@treeseed/sdk 0.6.37 → 0.6.38

package/dist/operations/services/git-workflow.js

@@ -162,7 +162,7 @@ function remoteBranchExists(repoDir, branchName) {
   }
 }
 function fetchOrigin(repoDir) {
-  runGit(["fetch", "origin"], { cwd: repoDir });
+  runGit(["fetch", "origin"], { cwd: repoDir, capture: true });
 }
 function ensureLocalBranchTracking(repoDir, branchName) {
   if (branchExists(repoDir, branchName)) {
@@ -175,7 +175,7 @@ function ensureLocalBranchTracking(repoDir, branchName) {
   runGit(["checkout", "--orphan", branchName], { cwd: repoDir });
 }
 function checkoutBranch(repoDir, branchName) {
-  runGit(["checkout", branchName], { cwd: repoDir });
+  runGit(["checkout", branchName], { cwd: repoDir, capture: true });
 }
 function checkoutTaskBranchFromStaging(cwd, branchName, { createIfMissing = true, pushIfCreated = false } = {}) {
   const repoDir = assertCleanWorktree(cwd);
@@ -244,7 +244,7 @@ function syncBranchWithOrigin(repoDir, branchName) {
     checkoutBranch(repoDir, branchName);
   }
   if (remoteBranchExists(repoDir, branchName)) {
-    runGit(["merge", "--ff-only", `origin/${branchName}`], { cwd: repoDir });
+    runGit(["merge", "--ff-only", `origin/${branchName}`], { cwd: repoDir, capture: true });
   }
 }
 function checkoutDetachedOriginBranch(repoDir, branchName) {

package/dist/operations/services/github-actions-verification.d.ts

@@ -16,6 +16,8 @@ export type GitHubActionsWorkflowGate = {
     workflow: string;
     branch: string;
     headSha: string;
+    timeoutSeconds?: number;
+    pollSeconds?: number;
 };
 export type GitHubActionsWorkflowJobStep = {
     name: string;
@@ -116,6 +118,8 @@ export declare function skippedGitHubActionsGate(gate: GitHubActionsWorkflowGate
     url: null;
     createdAt: null;
     updatedAt: null;
+    timeoutSeconds: number | null;
+    cached: boolean;
 };
 export declare function formatGitHubActionsGateFailure(gate: GitHubActionsWorkflowGate, result: Record<string, unknown>): string;
 export declare function createGitHubActionsGateProgressReporter(gate: GitHubActionsWorkflowGate, options?: {

package/dist/operations/services/github-actions-verification.js

@@ -408,7 +408,9 @@ function skippedGitHubActionsGate(gate, reason) {
     runId: null,
     url: null,
     createdAt: null,
-    updatedAt: null
+    updatedAt: null,
+    timeoutSeconds: gate.timeoutSeconds ?? null,
+    cached: false
   };
 }
 function formatGitHubActionsGateFailure(gate, result) {
@@ -537,8 +539,8 @@ async function waitForGitHubActionsGate(gate, options = {}) {
     workflow: gate.workflow,
     headSha: gate.headSha,
     branch: gate.branch,
-    timeoutSeconds: options.timeoutSeconds,
-    pollSeconds: options.pollSeconds,
+    timeoutSeconds: gate.timeoutSeconds ?? options.timeoutSeconds,
+    pollSeconds: gate.pollSeconds ?? options.pollSeconds,
     onProgress: reportProgress
   });
 }

package/dist/operations/services/release-history.d.ts

@@ -0,0 +1,59 @@
+export type ReleaseHistoryCommit = {
+    sha: string;
+    subject: string;
+    body: string;
+};
+export type ReleaseHistorySection = 'Added' | 'Changed' | 'Fixed' | 'Infrastructure' | 'Tests' | 'Dependencies';
+export type ReleaseHistorySummary = {
+    version: string;
+    date: string;
+    sourceRef: string;
+    targetRef: string;
+    commitCount: number;
+    sections: Record<ReleaseHistorySection, string[]>;
+    notableCommits: ReleaseHistoryCommit[];
+    changelogPath: string;
+    changelogUpdated: boolean;
+    entry: string;
+};
+export declare function collectReleaseHistoryCommits(repoDir: string, sourceRef: string, targetRef: string, options?: {
+    maxCommits?: number;
+}): ReleaseHistoryCommit[];
+export declare function renderReleaseChangelogEntry(input: {
+    version: string;
+    date?: string;
+    commits: ReleaseHistoryCommit[];
+    extraBullets?: Partial<Record<ReleaseHistorySection, string[]>>;
+}): {
+    date: string;
+    sections: Record<ReleaseHistorySection, string[]>;
+    entry: string;
+};
+export declare function upsertReleaseChangelog(repoDir: string, input: {
+    version: string;
+    sourceRef: string;
+    targetRef: string;
+    commits: ReleaseHistoryCommit[];
+    extraBullets?: Partial<Record<ReleaseHistorySection, string[]>>;
+}): {
+    version: string;
+    date: string;
+    sourceRef: string;
+    targetRef: string;
+    commitCount: number;
+    sections: Record<ReleaseHistorySection, string[]>;
+    notableCommits: ReleaseHistoryCommit[];
+    changelogPath: string;
+    changelogUpdated: boolean;
+    entry: string;
+};
+export declare function renderAdministrativeCommitMessage(input: {
+    subject: string;
+    version?: string | null;
+    tagName?: string | null;
+    sourceRef: string;
+    targetRef: string;
+    commits: ReleaseHistoryCommit[];
+    changelog?: ReleaseHistorySummary | null;
+    extraLines?: string[];
+}): string;

