@vegastack/vegafactory 0.19.1 → 0.19.5

package/dist/dashboard-artifact.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": 1,
   "name": "@vegastack/vegafactory-dashboard",
-  "version": "0.19.1",
-  "sha256": "14b22fad76fb22f1b4400fcf1ddac66d1dcfeffaa49cef30b900d142d5cd59fb",
-  "integrity": "sha512-z972L6ppDjIRd46DQI9CmIm9I33Nf44FWR/cVw3awIkLjP8QoPdhW4EzYv3WZaABY3jeZtAQy47nMPmoH/cZig==",
-  "bytes": 126851959,
+  "version": "0.19.5",
+  "sha256": "06ac0483425e85c72722f7885a9098522f85b1007fdc8dd88209cb61cf9affd1",
+  "integrity": "sha512-Im0uFCHae1p660SzayqgjoT2ezlsjyW5SSRUJjR08eRHjCz0UyVCkfIEytu8CwuGvhQYI5/KtYE9/13FMeId+Q==",
+  "bytes": 126852463,
   "files": [
     {
       "path": "LICENSE",
@@ -13668,7 +13668,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/BUILD_ID",
-      "sha256": "16d9c943469deeb36b751879a74c417875baa38a8b2b0e7ec3f2a3ad94e498ed",
+      "sha256": "0342879636495ee2b23c69ea9e87678afd809aad7bd584e0d5c822414c718f8c",
       "mode": 420
     },
     {
@@ -13678,7 +13678,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/build-manifest.json",
-      "sha256": "fe48e2ddc66538a67e659077f8f531a47968fdf9d0279b4e04d63c1fd2b8af34",
+      "sha256": "e62f1ec54cfd19d39a5b94be81c9411a02f05ac79c51d19fbaf3d211d29b8ff6",
       "mode": 420
     },
     {
@@ -13688,12 +13688,12 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/prerender-manifest.json",
-      "sha256": "fe90a573facde4a5c2fbe3731e0290647fe17d36ccc3067db5ba8b83042e220a",
+      "sha256": "c3dd30b2c4abef3ee49e2a537992cb473e5a9639d5b6185dd478464d0ed077bf",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/required-server-files.json",
-      "sha256": "78b93865664f4623a870f15d86680c833d07db973da4ff558f9f186ea6af63f4",
+      "sha256": "0742bb7dec156a72d658fde6316e4340d4f87bfe9dc62936c4e6b3b4f91b2020",
       "mode": 420
     },
     {
@@ -13708,7 +13708,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.html",
-      "sha256": "d3fafcb2502c99790366fc850d969372f94372adbdae58a96c4f27f12bf7f9f5",
+      "sha256": "fd202b0a008e9f00f6d1f41329677ec4ad142bd6168071172ac1c0b41731287d",
       "mode": 420
     },
     {
@@ -13718,22 +13718,22 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.rsc",
-      "sha256": "623708cc29f7ddbb04b7dd4cc1ccdf6ffc788db1df13a487e9c755a389ed4093",
+      "sha256": "59c1323978d539882477d6783cf1c099a7d6be7ad8c13668feb02c5c40ea08ae",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.segments/__PAGE__.segment.rsc",
-      "sha256": "9eab066fb25a3498f5ac115e5497bd7396d77bfd896836f10217a0f640c18b0c",
+      "sha256": "00c23188046dc298e9a186446e471561f2a12540fba1043ea67e619f8215c6af",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.segments/_full.segment.rsc",
-      "sha256": "623708cc29f7ddbb04b7dd4cc1ccdf6ffc788db1df13a487e9c755a389ed4093",
+      "sha256": "59c1323978d539882477d6783cf1c099a7d6be7ad8c13668feb02c5c40ea08ae",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_global-error.segments/_tree.segment.rsc",
-      "sha256": "034dfa0ef8dda3a6489137df58257141eeb8e546736d31a7892b7851a905f04b",
+      "sha256": "ad4ba1bed25125a1e8a72cc67b4b06dd392c76e4fe598422b56d254bf3e144d5",
       "mode": 420
     },
     {
@@ -13783,7 +13783,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.html",
-      "sha256": "e173bd63b1d61a32dd501328008cf3fce08c7cc33dd4939c44275ba90221d347",
+      "sha256": "e7a9ca2605b034b57de756c2059d1a518d6a8728ce8865f492236994b0dad1d7",
       "mode": 420
     },
     {
@@ -13793,22 +13793,22 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.rsc",
