-TREE diff feeds both readme-first and signature-fresh. A second
+    // porcelain call could observe a different tree and let the two publish guards disagree.
+    let changedPackageFiles: string[] | undefined;
+    // readme-first: from the WORKING-TREE diff (publishes happen pre-commit here), per package: did
+    // the version FIELD change from HEAD without its README.md changing? A package.json edit alone
+    // says nothing about version; repository/metadata-only edits must not manufacture a bump.
     try {
-      const status = execSync('git status --porcelain -- "packages/@dzhechkov/"', { cwd: root, encoding: 'utf-8' });
-      const perPack = new Map<string, { pkgJson: boolean; readme: boolean }>();
-      for (const line of status.split('\n')) {
-        const m = line.match(/packages\/@dzhechkov\/([^/]+)\/(.+)$/);
+      const status = execSync('git status --porcelain -uall -- "packages/@dzhechkov/"', { cwd: root, encoding: 'utf-8' });
+      changedPackageFiles = status
+        .split('\n')
+        .map((line) => line.slice(3).trim())
+        .map((path) => (path.includes(' -> ') ? path.split(' -> ')[1]!.trim() : path))
+        .filter(Boolean);
+      const perPack = new Map<string, { readme: boolean }>();
+      for (const rel of changedPackageFiles) {
+        const m = rel.match(/^packages\/@dzhechkov\/([^/]+)\/(.+)$/);
         if (!m || !m[1] || !m[2]) continue;
-        const e = perPack.get(m[1]) ?? { pkgJson: false, readme: false };
-        if (m[2] === 'package.json') e.pkgJson = true;
+        const e = perPack.get(m[1]) ?? { readme: false };
         if (m[2] === 'README.md') e.readme = true;
         perPack.set(m[1], e);
       }
-      facts['readmeFirst'] = [...perPack.entries()].map(([name, e]) => ({ name: '@dzhechkov/' + name, versionBumped: e.pkgJson, readmeChanged: e.readme }));
+      const readVersion = (raw: string): string => {
+        const version = (JSON.parse(raw) as { version?: unknown }).version;
+        if (typeof version !== 'string') throw new Error('package version is unreadable');
+        return version;
+      };
+      facts['readmeFirst'] = [...perPack.entries()].map(([name, e]) => {
+        const packagePath = `packages/@dzhechkov/${name}/package.json`;
+        let versionBumped = false;
+        let versionUnknown = false;
+        try {
+          const treeVersion = readVersion(readFileSync(join(root, packagePath), 'utf8'));
+          try {
+            const headVersion = readVersion(execFileSync('git', ['show', `HEAD:${packagePath}`], {
+              cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+            }));
+            versionBumped = treeVersion !== headVersion;
+          } catch {
+            try {
+              const trackedAtHead = execFileSync('git', ['ls-tree', '--name-only', 'HEAD', '--', packagePath], {
+                cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+              }).trim() === packagePath;
+              if (trackedAtHead) versionUnknown = true;
+              else versionBumped = true;
+            } catch {
+              versionUnknown = true;
+            }
+          }
+        } catch {
+          versionUnknown = true;
+        }
+        return {
+          name: '@dzhechkov/' + name,
+          versionBumped,
+          readmeChanged: e.readme,
+          ...(versionUnknown ? { versionUnknown: true } : {}),
+        };
+      });
     } catch { /* not a git repo — rule skips */ }
 
