@mannyc1/ts-release 0.2.2 → 0.3.0

package/ARCHITECTURE.md

@@ -33,6 +33,12 @@ the authority for publication progress.
   coordinator and provider subjects.
 - `src/correction` binds provider-specific correction requests to exact
   prepared subjects; catalog Git installs the sole conditional correction writer.
+- `src/operation-journal` owns the provider-neutral opaque event envelope,
+  finite transition reducer, and the one S3 conditional-write protocol. It
+  does not decode provider payloads or acquire cloud credentials.
+- `src/operation-journal/aws` owns the sole production backend: one sealed
+  GitHub-OIDC/STS session and exact IAM/S3 policy and object boundary. The core
+  subpath does not load the AWS SDK.
 - `src/api` exposes the public lifecycle used by CLI, Action, and library users.
 - `src/platform` supplies Node or Bun filesystem, process, HTTP, durable-store,
   and opaque credential sinks at the host boundary.
@@ -112,6 +118,60 @@ the engine's private service tags. Credential values remain host-owned; the
 public seam carries only prepared requests, opaque grants, safe references,
 typed acquisition failures, and authorized HTTP results.
 
+The separate `operation-journal` subpath is not part of the six-operation
+release API. Its credential-agnostic core receives an exact structural S3
+boundary so the protocol can be qualified without live credentials. The
+separate `operation-journal/aws` subpath is the only admitted backend and
+closes over a directly acquired short-lived purpose-scoped session; it exposes
+no profile, ambient credential-chain, endpoint, bucket-selection, or fallback
+input. Operation identities, payloads, and retained objects have fixed
+pre-hash/pre-allocation byte bounds. The
+journal records an immutable event attempt before conditionally advancing one versioned `head.bin`; the
+head version is the only commit point. Every returned acknowledgment follows
+an exact event/head version re-read and full reachable-chain validation.
+Unacknowledged event attempts may be adopted or rebased by a fresh process only
+when one transaction and one legal reducer transition are unambiguous. Reachable
+and orphan attempts sharing a transaction ID must have the same canonical
+logical record and workflow.
+
+The authority snapshot distinguishes standard GitHub OIDC claims for the
+caller (`repository`, `ref`, `sha`, `workflow_ref`, and
+`workflow_sha`) from `job_workflow_ref` and `job_workflow_sha` for the called
+reusable workflow. The package validates canonical relationships and exact
+expected-versus-observed equality without embedding a consumer repository,
+ID, environment, subject, or caller filename. The consumer-owned activation
+contract must pin its protected caller workflow and branch; a broader release
+workflow must not possess that authority. The
+snapshot also binds the exact OIDC trust-policy digest. Ref and source SHA are
+never collapsed into one invented claim. Append records
+derive repository/run/attempt from this snapshot. The structural boundary is a
+test and host seam, not policy evidence by itself. The package-owned AWS adapter
+decodes the JWT in memory, re-observes STS caller identity, parses live bucket,
+Object Lock, ownership, and public-access configuration, canonicalizes the
+bucket, role, and OIDC trust policies, and derives every boolean and digest it
+returns. Until that adapter is released and the exact infrastructure,
+opaque-byte workflow topology, and retained-object protocol are qualified, the
+reusable workflow is a permissionless, always-failing interface only.
+
+The parsed AWS trust projection is exact `aud`, the frozen environment `sub`,
+repository and immutable repository/owner IDs, caller `workflow`, `ref`,
+`environment`, and called `job_workflow_ref`. Current AWS IAM can condition on
+those GitHub claims directly. `workflow_sha` and `job_workflow_sha` remain
+locally re-observed source evidence; the trust-policy projection does not
+pretend AWS conditions on `job_workflow_sha`.
+The frozen activation selects either the exact name-bound environment subject
+or the exact immutable owner/repository-ID-bound form; validation reconstructs
+the selected form and never falls back to the other. The same STS-admitted
+token is locally pinned to `workflow_dispatch`, a branch ref, public repository
+visibility, and a GitHub-hosted runner. OIDC fetch, every SDK send, and every
+response/body stream have a fixed 10,000 ms wall-clock deadline.
+The reusable `job_workflow_ref` itself is conditioned at an exact lowercase
+40-hex ts-release commit, and the local claim validator requires that suffix to
+equal `job_workflow_sha`. This makes the AWS boundary immutable even though AWS
+does not expose `job_workflow_sha` as a separate condition key. An activated
+job runs the package on Node 22.22.2 through an `env -i` allowlist; it does not
+inherit a caller's Node 24.14.1 process environment.
+
 ## Extension translation
 