-      "sha256": "dde586ea8e9fc9ccae758c1deab741a6815a0ba35dd581f5e2141ca76846053f",
+      "sha256": "50c5f06bc431f115c8df3c002e6fb986616bfaa27bb676438673a4a05bdd33a9",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.segments/_full.segment.rsc",
-      "sha256": "dde586ea8e9fc9ccae758c1deab741a6815a0ba35dd581f5e2141ca76846053f",
+      "sha256": "50c5f06bc431f115c8df3c002e6fb986616bfaa27bb676438673a4a05bdd33a9",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.segments/_not-found/__PAGE__.segment.rsc",
-      "sha256": "886160d09362b6c6f5d309f62e01a3ea57b0cb1f5ec2943ac9465463f74a43c5",
+      "sha256": "0879d72f3527c5c4734e7cb7732c30db05cd23ca0bc63c6c7135600ab7168858",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/_not-found.segments/_tree.segment.rsc",
-      "sha256": "607bbdd4438226d82a346288221c2afb83f30110ef83e10575d004445fbd42b3",
+      "sha256": "ea06cee32c263b5cdb95e27d4ada1b6657117771c18c30fd4808c6513f4917aa",
       "mode": 420
     },
     {
@@ -13868,7 +13868,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/activity/page.js.nft.json",
-      "sha256": "4cdc048d894fc6bbe84e90b9847909d8e1bd1cd433099a73e638a272b46da1cd",
+      "sha256": "33acbbee1883085c67a9ed4689cdd68de368dd7ad32ac7da2842ac2686cac871",
       "mode": 420
     },
     {
@@ -13913,7 +13913,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/api/health/route.js.nft.json",
-      "sha256": "f7012ee5b8a4c60f96767873e96f0aef41008fb87a722b11aa42d8e9bf888e8e",
+      "sha256": "36dc7e8f7f59a7180c2c9d1cb2b917397a03e78cdc6815041a49bfa6b74032ed",
       "mode": 420
     },
     {
@@ -13948,7 +13948,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/board/page.js.nft.json",
-      "sha256": "b995a9d8bee8fb952d52d67eedb624e63a99a77ae20cfd705cc5bf304d516569",
+      "sha256": "f9a76c4b21f079e973505c6e8f22ab9db7d0cc69eb70b0c711bdc37f375b6fae",
       "mode": 420
     },
     {
@@ -13993,7 +13993,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/dispatcher/page.js.nft.json",
-      "sha256": "8b245b474d1d33c2ae3d3cb3140ff0f5c2848fd5a9303ba8f0a539391e11813c",
+      "sha256": "9773a55c0027b5aeecb461e14fa7d906fc8fa08c3bbf2a3db0476aa6eff7e430",
       "mode": 420
     },
     {
@@ -14038,7 +14038,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/page.js.nft.json",
-      "sha256": "318feda54ee27dc7482483521ae3eda871106df3015ec8899a890ed05f0ddb29",
+      "sha256": "0744bbc200862ab19ca72053569f4612ed8d83f81bf0e1047c4abe33e443d793",
       "mode": 420
     },
     {
@@ -14083,7 +14083,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/people/[login]/page.js.nft.json",
-      "sha256": "7f54478ee45fd021787b3066a030e32c03b0f13ea569217faf220ed9b39f38e3",
+      "sha256": "5bb0fc2a7d775909fdf00bd727429f682fee9732cf061372342507ccc7a0b91f",
       "mode": 420
     },
     {
@@ -14128,7 +14128,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/people/page.js.nft.json",
-      "sha256": "94d78d6b3b837ac6610bab4311b27bb7966a17dc37a85026d793f3f165b3b311",
+      "sha256": "f1cfa2edd9745b40979468e3296be20318cf8b51f5880f306cb6bda099efa105",
       "mode": 420
     },
     {
@@ -14173,7 +14173,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/performance/page.js.nft.json",
-      "sha256": "049be1dfb66d19c9f9626e04d71fe788c53911e116a615a0e854730f7e3134f2",
+      "sha256": "ca08aada62c9af838161bf9051b9ff67453f561cbead15cbce14abc32072a1dc",
       "mode": 420
     },
     {
@@ -14218,7 +14218,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/repo/[owner]/[name]/page.js.nft.json",
-      "sha256": "5c0dd4946dfd6fa6e3e06a50862eefe0a533950112e95725330e0edeb6c56473",