package/dist/operations/services/release-history.js

@@ -0,0 +1,159 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+const SECTION_ORDER = [
+  "Added",
+  "Changed",
+  "Fixed",
+  "Infrastructure",
+  "Tests",
+  "Dependencies"
+];
+function runGit(repoDir, args) {
+  const result = spawnSync("git", args, {
+    cwd: repoDir,
+    stdio: "pipe",
+    encoding: "utf8"
+  });
+  if (result.status !== 0) {
+    throw new Error(result.stderr?.trim() || result.stdout?.trim() || `git ${args.join(" ")} failed`);
+  }
+  return result.stdout;
+}
+function shortSha(value) {
+  return value.slice(0, 12);
+}
+function cleanLine(value) {
+  return value.replace(/\s+/gu, " ").trim();
+}
+function bulletText(commit) {
+  const subject = cleanLine(commit.subject);
+  return subject ? `${subject} (${shortSha(commit.sha)})` : shortSha(commit.sha);
+}
+function sectionForCommit(commit) {
+  const value = `${commit.subject}
+${commit.body}`.toLowerCase();
+  if (/^(feat|add)(\(|:)/u.test(value) || /\badded?\b/u.test(value)) return "Added";
+  if (/^(fix|hotfix)(\(|:)/u.test(value) || /\bfix(e[ds])?\b|\bbug\b/u.test(value)) return "Fixed";
+  if (/^(test)(\(|:)/u.test(value) || /\btest(s|ing)?\b|\bverify\b/u.test(value)) return "Tests";
+  if (/^(deps?|build)(\(|:)/u.test(value) || /\bdependenc(y|ies)\b|\blockfile\b|\bpackage pointer\b/u.test(value)) return "Dependencies";
+  if (/^(ci|chore|release)(\(|:)/u.test(value) || /\bdeploy\b|\bworkflow\b|\brelease\b|\bsubmodule\b/u.test(value)) return "Infrastructure";
+  return "Changed";
+}
+function uniqueSectionBullets(commits) {
+  const sections = Object.fromEntries(SECTION_ORDER.map((section) => [section, []]));
+  const seen = /* @__PURE__ */ new Set();
+  for (const commit of commits) {
+    const bullet = bulletText(commit);
+    const key = bullet.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    sections[sectionForCommit(commit)].push(bullet);
+  }
+  return sections;
+}
+function collectReleaseHistoryCommits(repoDir, sourceRef, targetRef, options = {}) {
+  const maxCommits = options.maxCommits ?? 80;
+  const output = runGit(repoDir, [
+    "log",
+    "--no-merges",
+    `--max-count=${maxCommits}`,
+    "--format=%H%x1f%s%x1f%b%x1e",
+    `${sourceRef}..${targetRef}`
+  ]);
+  return output.split("").map((entry) => entry.trim()).filter(Boolean).map((entry) => {
+    const [sha = "", subject = "", body = ""] = entry.split("");
+    return { sha: sha.trim(), subject: subject.trim(), body: body.trim() };
+  }).filter((commit) => commit.sha.length > 0);
+}
+function renderReleaseChangelogEntry(input) {
+  const date = input.date ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const sections = uniqueSectionBullets(input.commits);
+  for (const [section, bullets] of Object.entries(input.extraBullets ?? {})) {
+    for (const bullet of bullets ?? []) {
+      const normalized = cleanLine(bullet);
+      if (normalized) sections[section].push(normalized);
+    }
+  }
+  const lines = [`## [${input.version}] - ${date}`, ""];
+  let wroteSection = false;
+  for (const section of SECTION_ORDER) {
+    const bullets = sections[section];
+    if (bullets.length === 0) continue;
+    wroteSection = true;
+    lines.push(`### ${section}`, "");
+    for (const bullet of bullets.slice(0, 20)) {
+      lines.push(`- ${bullet}`);
+    }
+    if (bullets.length > 20) {
+      lines.push(`- ${bullets.length - 20} additional change${bullets.length - 20 === 1 ? "" : "s"} omitted from this summary.`);
+    }
+    lines.push("");
+  }
+  if (!wroteSection) {
+    lines.push("### Changed", "", "- Release metadata and deployment history updated.", "");
+  }
+  return {
+    date,
+    sections,
+    entry: lines.join("\n").trimEnd()
+  };
+}
+function upsertReleaseChangelog(repoDir, input) {
+  const rendered = renderReleaseChangelogEntry(input);
+  const changelogPath = resolve(repoDir, "CHANGELOG.md");
+  const current = existsSync(changelogPath) ? readFileSync(changelogPath, "utf8") : "";
+  const title = "# Changelog";
+  const withoutExisting = current.replace(new RegExp(`^# Changelog\\s*\\n+## \\[${input.version.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}\\][\\s\\S]*?(?=\\n## \\[|$)`, "u"), `${title}
+
+`).trim();
+  const body = withoutExisting.startsWith(title) ? withoutExisting.slice(title.length).trim() : withoutExisting.trim();
+  const next = `${title}
+
+${rendered.entry}${body ? `
+
+${body}` : ""}
+`;
+  const changed = current !== next;
+  if (changed) {
+    writeFileSync(changelogPath, next, "utf8");
+  }
+  return {
+    version: input.version,
+    date: rendered.date,
+    sourceRef: input.sourceRef,
+    targetRef: input.targetRef,
+    commitCount: input.commits.length,
+    sections: rendered.sections,
+    notableCommits: input.commits.slice(0, 12),
+    changelogPath,
+    changelogUpdated: changed,
+    entry: rendered.entry
+  };
+}
+function renderAdministrativeCommitMessage(input) {
+  const lines = [
+    input.subject,
+    "",
+    "Release summary:",
+    input.version ? `- Version: ${input.version}` : null,
+    input.tagName ? `- Tag: ${input.tagName}` : null,
+    `- Source: ${input.sourceRef}`,
+    `- Target: ${input.targetRef}`,
+    `- Promoted commits: ${input.commits.length}`,
+    ...(input.extraLines ?? []).map((line) => `- ${line}`),
+    "",
+    "Notable changes:",
+    ...input.commits.length > 0 ? input.commits.slice(0, 12).map((commit) => `- ${bulletText(commit)}`) : ["- Release metadata and package pointers updated."],
+    input.commits.length > 12 ? `- ${input.commits.length - 12} additional promoted commit${input.commits.length - 12 === 1 ? "" : "s"} omitted from this summary.` : null,
+    input.changelog ? "" : null,
+    input.changelog ? "See CHANGELOG.md for the release history entry." : null
+  ].filter((line) => line !== null);
+  return lines.join("\n");
+}
+export {
+  collectReleaseHistoryCommits,
+  renderAdministrativeCommitMessage,
+  renderReleaseChangelogEntry,
+  upsertReleaseChangelog
+};

