aiwg 2026.6.5 → 2026.6.7

package/CLAUDE.md

@@ -674,7 +674,7 @@ Before pushing a version tag:
 5. **Commit the release prep** — `git commit` the package.json/CHANGELOG/announcement bump. Do NOT use plain `git tag -a` or `git tag -s` (they sign with `user.signingkey`, which is typically the maintainer's *personal commit-signing key* — wrong key for tags; the supply-chain gate `tools/ci/verify-signed-tag.sh` will reject in CI).
 6. **Cut the tag via the wrapper — REQUIRED, never `git tag` by hand** — `tools/release/cut-tag.sh <X.Y.Z>`. Runs 10 pre-tag checks (CalVer shape, `package.json` + `marketplace.json` lockstep, **CHANGELOG entry present**, **announcement file present**, release-signing key both present locally AND published in `.gitea/keys/maintainers.asc`) and signs with `-u <RELEASE_KEY_FINGERPRINT>` (default: `FE9272F0BC5781E1DE77FAAA719AB63879E84CE8`, the `AIWG Release Signing <release@aiwg.io>` key per the two-key model from commit `a13dabc5`). **Bypassing this wrapper is how v2026.5.10 shipped without a CHANGELOG entry — don't repeat the failure.** See the v2026.5.5 incident note in `docs/contributing/versioning.md` for the signing-key variant of the same lesson.
 7. **Push tag to Gitea** — `git push origin main --tags`. Triggers `gitea-release.yml` + `npm-publish.yml` (both gated on signed-tag verify).
-8. **Mirror to GitHub** — `git push github main --tags`. Triggers `github-mirror.yml` which creates the GitHub Release using `docs/releases/v<version>-announcement.md` as the body. **No manual `gh release create` needed for stable releases** — the workflow handles it. Pre-release tags (`-rc.*`, `-alpha.*`, `-beta.*`, `-nightly.*`) skip GitHub-Release creation by design.
+8. **Mirror to GitHub** — `git push github main --tags`. **You must push the tag yourself** (don't rely on the mirror workflow to push it): GitHub's npm-publish workflow verifies the tag *signature*, and a tag pushed from the Gitea runner arrives peeled to a lightweight (unsigned) object that fails that gate. Your local `git push` preserves the annotated, signed tag. The Gitea tag push in step 7 then triggers `github-mirror.yml`, which **creates the GitHub Release** using `docs/releases/v<version>-announcement.md` as the body (reading the `GH_ACCESS_TOKEN` Gitea Actions secret) — so **no manual `gh release create` is needed**. The mirror's main-push is best-effort and its release step is idempotent, so pushing first does not conflict. Pre-release tags (`-rc.*`, `-alpha.*`, `-beta.*`, `-nightly.*`) skip GitHub-Release creation by design.
 
 ### Version Format
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiwg",
-  "version": "2026.6.5",
+  "version": "2026.6.7",
   "description": "Deployment tool and support utility for AI context. Copies agents, skills, commands, rules, and behaviors into the paths each AI platform reads (Claude Code, Codex, Copilot, Cursor, Warp, OpenClaw, and 6 more) so one source of truth works across 10 platforms. Optional utilities for persistent artifact memory, background orchestration, autonomous loops, and artifact indexing.",
   "type": "module",
   "bin": {