+      "sha256": "e76426d3c30e5638ec72fb0e64bfb25173976955042f6f232b300b49ccc94806",
       "mode": 420
     },
     {
@@ -14263,7 +14263,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/app/skills/page.js.nft.json",
-      "sha256": "29f89d1e2f8f47ef81022c047368c5149173d006bd5e2aa2d65638842c3d0102",
+      "sha256": "667dd7dc636c9c40491c4acf3409a084a36d5ef229f9f6f51f97b67e724a9c59",
       "mode": 420
     },
     {
@@ -15078,7 +15078,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/middleware-build-manifest.js",
-      "sha256": "907144f570ddcfda38662ff678039077807ffb4831685ed1fe070a89eadbb24f",
+      "sha256": "fb7a5f796455c5884945536e8ac6e7fad5c6eceead7e879d4f80fb91da8bb95c",
       "mode": 420
     },
     {
@@ -15103,12 +15103,12 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/pages/404.html",
-      "sha256": "e173bd63b1d61a32dd501328008cf3fce08c7cc33dd4939c44275ba90221d347",
+      "sha256": "e7a9ca2605b034b57de756c2059d1a518d6a8728ce8865f492236994b0dad1d7",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/pages/500.html",
-      "sha256": "d3fafcb2502c99790366fc850d969372f94372adbdae58a96c4f27f12bf7f9f5",
+      "sha256": "fd202b0a008e9f00f6d1f41329677ec4ad142bd6168071172ac1c0b41731287d",
       "mode": 420
     },
     {
@@ -15118,26 +15118,26 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/server-reference-manifest.js",
-      "sha256": "8ade2d7966b128135c74e498b77264489d830c8221fba04f8b46e0a66d0d6a9b",
+      "sha256": "1666f19cb024a68bd963d717002d67a18f873b11bdc400f2db140aa3ceb7f3e9",
       "mode": 420
     },
     {
       "path": "dist-standalone/packages/dashboard/.next/server/server-reference-manifest.json",
-      "sha256": "b750c6ed56351caf9934206f063273e1859a6969f044d835d31b995d1cbf08f1",
+      "sha256": "433e1189c03632a7f3183daa881b6093c033f409d8891e0c523548d8daebfe59",
       "mode": 420
     },
     {
-      "path": "dist-standalone/packages/dashboard/.next/static/aq8OjeI9l7bR2CGyoaW1t/_buildManifest.js",
+      "path": "dist-standalone/packages/dashboard/.next/static/Cm_SmnoCpVGagO6nR8WqE/_buildManifest.js",
       "sha256": "9476e0afd3f9da68a64e6ec58631191fd3eaca62c9f5a377e7517fe9a89e59ea",
       "mode": 420
     },
     {
-      "path": "dist-standalone/packages/dashboard/.next/static/aq8OjeI9l7bR2CGyoaW1t/_clientMiddlewareManifest.js",
+      "path": "dist-standalone/packages/dashboard/.next/static/Cm_SmnoCpVGagO6nR8WqE/_clientMiddlewareManifest.js",
       "sha256": "5483e3295dc35dfe29ea932efc85341c916f10ff78ff5b0e965e003710893a4a",
       "mode": 420
     },
     {
-      "path": "dist-standalone/packages/dashboard/.next/static/aq8OjeI9l7bR2CGyoaW1t/_ssgManifest.js",
+      "path": "dist-standalone/packages/dashboard/.next/static/Cm_SmnoCpVGagO6nR8WqE/_ssgManifest.js",
       "sha256": "678f6ce2cb80b1fe72fc67e7412be6e2ab6ada083111b64f7c40d35e3cba5e00",
       "mode": 420
     },
@@ -15193,7 +15193,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/CHANGELOG.md",
-      "sha256": "0589dfb5135cffbe09b125edd1c9d7fcfef519b43765e3c9dbfdc5b38d82b0e5",
+      "sha256": "f39afca575c8ce7a9d0a2850e5733170ddc7f7af67c342985d7f91bb32595ea2",
       "mode": 420
     },
     {
@@ -20913,7 +20913,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/package.json",
-      "sha256": "34c345c798a31e8d3eb3d0e577eab6a4d7c413d885291b7a047f13a7e4147200",
+      "sha256": "5c6bdf8fe7b28afe9fa32dcf03b97021df321bd70ed8cfd670388bf92157aeaf",
       "mode": 420
     },
     {
@@ -20928,7 +20928,7 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/server.js",
-      "sha256": "1be1eb3df1d46b53e26cfe806e81ca1f89205822be58d8388b6ceb4f976214d0",