package/dist/scripts/tenant-build.js

@@ -1,11 +1,40 @@
-import { resolveAstroBin, createProductionBuildEnv, packageScriptPath, runNodeBinary, runNodeScript } from '../operations/services/runtime-tools.js';
+import { spawnSync } from 'node:child_process';
+import { createBuildWarningSummary, formatAllowedBuildWarnings } from '../operations/services/build-warning-policy.js';
+import { resolveAstroBin, createProductionBuildEnv, packageScriptPath, runNodeScript } from '../operations/services/runtime-tools.js';
+function runFilteredNodeBinary(binPath, args, options) {
+    const result = spawnSync(process.execPath, [binPath, ...args], {
+        cwd: options.cwd,
+        env: { ...process.env, ...options.env },
+        stdio: 'pipe',
+        encoding: 'utf8',
+    });
+    const warningSummary = createBuildWarningSummary();
+    const emitFiltered = (text, stream) => {
+        for (const line of text.split(/\r?\n/u)) {
+            if (!line)
+                continue;
+            const classified = warningSummary.record(line);
+            if (classified.kind === 'allowed')
+                continue;
+            stream.write(`${line}\n`);
+        }
+    };
+    emitFiltered(result.stdout ?? '', process.stdout);
+    emitFiltered(result.stderr ?? '', process.stderr);
+    for (const line of formatAllowedBuildWarnings(warningSummary.allowedWarnings)) {
+        process.stdout.write(`${line}\n`);
+    }
+    if (result.status !== 0) {
+        process.exit(result.status ?? 1);
+    }
+}
 process.env.TREESEED_LOCAL_DEV_MODE = process.env.TREESEED_LOCAL_DEV_MODE ?? 'cloudflare';
 const publishedRuntime = process.env.TREESEED_CONTENT_SERVING_MODE === 'published_runtime';
 runNodeScript(packageScriptPath('patch-starlight-content-path'), [], { cwd: process.cwd() });
 if (!publishedRuntime) {
     runNodeScript(packageScriptPath('aggregate-book'), [], { cwd: process.cwd() });
 }
-runNodeBinary(resolveAstroBin(), ['build'], {
+runFilteredNodeBinary(resolveAstroBin(), ['build'], {
     cwd: process.cwd(),
     env: createProductionBuildEnv({
         TREESEED_LOCAL_DEV_MODE: process.env.TREESEED_LOCAL_DEV_MODE,

package/dist/workflow/operations.d.ts

@@ -44,6 +44,8 @@ type WorkflowRepoReport = {
     publishWait: Record<string, unknown> | null;
     workflowGates: Array<Record<string, unknown>>;
     backMerge: Record<string, unknown> | null;
+    changelog?: Record<string, unknown> | null;
+    adminCommitSummary?: Record<string, unknown> | null;
 };
 export declare function workflowStatus(helpers: WorkflowOperationHelpers, input?: TreeseedWorkflowStatusOptions): Promise<TreeseedWorkflowResult<import("../workflow-state.ts").TreeseedWorkflowState>>;
 export declare function workflowCi(helpers: WorkflowOperationHelpers, input?: TreeseedCiInput): Promise<TreeseedWorkflowResult<TreeseedCiResult>>;
@@ -417,6 +419,8 @@ export declare function workflowSave(helpers: WorkflowOperationHelpers, input: T
         url: null;
         createdAt: null;
         updatedAt: null;
+        timeoutSeconds: number | null;
+        cached: boolean;
     }[];
     releaseCandidate: ReleaseCandidateReport | null;
 } & {
@@ -557,6 +561,8 @@ export declare function workflowClose(helpers: WorkflowOperationHelpers, input:
             url: null;
             createdAt: null;
             updatedAt: null;
+            timeoutSeconds: number | null;
+            cached: boolean;
         }[];
         releaseCandidate: ReleaseCandidateReport | null;
     } & {
@@ -738,6 +744,8 @@ export declare function workflowStage(helpers: WorkflowOperationHelpers, input:
             url: null;
             createdAt: null;
             updatedAt: null;
+            timeoutSeconds: number | null;
+            cached: boolean;
         }[];
         releaseCandidate: ReleaseCandidateReport | null;
     } & {
@@ -874,7 +882,7 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
     publishWait: never[];
     repos: never[];
     rootRepo: WorkflowRepoReport;
-    releaseCandidate: ReleaseCandidateReport;
+    releaseCandidate: ReleaseCandidateReport | null;
     releaseBackMerge: {
         status: string;
         merged: boolean;
@@ -914,6 +922,8 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
         url: null;
         createdAt: null;
         updatedAt: null;
+        timeoutSeconds: number | null;
+        cached: boolean;
     }[];
 } & {
     finalState?: WorkflowStatePayload;
@@ -959,7 +969,7 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
     publishWait: Record<string, unknown>[];
     repos: WorkflowRepoReport[];
     rootRepo: WorkflowRepoReport;
-    releaseCandidate: ReleaseCandidateReport;
+    releaseCandidate: ReleaseCandidateReport | null;
     releaseBackMerge: {
         status: string;
         merged: boolean;
@@ -999,6 +1009,8 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
         url: null;
         createdAt: null;
         updatedAt: null;
+        timeoutSeconds: number | null;
+        cached: boolean;
     })[];
 } & {
     finalState?: WorkflowStatePayload;

