beeos-claw 0.6.11 → 0.6.12

package/README.md

@@ -203,10 +203,12 @@ Logs are written to rolling files in `log.dir` with automatic rotation and sensi
 | **production** | `main` | `X.Y.Z` (plain SemVer, e.g. `0.2.41`) | `latest` | `openclaw-desktop:latest`, `production-<sha>` |
 | **staging** | `staging` | `X.Y.Z-staging.N` (pre-release, e.g. `0.2.41-staging.0`) | `staging` | `openclaw-desktop:staging-<full-claw-sha>` |
 
-The publish workflow [`.github/workflows/publish.yml`](.github/workflows/publish.yml) inspects the `version` in [`package.json`](./package.json):
+The publish workflow [`.github/workflows/publish.yml`](.github/workflows/publish.yml) is triggered only by protected version tags:
 
-- If the version contains a `-staging.` / `-rc.` / `-beta.` / `-alpha.` suffix → published with `--tag staging`, downstream image built with `channel=staging`.
-- Otherwise → published with `--tag latest`, downstream image built with `channel=production`.
+- `vX.Y.Z-staging.N` must point at the current `staging` head and exactly match `package.json`; it publishes npm `staging` and invokes the frozen-SHA OpenClaw `staging` image workflow.
+- `vX.Y.Z` must point at the current `main` head and exactly match `package.json`; it is the production confirmation, publishes the immutable npm version, and invokes the frozen-SHA OpenClaw `production` image workflow.
+
+A normal branch push never publishes. Both lightweight and annotated tags are resolved to an immutable commit and rechecked before publish; moved tags and stale branch heads fail closed. OpenClaw first commits and read-backs the same immutable desktop digest in ECR and OCIR. Only then does Claw dispatch Backend with immutable receipt selectors; Backend independently re-verifies them before its receipt-bound release controller can promote a pin or roll out. Bootstrap the same repository-scoped fine-grained PAT as `BEEOS_RELEASE_AUTOMATION_TOKEN` in both Claw and Backend. It needs only the selected `beeos-ai/beeos-claw`, `beeos-ai/beeos-openclaw`, and `beeos-ai/backend` repositories, Actions read/write and Contents read/write; it is never interchangeable with `OPENCLAW_BUILD_TOKEN` or a registry credential. Activation order: merge the OpenClaw dual-receipt change, then merge the Backend controller to its default branch, then merge this Claw dispatch change; configure `BEEOS_RELEASE_AUTOMATION_TOKEN` in both repositories before creating the next protected release tag.
 
 ### Release to staging
 
@@ -216,9 +218,11 @@ git merge main                                    # or cherry-pick the commits y
 npm version prerelease --preid=staging --no-git-tag-version
 git commit -am "chore: release $(node -p "require('./package.json').version")"
 git push origin staging
+git tag v$(node -p "require('./package.json').version")
+git push origin v$(node -p "require('./package.json').version")
 ```
 
-CI publishes `beeos-claw@0.X.Y-staging.N` with `dist-tag=staging`, then triggers `beeos-openclaw` to rebuild `openclaw-desktop:staging-<full-claw-sha>`. Staging never uses `staging-latest`; consumers pulling `beeos-claw@latest` from npm or `openclaw-desktop:latest` from ECR are **not** affected.
+The tag workflow publishes `beeos-claw@0.X.Y-staging.N` with `dist-tag=staging`, then triggers `beeos-openclaw` to rebuild `openclaw-desktop:staging-<full-claw-sha>`. Staging never uses `staging-latest`; consumers pulling `beeos-claw@latest` from npm or `openclaw-desktop:latest` from ECR are **not** affected.
 
 ### Promote to production
 
@@ -230,9 +234,11 @@ git merge staging                                 # brings pre-release commits i
 npm version 0.X.Y --no-git-tag-version            # strip the -staging.N suffix
 git commit -am "chore: release $(node -p "require('./package.json').version")"
 git push origin main
+git tag v$(node -p "require('./package.json').version")
+git push origin v$(node -p "require('./package.json').version")
 ```
 
-CI publishes `beeos-claw@0.X.Y` with `dist-tag=latest`, then triggers `beeos-openclaw` to rebuild `openclaw-desktop:latest` (floating production tag, Docker convention) plus an immutable `openclaw-desktop:production-<sha>` for audit/rollback.
+The tag workflow publishes `beeos-claw@0.X.Y` with `dist-tag=latest`, then triggers `beeos-openclaw` to rebuild `openclaw-desktop:latest` (floating production tag, Docker convention) plus an immutable `openclaw-desktop:production-<sha>` for audit/rollback.
 
 ### Install from a specific channel (for local dev / debugging)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beeos-claw",
-  "version": "0.6.11",
+  "version": "0.6.12",
   "description": "OpenClaw plugin that bridges the BeeOS platform with the local OpenClaw Gateway, providing file transfer, ACP bridge, and observability.",
   "license": "MIT",
   "author": "BeeOS <dev@beeos.ai>",
@@ -42,7 +42,7 @@
     "verify:release-evidence": "node ./scripts/verify-release-evidence.mjs",
     "verify:release-types-pin": "node ./scripts/verify-release-types-pin.mjs",
     "verify:release-package": "npm run build:release && node ./scripts/verify-release-package.mjs",
-    "test:release-workflows": "node ./scripts/test-release-workflows.mjs && node --test ./scripts/openclaw-release-authority.test.mjs ./scripts/openclaw-release-dispatch.test.mjs ./scripts/openclaw-release-finalizer.test.mjs ./scripts/openclaw-release-recovery.test.mjs ./scripts/verify-openclaw-dispatch-contract.test.mjs ./scripts/verify-promotion-evidence.test.mjs ./scripts/verify-package-equivalence.test.mjs ./scripts/verify-package-equivalence.e2e.test.mjs",
+    "test:release-workflows": "node ./scripts/test-release-workflows.mjs && node --test ./scripts/verify-tag-release-request.test.mjs ./scripts/openclaw-release-authority.test.mjs ./scripts/openclaw-release-dispatch.test.mjs ./scripts/openclaw-release-finalizer.test.mjs ./scripts/openclaw-release-recovery.test.mjs ./scripts/verify-openclaw-dispatch-contract.test.mjs ./scripts/verify-promotion-evidence.test.mjs ./scripts/verify-package-equivalence.test.mjs ./scripts/verify-package-equivalence.e2e.test.mjs",
     "check:runtime-blackbox-worker": "node --check ./scripts/runtime-blackbox-worker.mjs && node --check ./scripts/runtime-blackbox-worker-main.mjs && node --check ./scripts/runtime-blackbox-worker-lifecycle.mjs && node --test ./scripts/runtime-blackbox-worker-lifecycle.test.mjs ./scripts/runtime-blackbox-worker-launcher.test.mjs",
     "prepublishOnly": "npm run verify:release-types-pin",
     "prepack": "npm run check:runtime-blackbox-worker && npm run build:release && node ./scripts/mcp-state-blackbox.mjs && node ./scripts/verify-release-package.mjs",