+      "sha256": "3a63413fdb9680d81b16ae0d4450db5d24fe9c0b134a61e2f29fec0b3c1af017",
       "mode": 420
     },
     {
@@ -21233,12 +21233,12 @@
     },
     {
       "path": "dist-standalone/packages/dashboard/tsconfig.tsbuildinfo",
-      "sha256": "44507045f8fa2c1178808821ff1999856ba3da84fe57dee2ce978014edb39849",
+      "sha256": "d0f12d83d997f7f53700beffc2b134f7eebc6d0628ded4772ee4375d075ff235",
       "mode": 420
     },
     {
       "path": "package.json",
-      "sha256": "34c345c798a31e8d3eb3d0e577eab6a4d7c413d885291b7a047f13a7e4147200",
+      "sha256": "5c6bdf8fe7b28afe9fa32dcf03b97021df321bd70ed8cfd670388bf92157aeaf",
       "mode": 420
     }
   ]

package/dist/index.js

@@ -20821,7 +20821,8 @@ __export(exports_dashboard, {
   dashboardInstallReceipt: () => dashboardInstallReceipt,
   dashboardCacheNamespace: () => dashboardCacheNamespace,
   SERVER_ENTRY: () => SERVER_ENTRY,
-  DASHBOARD_PACKAGE: () => DASHBOARD_PACKAGE
+  DASHBOARD_PACKAGE: () => DASHBOARD_PACKAGE,
+  DASHBOARD_HEALTH_TIMEOUT_MS: () => DASHBOARD_HEALTH_TIMEOUT_MS
 });
 import { execFile as execFile5, spawn as spawn6 } from "node:child_process";
 import { chmod, lstat as lstat11, mkdir as mkdir11, mkdtemp as mkdtemp2, open as open8, readFile as readFile15, readdir as readdir4, rename as rename7, rm as rm7, writeFile as writeFile5 } from "node:fs/promises";
@@ -21042,7 +21043,7 @@ async function runDashboard(options) {
     return 2;
   }
   const version = paths.source === "override" ? "unverified-development" : options.version;
-  const deadline = Date.now() + HEALTH_TIMEOUT_MS;
+  const deadline = Date.now() + DASHBOARD_HEALTH_TIMEOUT_MS;
   for (const port of portCandidates(flags.port, PORT_SPAN).filter((port2) => port2 <= 65535)) {
     if (Date.now() >= deadline)
       break;
@@ -21050,7 +21051,7 @@ async function runDashboard(options) {
     const env = launchEnv({ env: { ...environment, cacheFile, port, version, instanceId: identity.instanceId, bin: process.argv[1] ?? "vegafactory" } });
     const attempt = launchDashboardChild(paths.entry, { ...process.env, ...env }, flags.json);
     try {
-      const ready = await waitDashboardChild(attempt, identity, port, Math.min(deadline, Date.now() + 2000));
+      const ready = await waitDashboardChild(attempt, identity, port, deadline);
       if (!ready) {
         if (!await stopDashboardChild(attempt)) {
           console.error("error: dashboard child termination is unverified; retained ownership, no port retry");
@@ -21083,7 +21084,7 @@ async function runDashboard(options) {
       return 1;
     }
   }
-  console.error("error: no owned dashboard instance became ready within 20 seconds");
+  console.error(`error: no owned dashboard instance became ready within ${DASHBOARD_HEALTH_TIMEOUT_MS / 1000} seconds`);
   return 1;
 }
 function launchDashboardChild(entry, env, quiet = true) {
@@ -21452,7 +21453,7 @@ async function downloadDashboard(version, descriptor) {
   }
   return Buffer.concat(chunks);
 }
-var DASHBOARD_PACKAGE = "@vegastack/vegafactory-dashboard", SERVER_ENTRY = "dist-standalone/packages/dashboard/server.js", DEFAULT_PORT = 7777, PORT_SPAN = 10, HEALTH_TIMEOUT_MS = 20000, run2 = (command, args, options = {}) => new Promise((resolve14) => {
+var DASHBOARD_PACKAGE = "@vegastack/vegafactory-dashboard", SERVER_ENTRY = "dist-standalone/packages/dashboard/server.js", DEFAULT_PORT = 7777, PORT_SPAN = 10, DASHBOARD_HEALTH_TIMEOUT_MS = 60000, run2 = (command, args, options = {}) => new Promise((resolve14) => {
   execFile5(command, args, { ...options, maxBuffer: 32 * 1024 * 1024 }, (error, stdout, stderr) => {