package/dist/workflow/operations.js

@@ -57,7 +57,6 @@ import {
   headCommit,
   listTaskBranches,
   mergeBranchIntoTarget,
-  mergeStagingIntoMain,
   prepareReleaseBranches,
   PRODUCTION_BRANCH,
   pushBranch,
@@ -78,6 +77,11 @@ import {
 import {
   runReleaseCandidateGate
 } from "../operations/services/release-candidate.js";
+import {
+  collectReleaseHistoryCommits,
+  renderAdministrativeCommitMessage,
+  upsertReleaseChangelog
+} from "../operations/services/release-history.js";
 import { loadCliDeployConfig, packageScriptPath, resolveWranglerBin } from "../operations/services/runtime-tools.js";
 import { runTenantDeployPreflight, runWorkspaceReleasePreflight, runWorkspaceSavePreflight } from "../operations/services/save-deploy-preflight.js";
 import { collectCliPreflight } from "../operations/services/workspace-preflight.js";
@@ -402,7 +406,9 @@ async function waitForWorkflowGates(operation, gates, ciMode, options = {}) {
       ...result,
       workflow: String(result.workflow ?? gate.workflow),
       branch: String(result.branch ?? gate.branch),
-      headSha: String(result.headSha ?? gate.headSha)
+      headSha: String(result.headSha ?? gate.headSha),
+      timeoutSeconds: gate.timeoutSeconds ?? null,
+      cached: false
     };
     if (normalized.status === "completed" && normalized.conclusion !== "success") {
       workflowError(operation, "github_workflow_failed", formatGitHubActionsGateFailure(gate, normalized), {
@@ -416,13 +422,21 @@ async function waitForWorkflowGates(operation, gates, ciMode, options = {}) {
   }
   return results;
 }
+const RELEASE_DEPLOY_GATE_TIMEOUT_SECONDS = 45 * 60;
+function releaseDeployGate(gate) {
+  return {
+    ...gate,
+    timeoutSeconds: gate.timeoutSeconds ?? RELEASE_DEPLOY_GATE_TIMEOUT_SECONDS
+  };
+}
 function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGates) {
   const gates = Array.isArray(workflowGates) ? workflowGates.map((gate) => stringRecord(gate)).filter((gate) => Boolean(gate)) : [];
   const releaseRecord = stringRecord(rootRelease) ?? {};
   const reports = [];
+  const releaseTag = typeof releaseRecord.rootVersion === "string" ? releaseRecord.rootVersion : null;
   for (const target of [
     { scope: "staging", branch: STAGING_BRANCH, commit: releaseRecord.stagingCommit },
-    { scope: "prod", branch: PRODUCTION_BRANCH, commit: releaseRecord.releasedCommit }
+    { scope: "prod", branch: releaseTag ?? PRODUCTION_BRANCH, commit: releaseRecord.releasedCommit }
   ]) {
     const gate = gates.find((candidate) => candidate.workflow === "deploy.yml" && candidate.branch === target.branch && candidate.status === "completed" && candidate.conclusion === "success");
     const timestamp = typeof gate?.updatedAt === "string" && gate.updatedAt.trim() ? gate.updatedAt : null;
@@ -702,13 +716,13 @@ function remoteTagCommit(repoDir, tagName) {
   const direct = output.split("\n").find((line) => line.endsWith(`refs/tags/${tagName}`));
   return (peeled ?? direct)?.split(/\s+/u)[0] ?? null;
 }
-function ensureReleaseTag(repoDir, tagName, commitSha) {
+function ensureReleaseTag(repoDir, tagName, commitSha, message) {
   const localCommit = gitObjectCommit(repoDir, tagName);
   if (localCommit && localCommit !== commitSha) {
     throw new Error(`Release tag ${tagName} already exists locally at ${localCommit}, expected ${commitSha}.`);
   }
   if (!localCommit) {
-    run("git", ["tag", "-a", tagName, commitSha, "-m", `release: ${tagName}`], { cwd: repoDir });
+    run("git", ["tag", "-a", tagName, commitSha, "-m", message ?? `release: ${tagName}`], { cwd: repoDir });
   }
   const remoteCommit = remoteTagCommit(repoDir, tagName);
   if (remoteCommit && remoteCommit !== commitSha) {
@@ -731,6 +745,51 @@ function commitAllIfChanged(repoDir, message) {
   run("git", ["commit", "-m", message], { cwd: repoDir });
   return { committed: true, commitSha: headCommit(repoDir) };
 }
+function releaseHistoryCommits(repoDir, sourceRef = `origin/${PRODUCTION_BRANCH}`, targetRef = "HEAD") {
+  try {
+    return collectReleaseHistoryCommits(repoDir, sourceRef, targetRef);
+  } catch {
+    return [];
+  }
+}
+function versionLines(versions) {
+  return [...(versions ?? /* @__PURE__ */ new Map()).entries()].sort(([left], [right]) => left.localeCompare(right)).map(([name, version]) => `${name}: ${version}`);
+}
+function updateReleaseChangelog(repoDir, input) {
+  const sourceRef = input.sourceRef ?? `origin/${PRODUCTION_BRANCH}`;
+  const targetRef = input.targetRef ?? "HEAD";
+  const commits = input.commits ?? releaseHistoryCommits(repoDir, sourceRef, targetRef);
+  return upsertReleaseChangelog(repoDir, {
+    version: input.version,
+    sourceRef,
+    targetRef,
+    commits,
+    extraBullets: input.extraDependencyBullets?.length ? { Dependencies: input.extraDependencyBullets } : void 0
+  });
+}
+function releaseAdminMessage(input) {
+  return renderAdministrativeCommitMessage({
+    subject: input.subject,
+    version: input.version,
+    tagName: input.tagName,
+    sourceRef: input.sourceRef ?? STAGING_BRANCH,
+    targetRef: input.targetRef ?? PRODUCTION_BRANCH,
+    commits: input.commits ?? [],
+    changelog: input.changelog ?? null,
+    extraLines: input.extraLines
+  });
+}
+function completedJournalStepData(root, runId, stepId) {
+  const journal = readWorkflowRunJournal(root, runId);
+  return stringRecord(journal?.steps.find((step) => step.id === stepId && step.status === "completed")?.data);
+}
+function shouldResumeReleaseAtRootGates(root, runId) {
+  const journal = readWorkflowRunJournal(root, runId);
+  if (!journal || journal.command !== "release") return false;
+  const rootStep = journal.steps.find((step) => step.id === "release-root");
+  const gateStep = journal.steps.find((step) => step.id === "release-root-gates");
+  return rootStep?.status === "completed" && gateStep?.status !== "completed";
+}
 function createNextSteps(steps) {
   return steps.map(renderWorkflowStep);
 }
@@ -1397,8 +1456,25 @@ function runReleaseNpmInstall(repoDir, options = {}) {
   if (shouldSkipReleaseInstall()) {
     return { status: "skipped", reason: "disabled" };
   }
-  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false"];
-  run("npm", args, { cwd: repoDir });
+  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
+  const result = spawnSync("npm", args, {
+    cwd: repoDir,
+    env: {
+      ...process.env,
+      npm_config_audit: "false",
+      npm_config_fund: "false"
+    },
+    stdio: "pipe",
+    encoding: "utf8"
+  });
+  if (result.status !== 0) {
+    const detail = [
+      result.error?.message,
+      result.stderr?.trim(),
+      result.stdout?.trim()
+    ].filter(Boolean).join("\n");
+    throw new Error(detail || `npm ${args.join(" ")} failed`);
+  }
   return { status: "completed", reason: null };
 }
 function pathIsWithin(parent, candidate) {
@@ -1416,7 +1492,7 @@ function assertNoInternalDevReferencesForRepo(root, repoDir, packageNames) {
   throw new Error(`Stable release still contains internal Git/dev dependency references.
 ${rendered}`);
 }
-function backMergeProductionIntoStaging(repoDir, repoName) {
+function backMergeProductionIntoStaging(repoDir, repoName, message) {
   syncBranchWithOrigin(repoDir, PRODUCTION_BRANCH);
   syncBranchWithOrigin(repoDir, STAGING_BRANCH);
   checkoutBranch(repoDir, STAGING_BRANCH);
@@ -1433,7 +1509,7 @@ function backMergeProductionIntoStaging(repoDir, repoName) {
   } catch {
   }
   try {
-    run("git", ["merge", "--no-ff", `origin/${PRODUCTION_BRANCH}`, "-m", `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`], { cwd: repoDir });
+    run("git", ["merge", "--no-ff", `origin/${PRODUCTION_BRANCH}`, "-m", message ?? `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`], { cwd: repoDir });
   } catch (error) {
     const report = collectMergeConflictReport(repoDir);