 The kernel admits extensions only through an owner with a narrow invariant:

package/CHANGELOG.md

@@ -1,5 +1,87 @@
 # Changelog
 
+## Unreleased
+
+## 0.3.0 - 2026-09-01
+
+### Self-release hardening
+
+- Split credential-free preparation, no-upload npm OIDC certification,
+  lightweight tag creation, npm publication, and later GitHub publication
+  into five exact-SHA dispatch modes. GitHub and npm consume distinct
+  content-addressed prepared bundles
+  under separately named environments and least-privilege job permissions;
+  no default path receives publication authority.
+- Pin GitHub-hosted runner labels, third-party Actions, Node 22.22.2, Bun
+  1.3.14, and the self-release npm CLI at 11.11.0. Reauthenticate the exact
+  checkout against the current public `main` tip immediately before every
+  preparation or publication boundary, and reject ambient npm credentials.
+- After npm publication, bind the adopted tarball bytes to registry integrity,
+  the exact GitHub SLSA v1 provenance statement and run identity, and npm's
+  cryptographic signature audit. Select same-run proof for a fresh mutation
+  and authenticate the provenance-named prior run for an exact
+  `AlreadyEquivalent` response-loss recovery. Pin Sigstore 4.1.0 from the
+  audited npm archive and require the exact Fulcio workflow SAN, OIDC issuer,
+  environment-bound ID-qualified repository subject, source/workflow SHA, and
+  run-invocation certificate extensions. Preserve
+  GitHub tag, release, and asset equivalence checks inside the provider-native
+  publisher.
+- Keep every credentialed job free of nonlocal Actions by natively checking
+  out the exact current-main candidate and executing its local Action. Stage
+  GitHub assets only in a private draft; a fresh later full asset reread is the
+  sole authority for PATCH-only public promotion. Bind trusted npm children to
+  an empty private home and explicit empty mode-0600 user/global configs.
+- Move final npm certification/publication evidence out of the `id-token:
+  write` producer jobs. A dependency-free Node bootstrap validates then drops
+  the runner-injected OIDC request authority, binds the exact private report,
+  and commits one explicitly non-final handoff. A separate no-environment,
+  no-id-token job verifies that artifact and alone retains the final v2
+  receipt; missing outputs, changed attempts, and unknown writes fail closed.
+
+### Canonical operation journal
+
+- Add a provider-neutral `operation-journal` subpath with one opaque canonical
+  event envelope, one finite transition reducer, and one versioned S3
+  conditional-write protocol. Durable acknowledgments require exact retained
+  event/head re-read and full-chain validation; response loss, CAS conflict,
+  and fresh-process orphan recovery are bounded and fail closed. Every retained
+  attempt that shares a transaction ID must carry the same opaque logical
+  record and workflow, including attempts already reachable from the head.
+- Keep provider codecs and provider calls outside the journal package boundary.
+  Add the sole package-owned `operation-journal/aws` adapter: it rejects
+  ambient AWS configuration, exchanges a GitHub OIDC token directly for one
+  short-lived role session, re-observes STS/IAM/S3 authority, parses the exact
+  role/trust/bucket policies, and emits only single-part conditional S3 writes.
+  Serialized SDK requests and fakes qualify this code without claiming live
+  AWS policy or retained-object qualification. No SQLite, Git ref, Actions
+  artifact, alternate endpoint, credential chain, or fallback store is added.
+- Bind caller and called reusable-workflow OIDC refs and source SHAs as
+  distinct claims, derive event run coordinates from the observed session, and
+  include the exact OIDC trust-policy digest in authority drift checks. Pin the
+  called workflow at one immutable commit, admit one frozen name- or
+  immutable-ID-bound environment subject, and locally require hosted public
+  workflow-dispatch branch claims from the same STS-admitted token. Bound every
+  OIDC fetch, AWS SDK send, and object stream by a fixed wall-clock deadline.
+  Operation identities, payloads, retained objects, request/response
+  coordinates, and JWT bytes are independently bounded, and Actions request
+  coordinates are consumed from the environment before use. The
+  checked-in reusable workflow remains permissionless and always fails until a
+  released adapter, exact infrastructure, opaque-byte call topology, and live
+  retained-object protocol are separately qualified.
+
+### PyPI embedded-binary distributions
+
+- Reopen the repository-specific PyPI wrapper-wheel decision with four
+  deterministic `ts-release` wheels: manylinux 2.17 and macOS 13, each for
+  x64 and arm64. Every wheel embeds exactly one Bun-compiled executable and
+  exposes the `ts-release` Python console script.
+- Add an isolated manual PyPI workflow. Its build job has read-only repository
+  authority; its separate `pypi` environment job grants only `id-token: write`
+  and invokes `pypa/gh-action-pypi-publish@release/v1` over the transferred
+  four-wheel artifact set.
+- Make native self-release builds use the version-bearing Bun entrypoint and
+  require the Linux candidate executable to report the exact manifest version.
+
 ## 0.2.2 - 2026-08-14
 