     const code = error ? error.code : 0;
     resolve14({ code: typeof code === "number" ? code : error ? 1 : 0, stdout, stderr });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vegastack/vegafactory",
-  "version": "0.19.1",
+  "version": "0.19.5",
   "description": "VegaFactory CLI for installing Agent Skills and running local development workflows",
   "license": "MIT",
   "type": "module",

package/skill/skill-maintainer/references/release-ops.md

@@ -27,8 +27,8 @@ profile carries a schema version to validate against.
 2. Maintainer, at release time: `bunx changeset version` (applies changesets to `packages/cli/package.json` and the changelog), then `bun install` so any dependency changes riding along reach the lockfile, commit on a `chore/release-<version>` branch and open its PR — main is branch-protected with no admin exemption, so the bump reaches main by merge and never by direct push. That install does **not** update the workspace's own version inside `bun.lock`: measured on the bun the root `packageManager` line pins, the recorded version is left unchanged by a plain install, by `--force`, and even by `--lockfile-only`, so it sits at an older number indefinitely. `bun install --frozen-lockfile`, which CI and the release workflow both run, passes with it, and nothing in this repo reads it: `packages/cli/package.json` is the single release identity. Never hand-edit the lockfile to "correct" it. The release record is `packages/cli/CHANGELOG.md`, changesets-written — never by hand; the root `CHANGELOG.md` is the frozen pre-0.3.0 record pointing there.
 3. Merge the release PR on the operator's word, pull main, then tag that merged commit `v<version>` and push the tag. Tags are not branch-protected, so the tag push is unaffected.
 4. The release workflow prepares one immutable CLI/dashboard pair before either package publishes. `scripts/release-artifacts.mjs prepare <evidence-dir> v<version>` requires clean source and records full source/tree identity, toolchains, check and built-skill scan evidence, build-graph and shipped-runtime SBOMs. It builds/assembles dashboard and CLI/skills, scans, packs dashboard with scripts disabled, derives its regular-file descriptor into generated CLI dist, then packs CLI with scripts disabled. Rebuilding CLI invalidates its descriptor. The final external manifest binds both exact tarballs and each required build/runtime SBOM by filename, scope and SHA-256; publication and release asset verification refuse missing or changed evidence. Only completed preparation writes the finalized manifest; generated descriptors are never committed.
-5. `scripts/release-publish.mjs <manifest> --publish --promote` runs only inside the repository-wide serialized Release workflow on the operator's word. All versions and recovery reruns share that workflow concurrency group with cancellation disabled; direct local live publishing refuses. A successful immutable pair upload precedes this command. It uses retained tarballs with scripts disabled and the existing authentication arrangement; this work does not restore provenance or change runners. Stage dashboard before CLI under a non-latest candidate tag. Compare registry integrity and downloaded payload bytes separately from provenance; #156 owns actual registry/attestation evidence. Only a definite public/authenticated 404 means absent. Network, rate-limit and auth failures stop recovery; a timed-out publish is read back before any later attempt. Matching existing versions resume; conflicting bytes require an operator-selected new version.
