@rig-c/core 2.67.0 → 2.67.2

package/docs/AUTHORING.md

@@ -6972,6 +6972,21 @@ catalogue under it. An input flag that names a **directory** is a compile error
 with a remedy in it: `CE_COMPILE_JSON_READ_FAILED` says what the flag wants and
 names the one file there that reads as it (§5.1.2). It is never read as that file.
 
+**Maintainers — release workflow failures:** `PROVENANCE_SHA_MISMATCH` is a
+release-workflow refusal, not a rig-spec or `build` failure. It names both SHAs:
+the run's `GITHUB_SHA` and either the cut tag's commit resolved by the commits
+API with the full `refs/tags/` namespace in the push plan, or the checked-out
+`HEAD` in the dispatch publish job.
+A mismatched push leaves the tag cut and prints
+`gh workflow run release.yml --ref vX.Y.Z -f tag=vX.Y.Z` with the actual tag;
+neither the gate nor any publish starts. A failed commit lookup or invalid full
+SHA is `RELEASE_TAG_UNRESOLVED`. Matching pushes gate and check out the verified
+full SHA; dispatch keeps its tag/HEAD guard. Recovery requires a dispatched
+ref at the tag's commit whose `release.yml` contains the guard; an old tag whose
+workflow predates the guard cannot gain it from a newer `main`. See
+[Republishing a cut whose publish failed](https://github.com/rig-c/core/blob/main/RELEASING.md#republishing-a-cut-whose-publish-failed)
+for the recovery procedure.
+
 ### 5.1 Compile errors — before the gate
 
 A `CompileError` names the object and the field, and nothing is written. Its line

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rig-c/core",
-  "version": "2.67.0",
+  "version": "2.67.2",
   "description": "AI-authored 2D rigging and animation, verified before it is written. rigc compiles a rig spec into skeleton data in the Spine 4.3 format, gates it with named assertions held to a spine-core round trip's verdicts, and emits nothing that fails. Ships as an agent skill.",
   "type": "module",
   "bin": {