 This release delivers the intended `0.2` product relative to `0.0.7` and

package/README.md

@@ -94,6 +94,25 @@ publishing is represented as an external, host-owned
 `pypa/gh-action-pypi-publish@release/v1` path; the stock coordinator neither
 exchanges its OIDC token nor claims to recover that external upload.
 
+This repository's selected self-release shape is declared in
+`apps/release-ts/pypi-release.config.json`. It deterministically embeds one
+native executable in each of these `ts-release` wheels:
+
+- `py3-none-manylinux_2_17_x86_64`
+- `py3-none-manylinux_2_17_aarch64`
+- `py3-none-macosx_13_0_x86_64`
+- `py3-none-macosx_13_0_arm64`
+
+`.github/workflows/pypi-release.yml` prepares the exact four-file set in a
+read-only build job, transfers it with GitHub Actions artifact retention, and
+gives only the separate `pypi` environment job `id-token: write`. That job has
+no checkout or arbitrary command step; it downloads the prepared wheels and
+invokes the official PyPA trusted-publishing Action. The PyPI publisher must
+be configured for owner `mannyc2`, repository `ts-release`, workflow
+`pypi-release.yml`, branch `main`, and environment `pypi` before dispatch.
+The macOS wheel tags certify the cross-compiled artifact targets; they do not
+expand the product's Linux-only execution-host claim.
+
 With the canonical GitHub origin or package repository configured, `init` can
 discover the exact owner/repository coordinate and write this explicit shape:
 
@@ -104,9 +123,70 @@ ts-release init --preset bun-npm-github
 It refuses to guess when no repository coordinate is observable and strictly
 inspects the exact generated configuration before writing it.
 
