arcane-cli 1.14.1 → 1.14.2

package/dist/assets/.arcane/governance/mobile-release-standards.md

@@ -244,6 +244,10 @@ until the moment the release ships.
 
 **Rule (MR-15): Before each store release, list every binary version still in use, from the store releases, not from the updates published to them, and confirm each has an update path, judging each as it will stand once the release ships. An update path is either updates still published for the version's native compatibility version or an in-app prompt that sends it to the store; a version with phones on it and neither is stranded. Before the release ships, give each stranded version one (a backported update, which can carry the prompt) or record the operator's decision to leave it. Enforcement: structured spell gate (ARC-023) — spell-eas-store-deploy's runtime audit is the first step of every repeat deployment, and the release report names each stranded runtime with the route chosen for it; no executable check reads the audit's result.**
 
+Anchor a published backport with a protected, annotated publish-only tag that resolves to the published
+commit. Retire its temporary branch after verifying that the tag can support any future build for that
+runtime. Branch a later hotfix from the tag, then tag the new published commit in turn.
+
 ### MR-16: Pin the Xcode wherever it can change between builds
 
 Xcode stamps its toolchain into every iOS binary it builds (`DTXcode` and `DTSDKName` in the app's

package/dist/assets/.arcane/spells/spell-eas-store-deploy.md

@@ -224,8 +224,16 @@ offers it).
   5. Prove it by reading the update back: `eas update:view <new-group-id> --json` must show the stranded
      runtime's `runtimeVersion`, the git branch's `gitCommitHash`, and the `branch` that
      `eas channel:view <channel>` names. The pipeline's "succeeded" is not evidence (`EV-02`).
-  6. Mark the git branch publish-only (its name and its first commit say so) and never merge it: it exists
-     to publish from, and a merge would bring that old tree back into the trunk.
+  6. Anchor the published commit with an annotated git tag such as
+     `backport/<version>-update-prompt`, then retire the temporary backport branch. Before deleting the
+     branch, push the tag and verify that `git rev-parse "refs/tags/<tag>^{commit}"` and the remote's
+     peeled tag target (`git ls-remote origin 'refs/tags/<tag>^{}'`) both equal the `gitCommitHash` read
+     from the published update in step 5. Also verify that any build pipeline needed
+     for this runtime can run from `refs/tags/<tag>` and does not require a branch-name variable. Protect
+     the tag against deletion or replacement with the provider's tag permissions or tag ruleset; a git
+     branch by itself is not a durable publication anchor. Never merge the old tree into trunk. For a
+     later hotfix to this runtime, create a new temporary branch from the tag and give the new published
+     commit its own annotated tag after the same checks.
 
 ### 2. A store update prompt
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-cli",
-  "version": "1.14.1",
+  "version": "1.14.2",
   "description": "Arcane framework CLI — scaffold and manage governance files in consuming repositories",
   "keywords": [
     "arcane",