@ikon85/agent-workflow-kit 0.43.0 → 0.44.0

package/scripts/portability_profile_scan.py

@@ -1,53 +0,0 @@
-#!/usr/bin/env python3
-"""portability_profile_scan.py — profile-VALUE literal scan (#1878, Welle 49
-Slice 7, extends the portability lint in test_skill_portability_lint.py).
-
-A published (generic/vendored) skill body must reference the board profile
-(`docs/agents/board-sync.md`, loaded by `board_config.py`) by KEY —
-`prMarkers.retroValues`, `headings.vorBau` — never MANDATE the literal VALUE
-a profile happens to configure (e.g. testreporter's `gefahren`/`übersprungen`,
-`Vor Bau zu klären`). A consumer whose profile configures different words
-silently fails a skill that hardcoded testreporter's wording as required —
-the same drift class `test_skill_portability_lint.py`'s CONSTANT_PATTERNS
-scan already closes for opaque board node/option ids; this closes it for the
-human-facing convention words instead.
-
-A line that also names the profile key is a reference, not a hardcode —
-exempt (mirrors CONSTANT_PATTERNS' own exempt rule). A line carrying
-`portability-lint: ok` is exempt too (deliberate doc example, e.g. a
-copy-paste-ready marker/heading example where inlining the key would corrupt
-the example).
-"""
-from __future__ import annotations
-
-import re
-
-EXEMPT = "portability-lint: ok"
-
-# (label, literal pattern, profile-key substring whose presence on the same
-# line exempts the match — a reference, not a hardcode).
-PROFILE_VALUE_PATTERNS = [
-    # prMarkers.retroValues — the two configured PR "**Retro:**"-line words.
-    # Backtick-quoted only: bare "gefahren"/"übersprungen" are ordinary German
-    # words (past participles of fahren/überspringen) outside this
-    # convention — unquoted would false-positive on normal prose (e.g. "Retro
-    # schon gefahren?").
-    ("prMarkers.retroValues literal", re.compile(r"`(?:gefahren|übersprungen)`"), "retroValues"),
-    # headings.vorBau — the configured HITL heading text. The phrase is
-    # specific enough that no quoting requirement is needed.
-    ("headings.vorBau literal", re.compile(r"Vor Bau zu klären"), "vorBau"),
-]
-
-
-def find_profile_value_literals(text: str) -> list[tuple[int, str, str]]:
-    """Return (line_no, label, line) for every hardcoded MANDATORY profile-value
-    literal, minus lines that also reference the profile key (a profile-driven
-    reference, not a hardcode) or carry the exempt marker."""
-    out = []
-    for n, line in enumerate(text.splitlines(), 1):
-        if EXEMPT in line:
-            continue
-        for label, pattern, key in PROFILE_VALUE_PATTERNS:
-            if pattern.search(line) and key not in line:
-                out.append((n, label, line.strip()))
-    return out

package/scripts/release-delta-guard.test.mjs

@@ -1,174 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtemp, readFile, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { buildKit } from './build-kit.mjs';
-import {
-  assessRelease, manifestDelta, packedPayloadManifest,
-} from './release-delta-guard.mjs';
-
-const file = (path, sha256) => ({ path, sha256 });
-const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
-
-test('fresh build manifest hashes match the actual npm package payload', async () => {
-  const tempRoot = await mkdtemp(join(tmpdir(), 'awkit-packed-manifest-test-'));
-  try {
-    const distDir = join(tempRoot, 'dist');
-    await buildKit({ repoRoot, distDir });
-    const built = JSON.parse(await readFile(join(distDir, 'agent-workflow-kit.package.json'), 'utf8'));
-    const packed = await packedPayloadManifest({ repoRoot, manifest: built });
-    assert.deepEqual(manifestDelta(built, packed), { added: [], removed: [], changed: [] });
-  } finally {
-    await rm(tempRoot, { recursive: true, force: true });
-  }
-});
-