-## Automatic GitHub Actions release
-
-The default workflow is one job and one Action invocation. Copy the exact
+## Repository 0.3 self-release
+
+The checked-in `.github/workflows/release.yml` is a manual, fail-closed
+five-mode workflow. `prepare-exact-sha` has read-only repository authority
+and independently commits one GitHub-assets bundle and one npm-tarball bundle
+to the content-addressed Actions store. `certify-npm-oidc` adopts the exact npm
+bundle, proves one trusted-publisher exchange through pinned npm's dry-run, and
+proves unchanged anonymous registry state without upload, provenance, or
+publication. `create-tag` has only the separate
+`github-tag` environment and creates or reobserves the lightweight `v0.3.0`
+tag at the exact candidate; it creates no Release. `publish-npm` accepts only
+the npm bundle under the `npm` environment with `id-token: write`, then
+rereads the public registry to prove exact tarball bytes and the exact GitHub
+SLSA provenance identity. The pinned npm archive's Sigstore 4.1.0 verifier
+requires the exact Fulcio workflow SAN and GitHub OIDC issuer, then binds the
+certificate's workflow/source SHA and run-invocation extensions to the same
+candidate and provenance statement. Its repository-subject extension must be
+the ID-qualified `repo:mannyc2@126291407/ts-release@1271545637:environment:npm`
+identity issued for the protected npm environment; the historical ref-bound
+subject is rejected. Generic signature validity is insufficient.
+Only afterward, `publish-github` accepts the GitHub
+bundle plus the already-published npm bundle under the `github-release`
+environment with `contents: write`. Every boundary
+reauthenticates the checkout against the current public `main` tip immediately
+before it can adopt or mutate anything.
+
+The npm client itself is fetched from the canonical npm 11.11.0 tarball,
+checked against its fixed SHA-512 and SHA-1 registry digests, and freshly
+rematerialized before every boundary. Any nonempty `npm_config_*`, `PREFIX`,
+`DESTDIR`, token variable, project/user npmrc, or default global npmrc stops
+before repository or provider work.
+
+The exact order is preparation, no-upload npm OIDC certification, lightweight
+tag creation, npm publication and report-bound public/provenance verification,
+then GitHub publication. A fresh
+npm mutation must carry provenance for that exact workflow run attempt. If a
+prior run applied the bytes but lost its response, an exact `AlreadyEquivalent`
+retry instead authenticates the earlier canonical publishing run named by the
+public provenance; it never demands impossible same-run provenance from a
+no-op retry. Any uncertain, blocked, malformed, or differently bound Action
+report stops verification. The first
+GitHub publication invocation creates or resumes a private draft and uploads
+only missing exact assets. For a desired public Release that staging result is
+deliberately `uncertain`, not success, and the Release remains nonpublic. A
+fresh invocation with the same candidate and both exact `prepared:gha:`
+references must fully reread draft metadata and every paginated asset, download
+and hash any asset whose API digest is absent, and only then perform a
+PATCH-only public transition. Extra, duplicate, missing, or different assets
+stop that transition. On 2026-09-01, repository environments `github-tag`
+(ID `20986778371`), `npm` (ID `20985327992`), and `github-release`
+(ID `20985328229`) were observed with reviewer `mannyc2`, self-review allowed,
+admin bypass disabled, a custom deployment policy selecting exactly `main`,
+and no environment secrets or variables. Re-query those mutable facts before
+every dispatch. Repository Release immutability was also observed enabled on
+2026-09-01; re-query it before GitHub staging or promotion. The repository OIDC
+policy was observed on that date with the immutable ID-qualified subject
+`repo:mannyc2@126291407/ts-release@1271545637:environment:npm`; re-query it
+before certification or publication. That GitHub-side policy does not prove an
+npm-side trusted-publisher record. The exact npm trusted-publisher subject
+remains a separate prerequisite and is not inferred from an environment.
+
+## Automatic GitHub Actions template
+
+The reusable automatic template is one job and one Action invocation. Copy the exact