     throw new TreeseedWorkflowError("release", "merge_conflict", formatMergeConflictReport(report, repoDir, STAGING_BRANCH), {
@@ -1451,14 +1527,32 @@ function backMergeProductionIntoStaging(repoDir, repoName) {
     commitSha: headCommit(repoDir)
   };
 }
-function backMergeRootProductionIntoStaging(root, syncPackageStagingHeads) {
+function backMergeRootProductionIntoStaging(root, syncPackageStagingHeads, options = {}) {
   const gitRoot = repoRoot(root);
-  const backMerge = backMergeProductionIntoStaging(gitRoot, "@treeseed/market");
+  const commits = releaseHistoryCommits(gitRoot, STAGING_BRANCH, `origin/${PRODUCTION_BRANCH}`);
+  const backMerge = backMergeProductionIntoStaging(gitRoot, "@treeseed/market", releaseAdminMessage({
+    subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
+    version: options.version,
+    sourceRef: PRODUCTION_BRANCH,
+    targetRef: STAGING_BRANCH,
+    commits,
+    changelog: options.changelog ?? null,
+    extraLines: versionLines(options.selectedVersions).map((line) => `Released package ${line}`)
+  }));
   if (!syncPackageStagingHeads) {
     return backMerge;
   }
   syncAllCheckedOutPackageRepos(root, STAGING_BRANCH);
-  const pointerSync = commitAllIfChanged(gitRoot, "release: sync package staging heads");
+  const pointerCommits = releaseHistoryCommits(gitRoot, `origin/${STAGING_BRANCH}`, "HEAD");
+  const pointerSync = commitAllIfChanged(gitRoot, releaseAdminMessage({
+    subject: "release: sync package staging heads",
+    version: options.version,
+    sourceRef: "package staging heads",
+    targetRef: STAGING_BRANCH,
+    commits: pointerCommits,
+    changelog: options.changelog ?? null,
+    extraLines: versionLines(options.selectedVersions).map((line) => `Staging package ${line}`)
+  }));
   if (pointerSync.committed) {
     pushBranch(gitRoot, STAGING_BRANCH);
   }
@@ -3573,6 +3667,10 @@ async function workflowRelease(helpers, input) {
       if (autoResumeRun) {
         helpers.write(`[workflow][resume] Resuming interrupted release ${autoResumeRun.runId} on ${STAGING_BRANCH}.`);
       }
+      const resumeAtRootGates = workflowRun.resumed && shouldResumeReleaseAtRootGates(root, workflowRun.runId);
+      if (resumeAtRootGates) {
+        helpers.write(`[workflow][resume] Resuming release ${workflowRun.runId} directly at production deploy gates.`);
+      }
       let releaseCleanupSnapshot = null;
       try {
         const releasePlan = await executeJournalStep(root, workflowRun.runId, "release-plan", () => plannedRelease);
@@ -3582,30 +3680,67 @@ async function workflowRelease(helpers, input) {
         const rootVersion = String(releasePlan.rootVersion);
         applyTreeseedEnvironmentToProcess({ tenantRoot: root, scope: "staging", override: true });
         assertReleaseGitHubAutomationReady(root, effectiveSelectedPackageNames, ciMode);
-        const releaseCandidate = await executeJournalStep(root, workflowRun.runId, "release-candidate", () => runReleaseCandidateForPlan("release", root, releasePlan, { allowReuse: true }));
-        if (!isResume) {
+        const releaseCandidate = resumeAtRootGates ? completedJournalStepData(root, workflowRun.runId, "release-candidate") : await executeJournalStep(root, workflowRun.runId, "release-candidate", () => runReleaseCandidateForPlan("release", root, releasePlan, { allowReuse: true }));
+        if (!resumeAtRootGates && !isResume) {
           assertSessionBranchSafety("release", session, { requireCleanPackages: true, requireCurrentBranch: true });
           assertCleanWorktree(root);
         }
-        prepareReleaseBranches(root);
-        ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
-        runWorkspaceReleasePreflight({ cwd: root });
-        await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"), { rerunCompleted: true });
+        if (!resumeAtRootGates) {
+          prepareReleaseBranches(root);
+          ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
+          runWorkspaceReleasePreflight({ cwd: root });
+          await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"), { rerunCompleted: true });
+        }
         if (mode === "root-only") {
           const rootRelease2 = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
             setRootPackageJsonVersion(root, rootVersion);
             run("git", ["checkout", STAGING_BRANCH], { cwd: gitRoot });
-            commitAllIfChanged(gitRoot, `release: ${level} bump`);
+            const rootCommitsBeforeChangelog = releaseHistoryCommits(gitRoot);
+            const changelog = updateReleaseChangelog(gitRoot, {
+              version: rootVersion,
+              commits: rootCommitsBeforeChangelog,
+              extraDependencyBullets: [`Release @treeseed/market ${rootVersion}.`]
+            });
+            commitAllIfChanged(gitRoot, releaseAdminMessage({
+              subject: `release: ${level} bump`,
+              version: rootVersion,
+              tagName: rootVersion,
+              commits: rootCommitsBeforeChangelog,
+              changelog
+            }));
             pushBranch(gitRoot, STAGING_BRANCH);
             const stagingCommit = headCommit(gitRoot);
-            const released = mergeStagingIntoMain(root);
-            const tag = ensureReleaseTag(gitRoot, rootVersion, released.commitSha);
+            const rootCommits = releaseHistoryCommits(gitRoot);
+            const released = mergeBranchIntoTarget(root, {
+              sourceBranch: STAGING_BRANCH,
+              targetBranch: PRODUCTION_BRANCH,
+              message: releaseAdminMessage({
+                subject: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+                version: rootVersion,
+                tagName: rootVersion,
+                commits: rootCommits,
+                changelog
+              }),
+              pushTarget: true
+            });
+            const tag = ensureReleaseTag(gitRoot, rootVersion, released.commitSha, releaseAdminMessage({
+              subject: `release: ${rootVersion}`,
+              version: rootVersion,
+              tagName: rootVersion,
+              commits: rootCommits,
+              changelog
+            }));
             syncBranchWithOrigin(gitRoot, STAGING_BRANCH);
             return {
               rootVersion,
               stagingCommit,
               releasedCommit: released.commitSha,
-              tag
+              tag,
+              changelog,
+              adminCommitSummary: {
+                commitCount: rootCommits.length,
+                notableCommits: rootCommits.slice(0, 12)
+              }
             };
           });
           rootRepo.committed = true;
@@ -3615,48 +3750,23 @@ async function workflowRelease(helpers, input) {
           rootRepo.commitSha = String(rootRelease2?.releasedCommit ?? headCommit(gitRoot));
           rootRepo.tagName = String(rootRelease2?.rootVersion ?? "");
           const rootWorkflowGateResult2 = await executeJournalStep(root, workflowRun.runId, "release-root-gates", () => waitForWorkflowGates("release", [
-            {
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "verify.yml",
-              branch: STAGING_BRANCH,
-              headSha: String(rootRelease2?.stagingCommit ?? "")
-            },
-            {
+            releaseDeployGate({
               name: rootRepo.name,
               repoPath: rootRepo.path,
               workflow: "deploy.yml",
-              branch: STAGING_BRANCH,
-              headSha: String(rootRelease2?.stagingCommit ?? "")
-            },
-            {
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "verify.yml",
               branch: rootVersion,
               headSha: String(rootRelease2?.releasedCommit ?? rootRepo.commitSha ?? "")
-            },
-            {
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "verify.yml",
-              branch: PRODUCTION_BRANCH,
-              headSha: String(rootRelease2?.releasedCommit ?? rootRepo.commitSha ?? "")
