code-foundry 1.20.1 → 1.22.1

package/.github/workflows/release_self-ci.yml

@@ -12,32 +12,235 @@ on:
         default: false
 
 permissions:
-  actions: write
-  contents: write
-  issues: write
-  pull-requests: write
-  id-token: write
+  contents: read
+
+# One owner for draft staging and npm publication. Never cancel an active release.
+concurrency:
+  group: code-foundry-qualified-release-${{ github.repository }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   qualification:
     name: Qualify consumers
-    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
     uses: ./.github/workflows/consumer-qualification.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
     permissions:
       actions: read
       contents: read
+
+  preflight:
+    name: Verify release prerequisites
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout trusted verifier
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Require activation and verify immutability without changing it
+        env:
+          REQUIRE_IMMUTABLE_RELEASES: ${{ vars.REQUIRE_IMMUTABLE_RELEASES }}
+          CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$REQUIRE_IMMUTABLE_RELEASES" = true || { echo 'Enable and review immutable release prerequisites before this cutover.' >&2; exit 1; }
+          gh release verify --help >/dev/null
+          gh release verify-asset --help >/dev/null
+          # Match the reusable producer's credential selection. A rejected
+          # configured token must not make the later staging job use it.
+          if [ -n "$CODE_FOUNDRY_TOKEN" ] && GH_TOKEN="$CODE_FOUNDRY_TOKEN" gh api "repos/${GITHUB_REPOSITORY}" --jq '.full_name' >/dev/null 2>&1; then
+            GH_TOKEN="$CODE_FOUNDRY_TOKEN" node src/commands/release-integrity.mjs settings --repo "$GITHUB_REPOSITORY"
+          else
+            node src/commands/release-integrity.mjs settings --repo "$GITHUB_REPOSITORY"
+          fi
+
   release:
     name: Release
-    needs: qualification
-    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)
+    needs: [qualification, preflight]
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
     uses: ./.github/workflows/release.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
       runner: ubuntu-slim
       runtime-repository: 0xPlayerOne/code-foundry
       runtime-ref: ${{ github.sha }}
+      config-file: .github/release-please-foundry.json
+      defer-publication: true
+    permissions:
+      actions: write
+      contents: write
+      issues: write
+      pull-requests: write
+      # Required by the reusable legacy workflow's declared npm job, which is disabled here.
+      id-token: write
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+
+  recovery:
+    name: Recover qualified draft identity
+    needs: [qualification, release]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && needs.qualification.result == 'success' && needs.release.result == 'success'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      found: ${{ steps.recover.outputs.found }}
+      tag: ${{ steps.recover.outputs.tag }}
+      sha: ${{ steps.recover.outputs.sha }}
+    env:
+      RELEASE_CREATED: ${{ needs.release.outputs.release_created }}
+      SOURCE_SHA: ${{ needs.qualification.outputs.source-sha }}
+    steps:
+      - name: Checkout trusted recovery runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Locate an exact existing draft
+        id: recover
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from "node:fs"
+          import { resolveTagCommit, runGh } from "./src/commands/release-integrity.mjs"
+          const output = process.env.GITHUB_OUTPUT
+          const write = (found, tag = "", sha = "") => appendFileSync(output, `found=${found}\ntag=${tag}\nsha=${sha}\n`)
+          if (process.env.RELEASE_CREATED === "true") {
+            write("false")
+            process.exit(0)
+          }
+          const version = JSON.parse(readFileSync("package.json", "utf8")).version
+          const tag = `v${version}`
+          // GitHub's get-by-tag endpoint does not return draft releases. Use
+          // the authenticated release list and inspect every page instead.
+          const endpoint = `repos/${process.env.GITHUB_REPOSITORY}/releases?per_page=100`
+          const response = runGh(["api", "--paginate", "--slurp", endpoint])
+          if (response.status !== 0) throw new Error("Could not inspect the expected draft release; recovery remains blocked")
+          let pages
+          try {
+            pages = JSON.parse(response.stdout)
+          } catch {