 [automatic workflow template](templates/github-actions/release.yml). It is
 manual-only and requires `candidate_sha` to equal the current commit on
 `refs/heads/main` before the job can reach checkout. Its
@@ -118,7 +198,7 @@ recovery artifact.
 
 ```yaml
 - id: release
-  uses: mannyc2/ts-release/apps/ts-release-action@v0.2.2
+  uses: mannyc2/ts-release/apps/ts-release-action@v0.3.0
   env:
     GITHUB_TOKEN: ${{ github.token }}
   with:
@@ -132,7 +212,7 @@ preparation, dispatch the same candidate with the exact emitted
 `prepared:gha:` reference; the job selects `publish`, loads and verifies the
 original bundle, and does not rebuild.
 
-`v0.2.2` is the immutable monorepo-subpath coordinate intended for this
+`v0.3.0` is the immutable monorepo-subpath coordinate intended for this
 candidate. Packaging and release certification must stop unless that tag is
 created from the exact certified result commit before consumers can see a
 README that names it. A floating Action branch is never an alternative.
@@ -262,7 +342,9 @@ The kernel translates extension requests to the owner that can enforce them:
 
 Homebrew and Scoop rendering/delivery use typed renderers and an exact paired
 Git Data subject; arbitrary whole-file catalog templating remains excluded.
-Wrapper wheels remain excluded from the prebuilt PyPI slice unless an explicit product decision reopens them. PyPI
+Generic wrapper-wheel generation remains excluded from the prebuilt PyPI
+capability. The repository-specific four-wheel `ts-release` self-release is an
+explicit product decision and is prepared by its dedicated workflow. PyPI
 support is contract-tested but has not been live-write-dogfooded in this wave.
 Custom library applications may compose full provider subjects through the
 [`provider-sdk`](https://github.com/mannyc2/ts-release/blob/main/docs/native-extensions.md)
@@ -318,6 +400,47 @@ The public operations are `inspect`, `prepare`, `observe`, `publish`,
 prepared paths. The derived graph is ephemeral; the verified prepared
 manifest and blobs are the durable cross-process boundary.
 
+The separate `@mannyc1/ts-release/operation-journal` subpath exposes the
+provider-neutral canonical envelope and one S3 CAS protocol for durable
+external-operation continuation. It stores consumer-owned opaque bytes and
+never decodes provider fields. Workflow repository/run coordinates are derived
+from the re-observed GitHub OIDC session rather than accepted from an append
+request. A host can supply one already-authenticated, exact-policy S3 boundary
+as the credential-agnostic qualification seam. The separate
+`@mannyc1/ts-release/operation-journal/aws` subpath is the only operational
+backend implementation: it accepts one sealed activation contract, rejects
+ambient AWS variables and shared files, requests GitHub OIDC directly, uses
+only the returned short-lived role session, and parses live STS, IAM, bucket,
+Object Lock, ownership, public-access, and policy responses. It accepts no
+profile, credential, endpoint, alternate bucket, or fallback-store input.
+Operation identities are bounded to 65,536 bytes, payloads to 1,048,576 bytes,
+and retained objects to 1,500,000 bytes before hashing or allocation. The AWS
+trust and activation contract require the
+reusable workflow to be called as `uses: .../operational-journal.yml@<40-hex>`;
+a branch or tag ref is not authority, and the observed `job_workflow_ref` SHA
+must equal `job_workflow_sha`. The frozen subject selects exactly one GitHub
+environment-subject form: name-bound `repo:owner/repository:environment:name`
+or immutable-ID-bound
+`repo:owner@ownerId/repository@repositoryId:environment:name`; observed IDs
+must reconstruct the latter exactly, and there is no runtime fallback between
+forms. The same STS-admitted token must also report `workflow_dispatch`, a
+branch ref, a public repository, and a GitHub-hosted runner. Every OIDC fetch,
+AWS SDK send, and retained-object stream has a fixed 10,000 ms wall-clock
+deadline in addition to single-attempt retry policy.
+
+The checked-in `operational-journal.yml` is intentionally inert: it has no
+OIDC permission, AWS coordinate, credential input, checkout, or executable
+adapter and always stops. Activating it requires the separately provisioned
