@timurproko/a1 0.2.2 → 0.2.3-dev.655

package/docs/architecture/toolchain.md

@@ -81,7 +81,7 @@ Presentation acceptance is the reader comparing `a1 pi` with pinned Pi. `node sc
 
 ## Publication
 
-One reusable workflow publishes both npm channels: `.github/workflows/publish.yml`. Pushes do not publish. Nightly development verification runs at `03:17 UTC`; `npm run develop` dispatches the development wrapper for a numbered preview. `npm run release -- patch` generates a source-bound draft GitHub Release with a Pi-style version/date heading and categorized change sections, starts `.github/workflows/release-candidate.yml` to run the complete stable suite on that source, prints the run link, waits for it, and prints the draft editing link once only after it passes. Choosing native **Publish release** on the draft is the only stable npm trigger: GitHub creates the tag at the bound source, and the `release.published` workflow calls the default-branch publisher, which derives the authorized human actor, source, Release identity, normalized body, and digest, and requires the successful candidate run for that source and version. A preview is stamped as `-dev.<merged pull-request number>` and uses npm `next` only as an internal dist-tag. New candidates pack the application and dependency-free installer once each—including committed release history plus the approved current note snapshot—and validate their exact bytes on Windows, Linux, and macOS; after the click the published note is repacked and the exact-package gates run on the final bytes. A repeated nightly verifies both immutable registry tarballs. After npm verification, publication uploads the asset and fast-forwards `master`, then App-authenticated automation proposes one exact, manually merged reopening PR storing both next `-dev` versions and the note. A failure before either package reaches npm returns the Release to draft and deletes its unconsumed tag, the only tag deletion the release-automation App may perform; after npm, the same run's failed jobs are rerun. Tags are never moved or reused. All npm publication uses provenance from the `npm-publish` environment, a preview never changes `latest`, and one global non-cancelling concurrency group serializes the final registry check.
+One reusable workflow publishes both npm channels: `.github/workflows/publish.yml`. Pushes do not publish. Nightly development verification runs at `03:17 UTC`; `npm run develop` dispatches the development wrapper for a numbered preview. `npm run release -- patch` generates a source-bound draft GitHub Release with a Pi-style version/date heading and categorized change sections, starts `.github/workflows/release-candidate.yml` to run the complete stable suite on that source, prints the run link, waits for it, and prints the draft editing link once only after it passes. Choosing native **Publish release** on the draft is the only stable npm trigger: GitHub creates the tag at the bound source, and the `release.published` workflow calls the default-branch publisher, which derives the authorized human actor, source, Release identity, normalized body, and digest, and requires the successful candidate run for that source and version. A preview is stamped as `-dev.<merged pull-request number>` and uses npm `next` only as an internal dist-tag. New candidates pack the application and dependency-free installer once each—including committed release history plus the approved current note snapshot—and validate their exact bytes on Windows, Linux, and macOS; after the click the published note is repacked and the exact-package gates run on the final bytes. A repeated nightly verifies both immutable registry tarballs. After npm verification, publication uploads the asset and fast-forwards `master`, then App-authenticated automation proposes one exact reopening PR, which documentation auto-merge re-verifies and merges after required CI, storing both next `-dev` versions and the note. A failure before either package reaches npm returns the Release to draft and deletes its unconsumed tag, the only tag deletion the release-automation App may perform; after npm, the same run's failed jobs are rerun. Tags are never moved or reused. All npm publication uses provenance from the `npm-publish` environment, a preview never changes `latest`, and one global non-cancelling concurrency group serializes the final registry check.
 
 `docs/ci-release-runbook.md` is the operational reference.
 

package/docs/ci-release-runbook.md

@@ -13,7 +13,7 @@ channel. It starts at `03:17 UTC` for nightly development verification or as a
 trusted reusable workflow: `npm run develop` dispatches `develop.yml`, the stable
 release command dispatches `release-candidate.yml` to validate the prepared source
 without publishing, and native **Publish release** on the prepared draft runs
-`finalize-release.yml`, which publishes.
+`release.yml`, which publishes.
 The maintainer never opens Actions or re-enters the version.
 