+            throw new Error("GitHub returned an invalid release response; recovery remains blocked")
+          }
+          if (!Array.isArray(pages) || pages.some((page) => !Array.isArray(page))) {
+            throw new Error("GitHub returned an invalid release list; recovery remains blocked")
+          }
+          const release = pages.flat().find((entry) => entry?.tag_name === tag)
+          if (!release || release.draft !== true) {
+            write("false")
+            process.exit(0)
+          }
+          if (release.tag_name !== tag) throw new Error("Existing draft tag does not match the expected package version")
+          const sourceSha = resolveTagCommit(process.env.GITHUB_REPOSITORY, tag, runGh)
+          if (sourceSha.toLowerCase() !== process.env.SOURCE_SHA.toLowerCase()) throw new Error("Existing draft tag does not match the qualified source SHA")
+          write("true", tag, sourceSha)
+          NODE
+
+  stage:
+    name: Stage qualified release
+    needs: [qualification, release, recovery]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      attestations: read
+      contents: write
+    env:
+      RELEASE_TAG: ${{ needs.release.outputs.tag_name || needs.recovery.outputs.tag }}
+      RELEASE_SHA: ${{ needs.release.outputs.sha || needs.recovery.outputs.sha }}
+      SOURCE_SHA: ${{ needs.qualification.outputs.source-sha }}
+      PACKAGE: ${{ needs.qualification.outputs.filename }}
+      CANDIDATE_SHA256: ${{ needs.qualification.outputs.sha256 }}
+      CANDIDATE_ARTIFACT: ${{ needs.qualification.outputs.candidate-artifact }}
+    steps:
+      - name: Checkout trusted staging runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Require the release to identify this qualified candidate
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict'
+          import { readFileSync } from 'node:fs'
+          const env = process.env
+          const version = JSON.parse(readFileSync('package.json', 'utf8')).version
+          assert.match(env.SOURCE_SHA, /^[a-f0-9]{40}$/)
+          assert.equal(env.SOURCE_SHA, env.GITHUB_SHA)
+          assert.equal(env.RELEASE_SHA, env.SOURCE_SHA)
+          assert.equal(env.RELEASE_TAG, `v${version}`)
+          assert.equal(env.PACKAGE, `code-foundry-${version}.tgz`)
+          assert.match(env.CANDIDATE_SHA256, /^[a-f0-9]{64}$/)
+          assert.equal(env.CANDIDATE_ARTIFACT, `qualification-candidate-${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`)
+          NODE
+      - name: Retrieve only this attempt's qualified bytes and reports
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+            --name "$CANDIDATE_ARTIFACT" --dir "$RUNNER_TEMP/candidate"
+          test "$(sha256sum "$RUNNER_TEMP/candidate/$PACKAGE" | cut -d' ' -f1)" = "$CANDIDATE_SHA256"
+          for node in 20 22 24; do
+            gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+              --name "consumer-qualification-$GITHUB_RUN_ATTEMPT-node-$node" \
+              --dir "$RUNNER_TEMP/reports/$node"
+          done
+      - name: Stage identical assets then publish and verify the immutable release
+        env:
+          GH_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && secrets.CODE_FOUNDRY_TOKEN || github.token }}
+        run: |
+          set -euo pipefail
+          node src/commands/qualified-publication.mjs stage \
+            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$SOURCE_SHA" "$PACKAGE" \
+            "$RUNNER_TEMP/candidate" \
+            "$RUNNER_TEMP/reports/20/report.json" \
+            "$RUNNER_TEMP/reports/22/report.json" \
+            "$RUNNER_TEMP/reports/24/report.json" > "$RUNNER_TEMP/staging.json"
+      - name: Retain staging identity
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: release-staging-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/staging.json
+          if-no-files-found: warn
+          retention-days: 14
+
+  publish:
+    name: Publish verified package
+    needs: [qualification, release, recovery, stage]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && needs.stage.result == 'success' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    uses: ./.github/workflows/qualified-foundry-publish.yml
+    permissions:
+      actions: read
+      attestations: read
+      contents: read
+      id-token: write
+    with:
+      tag: ${{ needs.release.outputs.tag_name || needs.recovery.outputs.tag }}
+      asset: ${{ needs.qualification.outputs.filename }}
+      billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
+    secrets:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/test.yml