-test('an unbumped shipped change is blocked with its concrete delta', () => {
-  const result = assessRelease({
-    baseVersion: '1.2.3', currentVersion: '1.2.3',
-    baseManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'old')] },
-    builtManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'new')] },
-    checkedManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'old')] },
-    payloadManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'new')] },
-  });
-  assert.equal(result.ok, false);
-  assert.deepEqual(result.delta.changed, ['skill.md']);
-  assert.match(result.errors.join('\n'), /skill\.md/);
-  assert.match(result.errors.join('\n'), /version remains 1\.2\.3/);
-});
-
-test('an npm runtime change outside the Consumer manifest still requires a release', () => {
-  const consumer = { kitVersion: '1.2.3', files: [file('skill.md', 'same')] };
-  const result = assessRelease({
-    baseVersion: '1.2.3',
-    currentVersion: '1.2.3',
-    baseManifest: consumer,
-    builtManifest: consumer,
-    checkedManifest: consumer,
-    payloadManifest: consumer,
-    basePackagePayload: { files: [file('src/cli.mjs', 'old')] },
-    currentPackagePayload: { files: [file('src/cli.mjs', 'new')] },
-  });
-
-  assert.equal(result.ok, false);
-  assert.deepEqual(result.delta.changed, ['src/cli.mjs']);
-  assert.equal(result.recommendedBump, 'patch');
-  assert.match(result.errors.join('\n'), /version remains 1\.2\.3/);
-});
-
-test('removing accidentally packed seed-only project stubs is a minor change', () => {
-  const consumer = { kitVersion: '1.3.0', files: [file('skill.md', 'same')] };
-  const result = assessRelease({
-    baseVersion: '1.2.3',
-    currentVersion: '1.3.0',
-    baseManifest: { ...consumer, kitVersion: '1.2.3' },
-    builtManifest: consumer,
-    checkedManifest: consumer,
-    payloadManifest: consumer,
-    basePackagePayload: {
-      files: [
-        file('src/cli.mjs', 'same'),
-        file('docs/agents/issue-tracker.md', 'filled-project-layer'),
-      ],
-    },
-    currentPackagePayload: { files: [file('src/cli.mjs', 'same')] },
-  });
-
-  assert.equal(result.ok, true);
-  assert.deepEqual(result.delta.removed, ['docs/agents/issue-tracker.md']);
-  assert.equal(result.recommendedBump, 'minor');
-});
-
-test('dead checked-manifest entries are rejected', () => {
-  const result = assessRelease({
-    baseVersion: '1.2.3', currentVersion: '1.3.0',
-    baseManifest: { kitVersion: '1.2.3', files: [] },
-    builtManifest: { kitVersion: '1.3.0', files: [] },
-    checkedManifest: { kitVersion: '1.3.0', files: [file('gone.md', 'old')] },
-    payloadManifest: { kitVersion: '1.3.0', files: [] },
-  });
-  assert.equal(result.ok, false);
-  assert.match(result.errors.join('\n'), /dead entry: gone\.md/);
-});
-
-test('a matching regenerated manifest and semantic bump pass', () => {
-  const current = { kitVersion: '1.3.0', files: [file('new.md', 'one')] };
-  const result = assessRelease({
-    baseVersion: '1.2.3', currentVersion: '1.3.0',
-    baseManifest: { kitVersion: '1.2.3', files: [] }, builtManifest: current,
-    checkedManifest: current, payloadManifest: current,
-  });
-  assert.equal(result.ok, true);
-  assert.equal(result.recommendedBump, 'minor');
-});
-
-test('shipped content rejects downgrade and malformed version transitions', () => {
-  for (const currentVersion of ['1.1.0', 'banana']) {
-    const current = { kitVersion: currentVersion, files: [file('skill.md', 'new')] };
-    const result = assessRelease({
-      baseVersion: '1.2.3', currentVersion,
-      baseManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'old')] },
-      builtManifest: current, checkedManifest: current, payloadManifest: current,
-    });
-    assert.equal(result.ok, false, currentVersion);
-    assert.match(result.errors.join('\n'), /invalid version transition: 1\.2\.3 ->/);
-  }