-6. The states are prepared → dashboard-present → pair-present → smoked → promoted. Smoke the downloaded pair in clean homes before changing either latest tag or claiming release success. Promotion is not atomic: each pending mutation and confirmed per-package tag readback is recorded, so a failed second-tag promotion leaves a recorded partial state. Rerun the same workflow: it restores the finalized pair and available prior observations, verifies both registry identities, repeats smoke, then reconciles tags and lost responses before retrying. If no finalized pair exists, only affirmative skipped-publication records for every prior attempt permit retrying failed preparation; missing/expired pair evidence after possible publication is a refusal, never permission to rebuild. Never retag historical releases or move latest backward. Retain the finalized pair before the first registry mutation, and upload attempt outcomes separately. After workflow completion, download/verify those same artifacts instead of preparing or publishing a second local pair. Retain tarballs, manifests, SBOMs and failure logs as CI artifacts and release assets; copy needed evidence before artifact retention expires. A platform is qualified only by results for this same descriptor-backed pair on that actual OS/architecture. Missing Linux guest execution remains unperformed; macOS or source engines cannot prove Ubuntu x64 compatibility.
+5. `scripts/release-publish.mjs <manifest> --publish --promote` runs only inside the first attempt of the repository-wide serialized Release workflow on the operator's word. All versions share that workflow concurrency group with cancellation disabled; direct local live publishing refuses. A successful immutable pair upload precedes this command. It uses retained tarballs with scripts disabled and the existing authentication arrangement; this work does not restore provenance or change runners. Stage dashboard before CLI under a non-latest candidate tag. Compare registry integrity and downloaded payload bytes separately from provenance; #156 owns actual registry/attestation evidence. Only a definite public/authenticated 404 means absent. After either publish call, poll exact registry integrity and downloaded bytes for up to 10 minutes (61 observations separated by 10 seconds); a conflict stops immediately, while absence or unavailability never authorizes resubmitting an attempted artifact. A failed run is immutable and rolls forward through a fresh patch/tag.
+6. The states are prepared → dashboard-present → pair-present → smoked → promoted. Smoke the downloaded pair in clean homes before changing either latest tag or claiming release success. Promotion is not atomic: each pending mutation and confirmed per-package tag readback is recorded, so a failed second-tag promotion remains failure evidence for the next roll-forward. GitHub deletes prior-attempt artifacts when a workflow run is rerun, so `GITHUB_RUN_ATTEMPT` greater than one is refused before preparation; do not rerun the same run, retag a historical release, rebuild a possibly published version, or move latest backward. Retain the finalized pair before the first registry mutation and upload the same attempt's outcome separately. After workflow completion, download/verify those artifacts instead of preparing or publishing a second local pair. Retain tarballs, manifests, SBOMs and failure logs as CI artifacts and release assets; copy needed evidence before retention expires. A platform is qualified only by results for this same descriptor-backed pair on that actual OS/architecture. Missing Linux guest execution remains unperformed; macOS or source engines cannot prove Ubuntu x64 compatibility.
 
 Contributors do not bump versions in PRs; releases are maintainer-driven.
 

package/skill-integrity.json

@@ -183,7 +183,7 @@
       "files": {
         "SKILL.md": "81fc5d089e4edb15f8d6511887c65e1ea01bd134ba27fc7a324ffb1e5cff6961",
         "agents/openai.yaml": "dd356907fdbfd7937e67d7daf06ac659ab36e7da0b0a4d0ffecb8b6eea31fdbe",
-        "references/release-ops.md": "f88b04a06cb8f8590bc5a3533c0d033d941e10a14df4edca61c68919f6b8f2df",
+        "references/release-ops.md": "6c6d34ba0d43f1a72f24e2d0a4cb3dcee8f90287b1dd7ce728472f434305839e",
         "references/standards.md": "a9cb33f9425881307f2ef0d6f4cdb1133f782a50c7b5a87419c09c179899fdbf",
         "refresh/REFRESH.md": "d3ba44be2c264b849d8a815111c049e782720428d5d0c5cea23998b05e50d58f",
         "refresh/sources.json": "4977152381d53555196ac676f95e61b4eaa301309a17560da5cda722010eb80f"