+    // signature-fresh: verify only signed packs whose non-signature files changed in the same
+    // porcelain listing above. Manifest/SBOM churn is the remedy, not another reason to verify.
+    // The trust key and every byte read here stay in the CLI; the guard core receives facts only.
+    const trustRootPath = join(root, TRUST_ROOT_REL);
+    if (changedPackageFiles !== undefined && existsSync(trustRootPath)) {
+      try {
+        const trustRootPem = readFileSync(trustRootPath, 'utf8');
+        const signedPacks: {
+          name: string;
+          dir: string;
+          changed: boolean;
+          ok: boolean | null;
+          failures: string[];
+          note?: string;
+        }[] = [];
+        for (const { dir, m, text: packageJsonText } of located) {
+          const manifestPath = join(root, dir, MANIFEST_NAME);
+          if (!existsSync(manifestPath)) continue;
+          const prefix = dir + '/';
+          const changedPackFiles = new Set(changedPackageFiles
+            .filter((rel) => rel.startsWith(prefix))
+            .map((rel) => rel.slice(prefix.length))
+            .filter((packRel) => packRel !== MANIFEST_NAME && packRel !== SBOM_NAME));
+          const changed = changedPackFiles.size > 0;
+          let ok: boolean | null = null;
+          let failures: string[] = [];
+          let note: string | undefined;
+          if (changed) {
+            try {
+              const signed = JSON.parse(readFileSync(manifestPath, 'utf8')) as {
+                manifest?: { files?: readonly { path?: unknown; sha256?: unknown }[] };
+              };
+              const verified = verifyManifest(join(root, dir), signed as never, trustRootPem);
+              // A source checkout contains dev files outside package.json#files. They are absent
+              // from the tarball by design, so an unchanged "present but not signed" source file
+              // is not evidence about signature freshness. A changed/new unsigned file stays loud.
+              const relevantFailures = verified.failures.filter((failure) =>
+                failure.reason !== 'present in the pack but not signed' || changedPackFiles.has(failure.path));
+              ok = verified.ok || relevantFailures.length === 0;
+              if (!ok && relevantFailures.length > 0 && relevantFailures.every(({ path }) => path === 'package.json')) {
+                const signedPackageHash = signed.manifest?.files?.find(({ path }) => path === 'package.json')?.sha256;
+                if (typeof signedPackageHash === 'string') {
+                  const rewritten = rewriteWorkspaceSpecs(packageJsonText, versionByName);
+                  // MEASURED 2026-09-10 on keysarium/skills-meta/core: pnpm also removes only
+                  // prepublishOnly from the packed scripts table. Keep that I/O-adapter concern
+                  // outside the workspace-only core helper.
+                  const packedShape = JSON.parse(rewritten) as Record<string, unknown>;
+                  const scripts = packedShape['scripts'];
+                  if (scripts !== null && typeof scripts === 'object' && !Array.isArray(scripts)) {
+                    delete (scripts as Record<string, unknown>)['prepublishOnly'];
+                  }
+                  const rewrittenHash = hashPackBytes('package.json', Buffer.from(JSON.stringify(packedShape, null, 2) + '\n'), (signed.manifest as { version?: number } | undefined)?.version);
+                  if (rewrittenHash === signedPackageHash) {
+                    ok = true;
+                    note = 'package.json matches after workspace rewrite';
+                  }
+                }
+              }
+              failures = relevantFailures.slice(0, 3).map((failure) => `${failure.path}: ${failure.reason}`);
+            } catch (error) {
+              ok = false;
+              failures = [`${MANIFEST_NAME}: ${error instanceof Error ? error.message : String(error)}`];
+            }
+          }
+          signedPacks.push({ name: m.name ?? dir, dir, changed, ok, failures, ...(note !== undefined ? { note } : {}) });
+        }
+        facts['signedPacks'] = signedPacks;
+      } catch { /* unreadable trust root — absence of evidence, so the rule is not established */ }
+    }
+
     // review-round: the same WORKING-TREE diff, asked a different question — does a package that
     // bumps its version and changes SOURCE bring a GRADED QE report with it? Scoped to source so a
     // docs-only republish is never blocked (ADR-001, features/publish-needs-a-review). A throw here
@@ -17958,7 +18250,10 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
   // `dz recap` — a refusal built on either list would reject working commands, which is a worse
   // failure than the one being fixed. Goes to STDERR so a `--json` consumer's stdout stays clean.
   if (command !== 'contract-check') {
-    for (const notice of unknownFlagNotice([...flags, ...options.keys()].filter((k) => !k.startsWith('_positional_')), KNOWN_CLI_FLAGS)) {
+    for (const notice of unknownFlagNotice(
+      [...flags, ...options.keys()].filter((k) => !k.startsWith('_positional_')),
+      KNOWN_CLI_FLAGS,
+    )) {
       writeErr(notice.line);
     }
   }
@@ -18115,7 +18410,7 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
       case 'auto-canonicalize':
         return await cmdAutoCanonicalize(options, cwd, write);
       case 'publish':
-        return cmdPublish(options, flags, cwd, write);
+        return cmdPublish(options, flags, cwd, write, io.publishMirrorRunner);
       case 'release':
         return cmdRelease(options, flags, cwd, write, io.releaseRunner);
       case 'parity':

package/src/known-flags.ts

@@ -324,4 +324,5 @@ export const KNOWN_CLI_FLAGS: readonly string[] = [
   'write',
   'year',
   'yes',
+  'mirror-cmd', // dz publish epilogue (mirror-push-on-publish)
 ];