-});
-
-test('a bump on top of an untagged previous release is blocked', () => {
-  const current = { kitVersion: '1.3.0', files: [file('new.md', 'one')] };
-  const result = assessRelease({
-    baseVersion: '1.2.3', currentVersion: '1.3.0',
-    baseManifest: { kitVersion: '1.2.3', files: [] }, builtManifest: current,
-    checkedManifest: current, payloadManifest: current,
-    baseTag: { name: 'v1.2.3', exists: false, repoHasTags: true },
-  });
-  assert.equal(result.ok, false);
-  assert.match(result.errors.join('\n'), /1\.2\.3 is still awaiting-tag/);
-  assert.match(result.errors.join('\n'), /v1\.2\.3/);
-});
-
-test('a bump passes once the previous release carries its tag', () => {
-  const current = { kitVersion: '1.3.0', files: [file('new.md', 'one')] };
-  const result = assessRelease({
-    baseVersion: '1.2.3', currentVersion: '1.3.0',
-    baseManifest: { kitVersion: '1.2.3', files: [] }, builtManifest: current,
-    checkedManifest: current, payloadManifest: current,
-    baseTag: { name: 'v1.2.3', exists: true, repoHasTags: true },
-  });
-  assert.equal(result.ok, true);
-});
-
-test('a never-tagged repository is not blocked from its first release', () => {
-  const current = { kitVersion: '0.1.0', files: [file('new.md', 'one')] };
-  const result = assessRelease({
-    baseVersion: '0.0.0', currentVersion: '0.1.0',
-    baseManifest: { kitVersion: '0.0.0', files: [] }, builtManifest: current,
-    checkedManifest: current, payloadManifest: current,
-    baseTag: { name: 'v0.0.0', exists: false, repoHasTags: false },
-  });
-  assert.equal(result.ok, true);
-});
-
-test('an untagged base blocks nothing while the version stays put', () => {
-  const same = { kitVersion: '1.2.3', files: [file('skill.md', 'one')] };
-  const result = assessRelease({
-    baseVersion: '1.2.3', currentVersion: '1.2.3',
-    baseManifest: same, builtManifest: same, checkedManifest: same, payloadManifest: same,
-    baseTag: { name: 'v1.2.3', exists: false, repoHasTags: true },
-  });
-  assert.equal(result.ok, true);
-});
-
-test('actual npm payload drift is blocked even when checked and built manifests match', () => {
-  const scrubbed = { kitVersion: '1.2.3', files: [file('skill.md', 'scrubbed')] };
-  const result = assessRelease({
-    baseVersion: '1.2.3', currentVersion: '1.2.3',
-    baseManifest: scrubbed, builtManifest: scrubbed, checkedManifest: scrubbed,
-    payloadManifest: { kitVersion: '1.2.3', files: [file('skill.md', 'source')] },
-  });
-  assert.equal(result.ok, false);
-  assert.match(result.errors.join('\n'), /npm package payload.*changed: skill\.md/);
-});

package/scripts/release-parity.test.mjs

@@ -1,90 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { execFile } from 'node:child_process';
-import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { promisify } from 'node:util';
-import { assertReleaseParity, releaseIdentityFromTarball } from './release-parity.mjs';
-
-const exec = promisify(execFile);
-
-const identity = {
-  name: '@ikon85/agent-workflow-kit',
-  version: '1.2.3',
-  tarballIntegrity: 'sha512-example',
-  manifestSha256: 'abc123',
-};
-
-test('identical local, npm, and GitHub release identities have parity', () => {
-  assert.deepEqual(assertReleaseParity({ local: identity, npm: { ...identity }, github: { ...identity } }), identity);
-});
-
-test('a registry or GitHub content mismatch fails closed', () => {
-  assert.throws(() => assertReleaseParity({
-    local: identity,
-    npm: { ...identity, manifestSha256: 'different' },
-    github: { ...identity },
-  }), /npm manifestSha256 mismatch/);
-  assert.throws(() => assertReleaseParity({
-    local: identity,
-    npm: { ...identity },
-    github: { ...identity, tarballIntegrity: 'different' },
-  }), /github tarballIntegrity mismatch/);
-});
-
-test('a package tarball produces a deterministic content identity', async () => {