-            },
-            {
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "deploy.yml",
-              branch: PRODUCTION_BRANCH,
-              headSha: String(rootRelease2?.releasedCommit ?? rootRepo.commitSha ?? "")
-            }
+            })
           ].filter((gate) => gate.headSha), ciMode, {
             root,
             runId: workflowRun.runId,
             onProgress: (line, stream) => helpers.write(line, stream)
           }).then((workflowGates) => ({ workflowGates })));
           const hostedDeploymentState2 = recordHostedDeploymentStatesFromRootGates(root, rootRelease2, rootWorkflowGateResult2?.workflowGates);
-          const releaseBackMerge2 = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, false));
+          const releaseBackMerge2 = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, false, {
+            version: rootVersion,
+            changelog: rootRelease2?.changelog ?? null
+          }));
           const workspaceLinks2 = ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
           const payload2 = {
             mode,
@@ -3695,13 +3805,15 @@ async function workflowRelease(helpers, input) {
             ])
           });
         }
-        validatePackageReleaseWorkflows(root, effectivePackageSelection.selected);
-        for (const pkg of checkedOutWorkspacePackageRepos(root)) {
-          if (effectiveSelectedPackageNames.has(pkg.name)) {
-            prepareReleaseBranches(pkg.dir);
+        if (!resumeAtRootGates) {
+          validatePackageReleaseWorkflows(root, effectivePackageSelection.selected);
+          for (const pkg of checkedOutWorkspacePackageRepos(root)) {
+            if (effectiveSelectedPackageNames.has(pkg.name)) {
+              prepareReleaseBranches(pkg.dir);
+            }
           }
         }
-        releaseCleanupSnapshot = collectReleaseCleanupSnapshot(root, effectiveSelectedPackageNames);
+        releaseCleanupSnapshot = resumeAtRootGates ? null : collectReleaseCleanupSnapshot(root, effectiveSelectedPackageNames);
         const metadata = await executeJournalStep(root, workflowRun.runId, "prepare-release-metadata", () => {
           const releasedPackageDevTags2 = Object.fromEntries(
             checkedOutWorkspacePackageRepos(root).filter((pkg) => effectiveSelectedPackageNames.has(pkg.name)).map((pkg) => {
@@ -3721,7 +3833,7 @@ async function workflowRelease(helpers, input) {
             replacedDevReferences: replacedDevReferences2,
             releaseInstalls: releaseInstalls2
           };
-        }, { rerunCompleted: workflowRun.resumed });
+        }, { rerunCompleted: workflowRun.resumed && !resumeAtRootGates });
         const replacedDevReferences = Array.isArray(metadata?.replacedDevReferences) ? metadata.replacedDevReferences : [];
         const releaseInstalls = Array.isArray(metadata?.releaseInstalls) ? metadata.releaseInstalls : [];
         const releasedPackageDevTags = new Map(Object.entries(metadata?.releasedPackageDevTags ?? {}).map(([name, version]) => [name, String(version)]));
@@ -3736,24 +3848,52 @@ async function workflowRelease(helpers, input) {
           }
           const releasedPackage = await executeJournalStep(root, workflowRun.runId, `release-${report.name}`, async () => {
             checkoutBranch(pkg.dir, STAGING_BRANCH);
+            const tagName = String(effectiveVersions.get(pkg.name));
             releaseInstalls.push({
               name: pkg.name,
               ...runReleaseNpmInstall(pkg.dir, { workspaceRoot: root })
             });
             assertNoInternalDevReferencesForRepo(root, pkg.dir, effectiveSelectedPackageNames);
+            const packageCommitsBeforeChangelog = releaseHistoryCommits(pkg.dir);
+            const changelog = updateReleaseChangelog(pkg.dir, {
+              version: tagName,
+              commits: packageCommitsBeforeChangelog,
+              extraDependencyBullets: [`Release ${pkg.name} ${tagName}.`]
+            });
             if (hasMeaningfulChanges(pkg.dir)) {
               run("git", ["add", "-A"], { cwd: pkg.dir });
-              run("git", ["commit", "-m", `release: ${effectiveVersions.get(pkg.name)}`], { cwd: pkg.dir });
+              run("git", ["commit", "-m", releaseAdminMessage({
+                subject: `release: ${tagName}`,
+                version: tagName,
+                tagName,
+                commits: packageCommitsBeforeChangelog,
+                changelog,
+                extraLines: [`Package: ${pkg.name}`]
+              })], { cwd: pkg.dir });
             }
             pushBranch(pkg.dir, STAGING_BRANCH);
+            const packageCommits = releaseHistoryCommits(pkg.dir);
             const mergeResult = mergeBranchIntoTarget(pkg.dir, {
               sourceBranch: STAGING_BRANCH,
               targetBranch: PRODUCTION_BRANCH,
-              message: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+              message: releaseAdminMessage({
+                subject: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+                version: tagName,
+                tagName,
+                commits: packageCommits,
+                changelog,
+                extraLines: [`Package: ${pkg.name}`]
+              }),
               pushTarget: true
             });
-            const tagName = String(effectiveVersions.get(pkg.name));
-            const tag = ensureReleaseTag(pkg.dir, tagName, mergeResult.commitSha);
+            const tag = ensureReleaseTag(pkg.dir, tagName, mergeResult.commitSha, releaseAdminMessage({
+              subject: `release: ${tagName}`,
+              version: tagName,
+              tagName,
+              commits: packageCommits,
+              changelog,
+              extraLines: [`Package: ${pkg.name}`]
+            }));
             const workflowGates = await waitForWorkflowGates("release", [
               {
                 name: pkg.name,
@@ -3761,20 +3901,6 @@ async function workflowRelease(helpers, input) {
                 workflow: "publish.yml",
                 headSha: mergeResult.commitSha,
                 branch: tagName
-              },
-              {
-                name: pkg.name,
-                repoPath: pkg.dir,
-                workflow: "verify.yml",
-                headSha: mergeResult.commitSha,
-                branch: tagName
-              },
-              {
-                name: pkg.name,
-                repoPath: pkg.dir,
-                workflow: "verify.yml",
-                headSha: mergeResult.commitSha,
-                branch: PRODUCTION_BRANCH
               }
             ], ciMode, {
               root,
@@ -3783,12 +3909,26 @@ async function workflowRelease(helpers, input) {
             });
             const publish = workflowGates.find((gate) => gate.workflow === "publish.yml") ?? workflowGates[0] ?? null;
             assertReleaseGitHubWorkflowSucceeded(pkg.name, publish);
-            const backMerge = backMergeProductionIntoStaging(pkg.dir, pkg.name);
+            const backMerge = backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
+              subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
+              version: tagName,
+              tagName,
+              sourceRef: PRODUCTION_BRANCH,
+              targetRef: STAGING_BRANCH,
+              commits: packageCommits,
+              changelog,
+              extraLines: [`Package: ${pkg.name}`]
+            }));
             syncBranchWithOrigin(pkg.dir, STAGING_BRANCH);
             return {
               commitSha: mergeResult.commitSha,
               tagName,
               tag,
+              changelog,
+              adminCommitSummary: {
+                commitCount: packageCommits.length,
+                notableCommits: packageCommits.slice(0, 12)
+              },
               publish,
               workflowGates,
               backMerge