+bucket/role, a released adapter version, a reviewed opaque-byte caller/callee
+transport, and qualification of the exact retained object protocol. The
+serialized SDK requests, structural boundary, and fake tests are not live AWS
+or workflow qualification.
+An activated reusable job must install the package-supported Node 22.22.2
+runtime independently of the caller and launch the adapter through an
+`env -i` allowlist containing only the exact Actions OIDC request coordinates
+and non-secret activation inputs. The caller's Node 24.14.1 runtime is below a
+transitive dependency's admitted Node 24 floor and must not run this package.
+
 ## Agent bundles and development
 
 The single tracked agent source owner is `apps/ts-release-agents`. Generated

package/SPEC.md

@@ -127,6 +127,57 @@ Read-convergence timing defaults are conservative assumed bounds until live
 post-write evidence measures them. Announcements and unsupported providers
 remain outside the retained product.
 
+The provider-neutral `operation-journal` subpath admits only
+`IntentRecorded`, `ReceiptRecorded`, zero or more `ObservationRecorded`, and
+`TerminalRecorded`, with `OutcomeUnknown` as the terminal alternative from an
+intent. Payload bytes and their codec identifier are opaque to ts-release.
+There is one storage protocol: a versioned, Object-Locked S3 namespace with
+immutable conditional event creates and conditional `head.bin` replacement.
+An acknowledgment exists only after exact retained event/head versions and the
+complete chain are re-read. Conditional conflicts, response loss, and process
+death are reconciled by bounded exact-version reads; ambiguity stops and never
+authorizes a provider resubmission. Credential acquisition, provider codecs,
+and provider calls remain host/consumer responsibilities.
+
+The release point must equal the re-observed caller `sha`. Standard OIDC claims
+identify the caller while `job_workflow_ref` and
+`job_workflow_sha` separately identify the called ts-release workflow and its
+exact source commit. The OIDC trust-policy digest is independent of the bucket
+and role-policy digests. Repository ID, run ID, and run attempt in journal
+events come only from that observed session; they are not append inputs. The
+checked-in reusable workflow is inert and always fails without OIDC permission
+until the package-owned `operation-journal/aws` adapter has been released and
+the exact infrastructure, opaque-byte workflow topology, and retained-object
+protocol have been separately qualified. Local fake and serialized-request
+tests establish implementation behavior, not live AWS certification.
+AWS trust must compare `job_workflow_ref` to the reusable workflow path at one
+lowercase 40-hex ts-release commit. The called workflow ref must end in the
+same value as `job_workflow_sha`; branch and tag refs are rejected before STS.
+
+The library embeds no consumer repository, immutable ID, environment, subject,
+or caller-workflow name. An activation contract supplies those exact expected
+values and the adapter re-observes them. Its parsed trust projection must bind
+`aud`, the frozen environment `sub`, repository/IDs, caller `workflow`, `ref`,
+`environment`, and `job_workflow_ref`. Workflow source SHAs remain separately
+re-observed evidence and are not misrepresented as AWS trust-condition keys.
+The activation contract freezes either the exact name-bound environment
+subject or its immutable owner/repository-ID-bound form; the adapter admits no
+fallback between those forms. After STS admits the token, local equality also
+requires `event_name=workflow_dispatch`, `ref_type=branch`,
+`repository_visibility=public`, and `runner_environment=github-hosted`.
+The adapter accepts no credential, profile, endpoint, or alternate-store input:
+it rejects ambient AWS variables and shared files, directly exchanges GitHub
+OIDC for one short-lived role session, and derives governance facts from signed
+STS/IAM/S3 responses and exact parsed policies rather than caller booleans.
+Operation identities are limited to 65,536 bytes, consumer payloads to
+1,048,576 bytes, and every retained object to 1,500,000 bytes; declared and
+streamed lengths are both enforced before hashing or full object allocation.
+Every OIDC fetch, AWS SDK send, and response/body stream is