-  const root = await mkdtemp(join(tmpdir(), 'release-parity-'));
-  const packageDir = join(root, 'package');
-  const tarball = join(root, 'kit.tgz');
-  try {
-    await mkdir(packageDir);
-    await writeFile(join(packageDir, 'package.json'), '{"name":"kit","version":"2.0.0"}\n');
-    await writeFile(join(packageDir, 'agent-workflow-kit.package.json'), '{"kitVersion":"2.0.0","files":[]}\n');
-    await exec('tar', ['-czf', tarball, '-C', root, 'package']);
-    const first = await releaseIdentityFromTarball(tarball);
-    const second = await releaseIdentityFromTarball(tarball);
-    assert.equal(first.name, 'kit');
-    assert.equal(first.version, '2.0.0');
-    assert.match(first.tarballIntegrity, /^sha512-/);
-    assert.match(first.manifestSha256, /^[a-f0-9]{64}$/);
-    assert.deepEqual(first, second);
-  } finally { await rm(root, { recursive: true, force: true }); }
-});
-
-test('consumer parity proves npm↔github and matches the installed copy without re-packing', async () => {
-  const { assertConsumerReleaseParity } = await import('./release-parity.mjs');
-  const installed = { name: identity.name, version: identity.version, manifestSha256: identity.manifestSha256 };
-  assert.deepEqual(
-    assertConsumerReleaseParity({ installed, npm: { ...identity }, github: { ...identity } }),
-    identity,
-  );
-  assert.throws(() => assertConsumerReleaseParity({
-    installed, npm: { ...identity }, github: { ...identity, tarballIntegrity: 'different' },
-  }), /github tarballIntegrity mismatch/);
-  assert.throws(() => assertConsumerReleaseParity({
-    installed: { ...installed, manifestSha256: 'different' },
-    npm: { ...identity }, github: { ...identity },
-  }), /installed manifestSha256 mismatch/);
-  assert.throws(() => assertConsumerReleaseParity({
-    installed: { ...installed, version: '9.9.9' },
-    npm: { ...identity }, github: { ...identity },
-  }), /installed version mismatch/);
-});
-
-test('an installed kit directory yields a content identity without npm pack', async () => {
-  const { installedIdentityFromDir } = await import('./release-parity.mjs');
-  const root = await mkdtemp(join(tmpdir(), 'release-parity-installed-'));
-  try {
-    const manifest = JSON.stringify({ kitVersion: '1.2.3', files: [] });
-    await writeFile(join(root, 'package.json'), JSON.stringify({ name: identity.name, version: '1.2.3' }));
-    await writeFile(join(root, 'agent-workflow-kit.package.json'), manifest);
-    const installed = await installedIdentityFromDir(root);
-    assert.equal(installed.name, identity.name);
-    assert.equal(installed.version, '1.2.3');
-    assert.equal(typeof installed.manifestSha256, 'string');
-    assert.equal('tarballIntegrity' in installed, false);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});

package/scripts/release-state.test.mjs

@@ -1,360 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
-import { execFileSync } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { dirname, join } from 'node:path';
-import { tmpdir } from 'node:os';
-import { fileURLToPath } from 'node:url';
-import {
-  createCommandAdapter, DEFAULT_VISIBILITY_DELAYS_MS, githubReleaseArgs, inspectRelease,
-  isMissingRelease, npmTarballFilename, reconcileRelease,
-} from './release-state.mjs';
-
-const REPO = join(dirname(fileURLToPath(import.meta.url)), '..');
-
-const identity = {
-  name: '@ikon85/agent-workflow-kit', version: '1.2.3',
-  tarballIntegrity: 'sha512-example', manifestSha256: 'abc123',
-};
-
-function adapter({
-  npmPublished = false,
-  githubReleased = false,
-  npmIdentity = identity,
-  npmInvisibleReads = 0,
-  githubInvisibleReads = 0,
-  publishNpmError,
-  createGithubError,
-  npmReadErrorAfterPublish,
-} = {}) {
-  const events = [];
-  let npmExists = npmPublished;
-  let githubExists = githubReleased;