@@ -33,6 +33,11 @@ on:
         required: false
         type: boolean
         default: false
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -104,8 +109,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Unit
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci unit
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/unit.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-unit
+          path: .code-foundry/results/unit.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
       - name: Upload coverage
         if: >-
           always() &&
@@ -171,8 +190,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Performance
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci performance
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/performance.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-performance
+          path: .code-foundry/results/performance.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
       - name: Upload performance results
         if: >-
           always() &&
@@ -236,8 +269,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Integration
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci integration
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/integration.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-integration
+          path: .code-foundry/results/integration.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   e2e:
     name: E2E
@@ -298,8 +345,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: E2E
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci e2e
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/e2e.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-e2e
+          path: .code-foundry/results/e2e.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   smoke:
     name: Smoke
@@ -348,5 +409,19 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Smoke
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci smoke
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/smoke.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-smoke
+          path: .code-foundry/results/smoke.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14

package/.github/workflows/validation-no-codeql.yml

@@ -62,6 +62,11 @@ on:
         required: false
         type: number
         default: 1
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -86,6 +91,7 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.ci-runner }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -101,6 +107,7 @@ jobs:
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
       unit-only: ${{ inputs.mode == 'fast' }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 

package/.github/workflows/validation.yml

@@ -62,6 +62,11 @@ on:
         required: false
         type: number
         default: 1
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -86,6 +91,7 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.ci-runner }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -101,6 +107,7 @@ jobs:
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
       unit-only: ${{ inputs.mode == 'fast' }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 

package/.gitignore

@@ -46,7 +46,7 @@ cache/
 !.github/actions/cache/action.yml
 typechain/
 coverage.json
-performance-results/
+.code-foundry/
 tests/.bin/
 **/.app/
 

package/AGENTS.md

@@ -106,7 +106,10 @@ This repository uses the `direct` workflow. Topic pull requests target `main`.
 - Keep ordinary pull requests in draft while preparing them. The generated
   Draft Guard converts ready ordinary pull requests to draft when they are
   opened or reopened, and runner-heavy validation starts only after an
-  explicit `ready_for_review` transition.
+  explicit `ready_for_review` transition unless `draft_protection: false` is
+  configured for generated callers. That opt-out does not disable Draft Guard
+  or draft-PR automation. Cloudflare reusable callers use
+  `draft-protection: false`.
 - Run local validation and finish review preparation before marking an ordinary
   pull request ready. Ready pull requests stay ready when new commits arrive,
   and validation reruns for the current head; draft updates allocate no