 npm trusted publishing binds authorization to the exact workflow filename of the
@@ -23,13 +23,16 @@ npmjs.com, with repository `timurproko/a1` and environment `npm-publish`:
 
 | Trusted publisher workflow | Publishes |
 | --- | --- |
-| `finalize-release.yml` | stable `latest` after native **Publish release** |
+| `release.yml` | stable `latest` after native **Publish release** |
 | `develop.yml` | numbered previews from `npm run develop` |
 | `publish.yml` | nightly `next` from its own schedule |
 
-The retired `release.yml` entry grants nothing and should be removed. No npm token is
-used: before either upload, the publish job requires npm >= 11.5.1 and completes the
-trusted-publishing token exchange for both packages. A refusal fails there, before
+Before native stable publication, both package settings must show `release.yml`, and the
+draft's bound source must contain `.github/workflows/release.yml`; reprepare any draft
+bound to an older source rather than publishing it. Both packages should list exactly
+these active caller identities; obsolete trusted-publisher entries should be removed.
+No npm token is used: before either upload, the publish job requires npm >= 11.5.1
+and completes the trusted-publishing token exchange for both packages. A refusal fails there, before
 anything is uploaded, and names the workflow and environment to register. When a
 caller's path changes, update both packages before the next publication through it.
 
@@ -82,7 +85,7 @@ effect of stable publication, not a trigger.
 | `npm run develop` | Preview package gates on Windows, Linux, and macOS; an existing numbered preview is an early successful no-op |
 | Nightly at `03:17 UTC` | One full documentation review plus the complete non-physical suite on Windows, Linux, and macOS, every night |
 | `npm run release -- ...` | Creates an editable source-bound draft (or refreshes the existing draft of that version bound to an older `develop`, regenerating its notes and removing duplicate drafts of that version), starts the complete stable suite on that source in `.github/workflows/release-candidate.yml`, prints its run link, waits, and prints the draft edit link only after validation passes |
-| Native **Publish release** on the prepared draft | GitHub creates the source-bound tag; `.github/workflows/finalize-release.yml` requires the successful candidate run, adopts the package pair it validated (replacing only the packaged release-note resource when the note was edited), proves npm trust, publishes both packages to npm `latest`, and proposes one manually merged reopening-and-note PR; a failure before npm returns the Release to draft |
+| Native **Publish release** on the prepared draft | GitHub creates the source-bound tag; `.github/workflows/release.yml` requires the successful candidate run, adopts the package pair it validated (replacing only the packaged release-note resource when the note was edited), proves npm trust, publishes both packages to npm `latest`, and proposes one reopening-and-note PR that auto-merges after required CI; a failure before npm returns the Release to draft |
 | `.github/workflows/release-tag-cleanup.yml` | When a stable Release is deleted, or on dispatch with a version (`gh workflow run release-tag-cleanup.yml -f version=X.Y.Z`): the release-automation App deletes the leftover `vX.Y.Z` tag only while no Release uses it and npm serves neither package; a published version's tag is permanent |
 | `.github/workflows/full-regression.yml` | Additional on-demand complete regression without publication authority |
 | `.github/workflows/pi-upstream-sync.yml` | Nightly at `03:23 UTC`: when npm publishes a newer Pi than the pin that no closed proposal skipped, proposes the upgrade as a draft pull request with the vendored copies that follow upstream merged, the kept copies reported with their upstream delta, the ledger, headers, inventories, public API and feature baselines, startup graph, and parity evidence regenerated, and every gate verdict (passed, failed, or blocked by conflict markers) and review item in the body; never merges and never replaces a proposal a human has continued |
@@ -166,7 +169,11 @@ succeeds. If validation finishes before auto-merge can be armed and GitHub alrea
 reports the pull request clean, the reconciler squash-merges only the validated head
 SHA. Every current and renamed-from path must be under `openspec/**`, under
 `docs/**` other than `docs/releases/**`, or exactly the root `README.md`. Release
-history always requires manual integration. Eligible pull requests must use a
+history requires manual integration except in the verified release reopening PR:
+a `chore/release-X.Y.Z-dev` PR opened by `openspec-ci[bot]` that modifies only the
+three version declarations (base `<released>-dev`, head its patch successor `-dev`,
+nothing else in the manifests) and adds exactly `docs/releases/<released>.md` equal
+to the published stable Release body. It takes the same validated squash route. Eligible pull requests must use a
 non-draft branch in this repository and target `develop`. Implementation-associated PRs and newly introduced active OpenSpec changes are held for manual integration even when their diff is documentation-only. Body edits trigger reconciliation; removing a marker cannot bypass the base/head tree check. Standalone existing-change revisions and archive moves remain eligible.
 