-  let npmReadsUntilVisible = npmInvisibleReads;
-  let githubReadsUntilVisible = githubInvisibleReads;
-  return {
-    events,
-    local: async () => ({ identity, tarball: '/tmp/kit.tgz' }),
-    npm: async () => {
-      events.push('read npm');
-      if (!npmExists) return null;
-      if (npmReadErrorAfterPublish) throw npmReadErrorAfterPublish;
-      if (npmReadsUntilVisible > 0) {
-        npmReadsUntilVisible -= 1;
-        return null;
-      }
-      return npmIdentity;
-    },
-    github: async () => {
-      events.push('read github');
-      if (!githubExists) return null;
-      if (githubReadsUntilVisible > 0) {
-        githubReadsUntilVisible -= 1;
-        return null;
-      }
-      return identity;
-    },
-    publishNpm: async () => {
-      events.push('publish npm');
-      if (publishNpmError) throw publishNpmError;
-      npmExists = true;
-    },
-    createGithub: async () => {
-      events.push('create github');
-      if (createGithubError) throw createGithubError;
-      githubExists = true;
-    },
-  };
-}
-
-function visibilityOptions(attempts, delays = [], progress = []) {
-  return {
-    visibility: {
-      delaysMs: Array.from({ length: attempts - 1 }, (_, index) => 10 * (2 ** index)),
-      sleep: async (delay) => delays.push(delay),
-      log: (message) => progress.push(message),
-    },
-  };
-}
-
-test('the default npm visibility window spans at least five minutes', () => {
-  assert.ok(
-    DEFAULT_VISIBILITY_DELAYS_MS.reduce((total, delay) => total + delay, 0) >= 300_000,
-  );
-  assert.deepEqual(DEFAULT_VISIBILITY_DELAYS_MS, [
-    1_000, 2_000, 4_000, 8_000, 16_000, 32_000, 64_000, 128_000, 256_000,
-  ]);
-});
-
-test('a fresh release publishes npm, verifies registry readback, then creates GitHub release', async () => {
-  const fixture = adapter();
-  assert.deepEqual(await reconcileRelease(fixture), { status: 'released', identity });
-  assert.deepEqual(fixture.events, [
-    'read npm', 'read github', 'publish npm', 'read npm', 'create github', 'read github',
-  ]);
-});
-
-test('npm visibility is retried with bounded backoff after a successful publish', async () => {
-  const fixture = adapter({ npmInvisibleReads: 2 });
-  const delays = [];
-  const progress = [];
-  assert.deepEqual(
-    await reconcileRelease(fixture, visibilityOptions(4, delays, progress)),
-    { status: 'released', identity },
-  );
-  assert.deepEqual(fixture.events, [
-    'read npm', 'read github', 'publish npm',
-    'read npm', 'read npm', 'read npm',
-    'create github', 'read github',
-  ]);
-  assert.deepEqual(delays, [10, 20]);
-  assert.deepEqual(progress, [
-    'npm visibility: attempt 1/4',
-    'npm visibility: attempt 2/4',
-    'npm visibility: attempt 3/4',
-    'GitHub visibility: attempt 1/4',
-  ]);
-});
-
-test('GitHub visibility is retried with bounded backoff after a successful create', async () => {
-  const fixture = adapter({ npmPublished: true, githubInvisibleReads: 2 });
-  const delays = [];
-  assert.deepEqual(
-    await reconcileRelease(fixture, visibilityOptions(4, delays)),
-    { status: 'released', identity },
-  );
-  assert.deepEqual(fixture.events, [
-    'read npm', 'read github', 'create github', 'read github', 'read github', 'read github',
-  ]);
-  assert.deepEqual(delays, [10, 20]);
-});
-
-test('permanent npm absence fails at the bound with post-publish phase evidence', async () => {
-  const fixture = adapter({ npmInvisibleReads: 4 });
-  const delays = [];
-  const progress = [];
-  await assert.rejects(
-    reconcileRelease(fixture, visibilityOptions(3, delays, progress)),
-    /npm publish succeeded but package was not visible after 3 npm read attempts/,
-  );
-  assert.deepEqual(delays, [10, 20]);
-  assert.deepEqual(progress, [
-    'npm visibility: attempt 1/3',