+bounded by one fixed 10,000 ms wall-clock deadline. The activated reusable job
+uses pinned Node 22.22.2 and an
+`env -i` allowlist. Node 24.14.1 is not in this package's engine because the
+authoritative transitive floor begins at Node 24.15.0.
+
 ## 10. Product evidence
 
 In the source distribution, the generated capability inventory is joined

package/apps/release-ts/README.md

@@ -30,3 +30,10 @@ The preset binds trusted publication to `.github/workflows/release.yml` at
 `refs/heads/main`. Change both `workflow` and `workflowRef` when another exact
 workflow/ref is the intended host; a mismatch is rejected before OIDC request
 material is read.
+
+The repository-specific PyPI self-release is separate from that npm/GitHub
+path. `pypi-release.config.json` builds the four Linux/macOS x64/arm64 native
+wheel artifacts, and `scripts/prepare-pypi-distributions.ts` materializes the
+verified set for `.github/workflows/pypi-release.yml`. Its external publisher
+identity is the official PyPA Action bound to the `pypi` GitHub environment;
+the script prepares bytes only and never exchanges OIDC or uploads them.

package/apps/ts-release-agents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mannyc1/ts-release-agents",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "private": true,
   "type": "module",
   "scripts": {

package/apps/ts-release-agents/src/check.ts

@@ -25,6 +25,11 @@ const generatedFiles = (directory: string): string[] => readdirSync(directory, {
 const containsFiles = (directory: string): boolean => readdirSync(directory, { withFileTypes: true }).some((entry) => {
   return entry.isDirectory() ? containsFiles(join(directory, entry.name)) : true
 })
+const commandFailure = (result: ReturnType<typeof spawnSync>): string => {
+  const stderr = typeof result.stderr === "string" ? result.stderr.trim() : ""
+  const stdout = typeof result.stdout === "string" ? result.stdout.trim() : ""
+  return stderr || stdout || result.error?.message || "unknown command failure"
+}
 
 const firstPaths = buildAgents()
 const first = firstPaths.map((path) => bytes(path))
@@ -54,7 +59,7 @@ for (const path of ["SKILL.md", join("skills", "release", "SKILL.md")]) {
   if (existsSync(join(root, path))) fail(`Root canonical agent owner remains: ${path}`)
 }
 const tracked = spawnSync("git", ["ls-files", "-z"], { cwd: root, encoding: "utf8", stdio: "pipe" })
-if (tracked.status !== 0) fail(`Could not inspect tracked agent owners: ${tracked.stderr.trim() || tracked.stdout.trim()}`)
+if (tracked.status !== 0) fail(`Could not inspect tracked agent owners: ${commandFailure(tracked)}`)
 const trackedFiles = tracked.stdout.split("\0").filter((path) => path.length > 0)
 const canonicalRootOwners = trackedFiles.filter((path) =>
   path === ".codex-plugin/plugin.json" ||
@@ -95,7 +100,7 @@ try {
         stdio: "pipe"
       })
       if (validated.status !== 0) {
-        fail(`Installed Claude plugin validator failed: ${validated.stderr.trim() || validated.stdout.trim()}`)
+        fail(`Installed Claude plugin validator failed: ${commandFailure(validated)}`)
       }
     }
     providerLayouts.push(relative(disposableRoot, installation.packageRoot).replaceAll("\\", "/"))

package/apps/ts-release-agents/test/contract.test.ts

@@ -21,7 +21,7 @@ describe("agent distribution contract", () => {
       const native = provider === "codex" ? ".codex-plugin" : ".claude-plugin"
       const manifest = join(root, ".release", "agents", provider, "ts-release", native, "plugin.json")
       expect(existsSync(manifest)).toBe(true)
-      expect(JSON.parse(readFileSync(manifest, "utf8")).version).toBe("0.2.2")
+      expect(JSON.parse(readFileSync(manifest, "utf8")).version).toBe("0.3.0")
     }
   })
 
@@ -43,7 +43,7 @@ describe("agent distribution contract", () => {
           "local-archive",
           "ts-release"
         ))
-        expect(installed.version).toBe("0.2.2")
+        expect(installed.version).toBe("0.3.0")
         expect(installed.packageRoot).toBe(join(installed.providerRoot, installed.version))
         expect(existsSync(join(installed.packageRoot, provider === "codex" ? ".codex-plugin" : ".claude-plugin", "plugin.json"))).toBe(true)
         expect(existsSync(join(installed.packageRoot, "skills", "release", "SKILL.md"))).toBe(true)