@@ -3802,6 +3942,8 @@ async function workflowRelease(helpers, input) {
           report.publishWait = releasedPackage?.publish ?? null;
           report.workflowGates = Array.isArray(releasedPackage?.workflowGates) ? releasedPackage.workflowGates : [];
           report.backMerge = releasedPackage?.backMerge ?? null;
+          report.changelog = releasedPackage?.changelog ?? null;
+          report.adminCommitSummary = releasedPackage?.adminCommitSummary ?? null;
           report.branch = STAGING_BRANCH;
           publishWait.push({
             name: report.name,
@@ -3812,16 +3954,41 @@ async function workflowRelease(helpers, input) {
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           setRootPackageJsonVersion(root, rootVersion);
           run("git", ["checkout", STAGING_BRANCH], { cwd: gitRoot });
-          commitAllIfChanged(gitRoot, `release: ${level} bump`);
+          const rootCommitsBeforeChangelog = releaseHistoryCommits(gitRoot);
+          const changelog = updateReleaseChangelog(gitRoot, {
+            version: rootVersion,
+            commits: rootCommitsBeforeChangelog,
+            extraDependencyBullets: [
+              `Release @treeseed/market ${rootVersion}.`,
+              ...versionLines(effectiveVersions).map((line) => `Release package ${line}.`)
+            ]
+          });
+          commitAllIfChanged(gitRoot, releaseAdminMessage({
+            subject: `release: ${level} bump`,
+            version: rootVersion,
+            tagName: rootVersion,
+            commits: rootCommitsBeforeChangelog,
+            changelog,
+            extraLines: versionLines(effectiveVersions).map((line) => `Package ${line}`)
+          }));
           pushBranch(gitRoot, STAGING_BRANCH);
           const stagingCommit = headCommit(gitRoot);
+          const rootCommits = releaseHistoryCommits(gitRoot);
           let released;
           let submoduleReconciliation = null;
+          const mergeMessage = releaseAdminMessage({
+            subject: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+            version: rootVersion,
+            tagName: rootVersion,
+            commits: rootCommits,
+            changelog,
+            extraLines: versionLines(effectiveVersions).map((line) => `Package ${line}`)
+          });
           try {
             released = mergeBranchIntoTarget(root, {
               sourceBranch: STAGING_BRANCH,
               targetBranch: PRODUCTION_BRANCH,
-              message: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+              message: mergeMessage,
               pushTarget: false,
               quietMerge: true
             });
@@ -3832,7 +3999,7 @@ async function workflowRelease(helpers, input) {
             }
             helpers.write(`[release][reconcile] Resolving generated package pointer reconciliation for ${reconciliation.entries.map((entry) => String(entry.path)).join(", ")}.`);
             submoduleReconciliation = reconciliation;
-            commitAllIfChanged(gitRoot, `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`);
+            commitAllIfChanged(gitRoot, mergeMessage);
             released = { commitSha: headCommit(gitRoot) };
           }
           for (const pkg of checkedOutWorkspacePackageRepos(root)) {
@@ -3840,9 +4007,26 @@ async function workflowRelease(helpers, input) {
               syncBranchWithOrigin(pkg.dir, PRODUCTION_BRANCH);
             }
           }
-          commitAllIfChanged(gitRoot, "release: sync package main heads");
+          const mainPointerCommits = releaseHistoryCommits(gitRoot, released.commitSha, "HEAD");
+          commitAllIfChanged(gitRoot, releaseAdminMessage({
+            subject: "release: sync package main heads",
+            version: rootVersion,
+            tagName: rootVersion,
+            sourceRef: "package main heads",
+            targetRef: PRODUCTION_BRANCH,
+            commits: mainPointerCommits,
+            changelog,
+            extraLines: versionLines(effectiveVersions).map((line) => `Main package ${line}`)
+          }));
           const releasedCommit = headCommit(gitRoot);
-          const tag = ensureReleaseTag(gitRoot, rootVersion, releasedCommit);
+          const tag = ensureReleaseTag(gitRoot, rootVersion, releasedCommit, releaseAdminMessage({
+            subject: `release: ${rootVersion}`,
+            version: rootVersion,
+            tagName: rootVersion,
+            commits: rootCommits,
+            changelog,
+            extraLines: versionLines(effectiveVersions).map((line) => `Package ${line}`)
+          }));
           run("git", ["push", "origin", PRODUCTION_BRANCH], { cwd: gitRoot });
           syncAllCheckedOutPackageRepos(root, STAGING_BRANCH);
           syncBranchWithOrigin(gitRoot, STAGING_BRANCH);
@@ -3852,6 +4036,11 @@ async function workflowRelease(helpers, input) {
             releasedCommit,
             mergeCommit: released.commitSha,
             tag,
+            changelog,
+            adminCommitSummary: {
+              commitCount: rootCommits.length,
+              notableCommits: rootCommits.slice(0, 12)
+            },
             submoduleReconciliation
           };
         });
@@ -3862,48 +4051,24 @@ async function workflowRelease(helpers, input) {
         rootRepo.commitSha = String(rootRelease?.releasedCommit ?? headCommit(gitRoot));
         rootRepo.tagName = String(rootRelease?.rootVersion ?? "");
         const rootWorkflowGateResult = await executeJournalStep(root, workflowRun.runId, "release-root-gates", () => waitForWorkflowGates("release", [
-          {
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "verify.yml",
-            branch: STAGING_BRANCH,
-            headSha: String(rootRelease?.stagingCommit ?? "")
-          },
-          {
+          releaseDeployGate({
             name: rootRepo.name,
             repoPath: rootRepo.path,
             workflow: "deploy.yml",
-            branch: STAGING_BRANCH,
-            headSha: String(rootRelease?.stagingCommit ?? "")
-          },
-          {
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "verify.yml",
             branch: rootVersion,
             headSha: String(rootRelease?.releasedCommit ?? rootRepo.commitSha ?? "")
-          },
-          {
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "verify.yml",
-            branch: PRODUCTION_BRANCH,
-            headSha: String(rootRelease?.releasedCommit ?? rootRepo.commitSha ?? "")
-          },
-          {
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "deploy.yml",
-            branch: PRODUCTION_BRANCH,
-            headSha: String(rootRelease?.releasedCommit ?? rootRepo.commitSha ?? "")
-          }
+          })
         ].filter((gate) => gate.headSha), ciMode, {
           root,
           runId: workflowRun.runId,
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
         const hostedDeploymentState = recordHostedDeploymentStatesFromRootGates(root, rootRelease, rootWorkflowGateResult?.workflowGates);
-        const releaseBackMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, true));
+        const releaseBackMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, true, {
+          version: rootVersion,
+          changelog: rootRelease?.changelog ?? null,
+          selectedVersions: effectiveVersions
+        }));
         const devTagCleanupMode = effectiveInput.devTagCleanup ?? "safe-after-release";
         const devTagCleanup = devTagCleanupMode === "off" ? (skipJournalStep(root, workflowRun.runId, "cleanup-dev-tags", { status: "skipped", reason: "disabled" }), { status: "skipped", reason: "disabled" }) : await executeJournalStep(root, workflowRun.runId, "cleanup-dev-tags", () => {
           const activeDevTags = collectActiveDevTagReferences(root);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.6.37",
+  "version": "0.6.38",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {

package/templates/github/deploy.workflow.yml

@@ -4,9 +4,8 @@ on:
   push:
     branches:
       - staging
-      - main
     tags:
-      - 'v*'
+      - '*.*.*'
   workflow_dispatch:
     inputs:
       environment:
@@ -75,12 +74,13 @@ jobs:
 
             if [[ "${ref_type}" == "tag" ]]; then
               scope="prod"
-              release_tag="true"
-              compare_ref="$(git rev-list --parents -n 1 "${head_sha}" | awk '{print $2}')"
-            elif [[ "${ref_name}" == "main" ]]; then
-              scope="prod"
-              release_tag="false"
-              compare_ref="${before_sha}"
+              if [[ "${ref_name}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                release_tag="true"
+                compare_ref="$(git rev-list --parents -n 1 "${head_sha}" | awk '{print $2}')"
+              else
+                release_tag="false"
+                compare_ref=""
+              fi
             else
               scope="staging"
               release_tag="false"
@@ -94,7 +94,10 @@ jobs:
             code_changed="false"
             content_changed="false"
 
-            if [[ -n "${compare_ref}" ]]; then
+            if [[ "${ref_type}" == "tag" && "${release_tag}" != "true" ]]; then
+              code_changed="false"
+              content_changed="false"
+            elif [[ -n "${compare_ref}" ]]; then
               while IFS= read -r path; do
                 [[ -z "${path}" ]] && continue
                 case "${path}" in