-    'npm visibility: attempt 2/3',
-    'npm visibility: attempt 3/3',
-  ]);
-  assert.equal(fixture.events.filter((event) => event === 'read npm').length, 4);
-  assert.ok(!fixture.events.includes('create github'));
-});
-
-test('permanent GitHub absence fails at the bound with post-create phase evidence', async () => {
-  const fixture = adapter({ npmPublished: true, githubInvisibleReads: 4 });
-  const delays = [];
-  await assert.rejects(
-    reconcileRelease(fixture, visibilityOptions(3, delays)),
-    /GitHub release creation succeeded but release was not visible after 3 GitHub read attempts/,
-  );
-  assert.deepEqual(delays, [10, 20]);
-  assert.equal(fixture.events.filter((event) => event === 'read github').length, 4);
-  assert.ok(!fixture.events.includes('publish npm'));
-});
-
-test('a rejected publish is not reported as a post-publish visibility timeout', async () => {
-  const rejected = new Error('registry rejected publish');
-  const fixture = adapter({ publishNpmError: rejected });
-  await assert.rejects(reconcileRelease(fixture, visibilityOptions(3)), (error) => error === rejected);
-  assert.deepEqual(fixture.events, ['read npm', 'read github', 'publish npm']);
-});
-
-test('a rejected GitHub create is not reported as a post-create visibility timeout', async () => {
-  const rejected = new Error('GitHub rejected release create');
-  const fixture = adapter({ npmPublished: true, createGithubError: rejected });
-  await assert.rejects(reconcileRelease(fixture, visibilityOptions(3)), (error) => error === rejected);
-  assert.deepEqual(fixture.events, ['read npm', 'read github', 'create github']);
-});
-
-test('an npm-published release resumes at GitHub without a second npm publish', async () => {
-  const fixture = adapter({ npmPublished: true });
-  await reconcileRelease(fixture);
-  assert.deepEqual(fixture.events, ['read npm', 'read github', 'create github', 'read github']);
-  assert.ok(!fixture.events.includes('publish npm'));
-});
-
-test('a rerun after eventual npm visibility never publishes the version twice', async () => {
-  const fixture = adapter({ npmInvisibleReads: 2 });
-  await reconcileRelease(fixture, visibilityOptions(4));
-  await reconcileRelease(fixture, visibilityOptions(4));
-  assert.equal(fixture.events.filter((event) => event === 'publish npm').length, 1);
-  assert.equal(fixture.events.filter((event) => event === 'create github').length, 1);
-});
-
-test('an already-published release at parity is a read-only no-op', async () => {
-  const fixture = adapter({ npmPublished: true, githubReleased: true });
-  assert.deepEqual(await reconcileRelease(fixture), { status: 'released', identity });
-  assert.deepEqual(fixture.events, ['read npm', 'read github']);
-});
-
-test('post-merge status inspection is read-only and reports the reconstructable phase', async () => {
-  const fixture = adapter({ npmPublished: true });
-  assert.deepEqual(await inspectRelease(fixture), { status: 'awaiting-github', identity });
-  assert.deepEqual(fixture.events, ['read npm', 'read github']);
-});
-
-test('the registry read bypasses the local packument cache, the local pack does not', async () => {
-  const calls = [];
-  const run = async (command, args) => {
-    calls.push({ command, args });
-    throw Object.assign(new Error('stubbed pack'), { stderr: 'stubbed pack' });
-  };
-  const probe = await createCommandAdapter({ repoRoot: REPO, run });
-  try {
-    await assert.rejects(() => probe.local());
-    await assert.rejects(() => probe.npm(identity));
-  } finally { await probe.dispose(); }
-
-  const [localPack, registryPack] = calls;
-  // A stale packument makes `npm pack <name>@<version>` answer ETARGET for a
-  // version that IS published — the status would then claim awaiting-npm and
-  // invite a second publish. The local pack must NOT reach for the registry.