 The exact allowlist covers maintained OpenSpec, architecture, feature, manual,
@@ -273,7 +280,7 @@ the version. The retired `--approve` form remains a mutation-free usage error.
 2. **Edit.** When validation passes, open the printed Releases URL and edit the
    changelog. **Save draft** is optional and starts nothing.
 3. **Publish.** Choose native **Publish release**. GitHub creates the tag at the bound
-   source, and its `release.published` event starts `finalize-release.yml`. Trusted default-branch code requires the
+   source, and its `release.published` event starts `release.yml`. Trusted default-branch code requires the
    publisher to be a GitHub `User` with `write`, `maintain`, or `admin` permission,
    the Release and tag to match the bound source, both npm versions to be absent, and
    the candidate validation of that exact source and version to have succeeded. Apps,
@@ -288,8 +295,9 @@ the version. The retired `--approve` form remains a mutation-free usage error.
    uploads the asset, fast-forwards `master`, and creates or exactly reuses
    `chore/release-0.1.9-dev`. That PR's single commit changes only the application
    manifest, root lockfile, installer version, and exact `docs/releases/0.1.8.md`.
-   Let required CI pass and **merge it manually**. Automation never merges or
-   enables auto-merge.
+   Documentation auto-merge re-verifies that exact content and squash-merges it
+   once required CI passes on its current head. If any check fails it disables
+   auto-merge; then let required CI pass and **merge it manually**.
 
 Publishing before validation finishes is safe: publication fails before npm and the
 Release returns to draft. Publish the draft again once validation has succeeded.
@@ -366,7 +374,7 @@ Rules that do not bend:
 - **Draft preparation stops:** inspect the reported draft Release. Preparation may safely reuse an exact source-bound draft without overwriting edits, and reuses a running or successful validation of the same source and version. If `develop` advanced, retire the stale draft explicitly and prepare a new one from synchronized `develop`.
 - **Candidate validation fails:** do not publish the draft. Fix the failure on `develop`, retire the draft, and prepare again; the new draft binds the new source. Publishing anyway fails before npm and returns the Release to draft.
 - **Publication fails before npm:** the rollback job returns the Release to draft and deletes the unconsumed tag, so no manual tag cleanup is needed. Read the failed `Publish stable release` run, fix the cause (for example, wait for validation, undo a body edit made after publishing, rerun candidate validation when its retained package is missing or older than 30 days, or register the trusted publisher the npm preflight names), and choose **Publish release** again. If the rollback job itself failed, rerun it; never delete or move a tag by hand.
-- **Publication fails after npm:** the Release and tag stay. Rerun the failed jobs of that same run: its retained candidate and digests make the final registry check an exact-byte no-op for any package already published. Any recovered reopening PR must contain only both next `-dev` version declarations and the exact approved `docs/releases/<released>.md`; merge it by hand after CI. Never republish immutable bytes. Never repeat stable publication for a published version.
+- **Publication fails after npm:** the Release and tag stay. Rerun the failed jobs of that same run: its retained candidate and digests make the final registry check an exact-byte no-op for any package already published. Any recovered reopening PR must contain only both next `-dev` version declarations and the exact approved `docs/releases/<released>.md`; it auto-merges after CI when it verifies, otherwise merge it by hand. Never republish immutable bytes. Never repeat stable publication for a published version.
 
 ## Safe release-command validation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.2.2",
+  "version": "0.2.3-dev.655",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "privateLaunchContract": "neutral-launch-v1",
@@ -64,8 +64,8 @@
     "typecheck:bin": "tsgo -p tsconfig.bin.json"
   },
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.87.1",
-    "@earendil-works/pi-tui": "0.87.1",
+    "@earendil-works/pi-coding-agent": "0.99.2",
+    "@earendil-works/pi-tui": "0.99.2",
     "@silvia-odwyer/photon-node": "0.3.4",
     "chalk": "5.6.2",
     "cross-spawn": "7.0.6",