-  assert.ok(registryPack.args.includes('--prefer-online'), 'registry read must bypass the cache');
-  assert.ok(registryPack.args.includes(`${identity.name}@${identity.version}`));
-  assert.ok(!localPack.args.includes('--prefer-online'), 'local pack must stay offline');
-  assert.ok(localPack.args.includes('.'));
-});
-
-test('local Claude overrides cannot change the packed release identity or enter the tarball', async () => {
-  const fixture = await mkdtemp(join(tmpdir(), 'awkit-local-overrides-'));
-  await mkdir(join(fixture, '.claude'), { recursive: true });
-  await Promise.all([
-    ['package.json', 'package.json'],
-    ['agent-workflow-kit.package.json', 'agent-workflow-kit.package.json'],
-    ['.claude/.npmignore', '.claude/.npmignore'],
-  ].map(([source, destination]) => copyFile(join(REPO, source), join(fixture, destination))));
-  await writeFile(join(fixture, '.claude/shipped.json'), '{"shipped":true}\n');
-
-  const overrides = [
-    ['.claude/settings.local.json', randomUUID()],
-    ['.claude/settings.local.json.backup', randomUUID()],
-  ];
-
-  const clean = await createCommandAdapter({ repoRoot: fixture });
-  const local = await createCommandAdapter({ repoRoot: fixture });
-  try {
-    const { identity: publishedIdentity } = await clean.local();
-    for (const [path, canary] of overrides) {
-      await writeFile(join(fixture, path), `${canary}\n`);
-    }
-
-    const { identity, tarball } = await local.local();
-    assert.deepEqual(identity, publishedIdentity);
-    assert.deepEqual(await inspectRelease({
-      local: async () => ({ identity, tarball }),
-      npm: async () => publishedIdentity,
-      github: async () => publishedIdentity,
-    }), { status: 'released', identity: publishedIdentity });
-
-    const paths = new Set(
-      execFileSync('tar', ['-tzf', tarball], { encoding: 'utf8' })
-        .trim().split('\n').map((path) => path.replace(/^package\//, '')),
-    );
-    assert.ok(paths.has('.claude/shipped.json'));
-    const contents = execFileSync('tar', ['-xOzf', tarball], {
-      encoding: 'utf8', maxBuffer: 16 * 1024 * 1024,
-    });
-    for (const [path, canary] of overrides) {
-      assert.ok(!paths.has(path), `packed local override: ${path}`);
-      assert.doesNotMatch(contents, new RegExp(canary));
-    }
-  } finally {
-    await Promise.all([clean.dispose(), local.dispose()]);
-    await rm(fixture, { recursive: true, force: true });
-  }
-});
-
-test('an unpublished npm version is reconstructable when npm reports ETARGET', () => {
-  assert.equal(isMissingRelease({
-    stderr: 'npm error code ETARGET\nnpm error notarget No matching version found',
-  }, 'npm'), true);
-});
-
-test('a mismatching npm package blocks GitHub release creation', async () => {
-  const fixture = adapter({
-    npmPublished: true,
-    npmIdentity: { ...identity, manifestSha256: 'wrong' },
-  });
-  await assert.rejects(reconcileRelease(fixture), /npm manifestSha256 mismatch/);
-  assert.ok(!fixture.events.includes('create github'));
-});
-
-test('a post-publish npm mismatch hard-stops without retrying or creating GitHub', async () => {
-  const fixture = adapter({
-    npmIdentity: { ...identity, manifestSha256: 'wrong' },
-  });
-  const delays = [];
-  const progress = [];
-  await assert.rejects(
-    reconcileRelease(fixture, visibilityOptions(4, delays, progress)),
-    /npm manifestSha256 mismatch/,
-  );
-  assert.deepEqual(delays, []);
-  assert.deepEqual(progress, ['npm visibility: attempt 1/4']);
-  assert.equal(fixture.events.filter((event) => event === 'publish npm').length, 1);
-  assert.equal(fixture.events.filter((event) => event === 'read npm').length, 2);
-  assert.ok(!fixture.events.includes('create github'));
-});
-
-test('a post-publish non-missing registry error hard-stops without retrying', async () => {
-  const registryError = new Error('registry authentication failed');
-  const fixture = adapter({ npmReadErrorAfterPublish: registryError });
-  const delays = [];
-  const progress = [];
-  await assert.rejects(
-    reconcileRelease(fixture, visibilityOptions(4, delays, progress)),
-    (error) => error === registryError,
-  );
-  assert.deepEqual(delays, []);
-  assert.deepEqual(progress, ['npm visibility: attempt 1/4']);
-  assert.equal(fixture.events.filter((event) => event === 'publish npm').length, 1);
-  assert.ok(!fixture.events.includes('create github'));
-});
-
-test('release workflow uses supported OIDC trusted publishing without a long-lived npm token', async () => {
-  const workflow = await readFile(join(REPO, '.github/workflows/release.yml'), 'utf8');
-  assert.match(workflow, /node-version:\s*22\.14/);
-  assert.match(workflow, /npm@11\.5\.1/);
-  assert.match(workflow, /id-token:\s*write/);
-  assert.match(workflow, /contents:\s*write/);
-  assert.match(workflow, /registry-url:\s*['"]https:\/\/registry\.npmjs\.org['"]/);
-  assert.match(workflow, /node scripts\/release-state\.mjs/);
-  assert.doesNotMatch(workflow, /NPM_TOKEN|NODE_AUTH_TOKEN|npm_[A-Za-z0-9]/);
-});
-
-test('the production publisher explicitly requests npm provenance', async () => {
-  const commands = [];
-  const fixture = await createCommandAdapter({
-    repoRoot: REPO,
-    run: async (command, args) => { commands.push([command, ...args]); return { stdout: '' }; },
-  });
-  try {
-    await fixture.publishNpm({ tarball: '/tmp/kit.tgz' });
-    assert.deepEqual(commands, [[
-      'npm', 'publish', '/tmp/kit.tgz', '--access', 'public', '--provenance',
-    ]]);
-  } finally { await fixture.dispose(); }
-});
-
-test('an incomplete GitHub release resumes by uploading the verified registry tarball', () => {
-  assert.deepEqual(githubReleaseArgs({
-    exists: true, tag: 'v1.2.3', tarball: '/tmp/ikon85-agent-workflow-kit-1.2.3.tgz', target: 'abc123',
-  }), [
-    'release', 'upload', 'v1.2.3', '/tmp/ikon85-agent-workflow-kit-1.2.3.tgz', '--clobber',
-  ]);
-});
-
-test('a scoped npm identity maps to the registry tarball asset name', () => {
-  assert.equal(
-    npmTarballFilename('@ikon85/agent-workflow-kit', '1.2.3'),
-    'ikon85-agent-workflow-kit-1.2.3.tgz',
-  );
-});