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog
 
+## [1.22.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.22.0...v1.22.1) (2026-09-09)
+
+
+### Bug Fixes
+
+* **release:** use shell-safe recovery script ([#574](https://github.com/0xPlayerOne/code-foundry/issues/574)) ([264036f](https://github.com/0xPlayerOne/code-foundry/commit/264036f34afa4d7bc405285918395f2ce075bde3))
+
+## [1.22.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.21.3...v1.22.0) (2026-09-09)
+
+
+### Features
+
+* **workflows:** protect draft pull requests by default ([#572](https://github.com/0xPlayerOne/code-foundry/issues/572)) ([6fa4ce1](https://github.com/0xPlayerOne/code-foundry/commit/6fa4ce1b2dde5eddff361b819722912fed7a9815))
+
+## [1.21.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.21.2...v1.21.3) (2026-09-09)
+
+
+### Bug Fixes
+
+* **release:** unblock draft publication and PR deployment links ([#570](https://github.com/0xPlayerOne/code-foundry/issues/570)) ([35ab90f](https://github.com/0xPlayerOne/code-foundry/commit/35ab90f185483b0cd6a9c622b9793e46c90dd60c))
+
+## [1.21.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.21.1...v1.21.2) (2026-09-09)
+
+
+### Documentation
+
+* refresh documentation for current workflows ([#568](https://github.com/0xPlayerOne/code-foundry/issues/568)) ([d0028e0](https://github.com/0xPlayerOne/code-foundry/commit/d0028e096371e1019c466f72f8744bdf832e067c))
+
+## [1.21.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.21.0...v1.21.1) (2026-09-09)
+
+
+### Bug Fixes
+
+* release-hook-and-performance-safety ([#565](https://github.com/0xPlayerOne/code-foundry/issues/565)) ([0d410c6](https://github.com/0xPlayerOne/code-foundry/commit/0d410c68abfbc0d9fdd03b7aa81676489e459c19))
+* **release:** automate self publication after CI ([91b2655](https://github.com/0xPlayerOne/code-foundry/commit/91b265585aa03e742e5bfc8a839b2794bf234491))
+
+
+### Performance
+
+* **ci:** batch native Rust test targets by category ([#564](https://github.com/0xPlayerOne/code-foundry/issues/564)) ([6def882](https://github.com/0xPlayerOne/code-foundry/commit/6def8826e90b23d021a4f4587fa843dbb37df0e7))
+
+## [1.21.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.20.2...v1.21.0) (2026-09-09)
+
+
+### Features
+
+* **release:** wire qualified draft staging and immutable publication ([#558](https://github.com/0xPlayerOne/code-foundry/issues/558)) ([19aea32](https://github.com/0xPlayerOne/code-foundry/commit/19aea32f50c747cdc5642d1752a9f02008c157f6))
+
+
+### Bug Fixes
+
+* **quality:** harden HTML filtering ([#562](https://github.com/0xPlayerOne/code-foundry/issues/562)) ([ea45590](https://github.com/0xPlayerOne/code-foundry/commit/ea45590db24dc05ef12db57e80c7405fa217514f))
+
+## [1.20.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.20.1...v1.20.2) (2026-09-09)
+
+
+### Bug Fixes
+
+* **ci:** retain scoped task receipts across success and failure ([#557](https://github.com/0xPlayerOne/code-foundry/issues/557)) ([ee0fe45](https://github.com/0xPlayerOne/code-foundry/commit/ee0fe45e821621e3193831d70a533077b7bcf8a9))
+
 ## [1.20.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.20.0...v1.20.1) (2026-09-09)
 
 

package/README.md

@@ -58,7 +58,7 @@ preserved and can coexist with the standard baseline.
 The generated configuration is the one place to control the baseline. See
 [Configuration reference](docs/CONFIGURATION.md) for the visual configuration
 guide and [Initialization and synchronization](docs/INITIALIZATION.md) for
-the two-command workflow.
+the init, sync, and doctor workflow.
 
 New repositories default to GPL-3.0-or-later. Existing projects preserve an
 authored license unless a replacement is explicitly selected. Our maintained
@@ -82,9 +82,11 @@ PRs: it converts them to drafts without checking out PR code. It verifies the
 event head and update timestamp before changing state, and excludes Release
 Please version PRs whose release workflow owns readiness. Pull-request
 validation runs on the ready-for-review transition and on new commits while a
-PR remains ready; draft updates allocate no validation runner. Converting a PR
-to draft runs only the lightweight cancellation control. Scheduled and manually
-dispatched audits are unaffected.
+PR remains ready; draft updates allocate no validation runner by default. Set
+`draft_protection: false` in generated consumer configuration, or pass
+`draft-protection: false` to a Cloudflare reusable workflow, to run those gates
+for drafts. Converting a PR to draft runs only the lightweight cancellation
+control. Scheduled and manually dispatched audits are unaffected.
 
 Jobs are language-aware and skip irrelevant setup inside the applicable
 aggregate checks. TypeScript uses Oxlint, Oxfmt, and Bun's native
@@ -125,9 +127,16 @@ workflow runs.
 In the default `direct` flow, changes reach `main` through feature pull
 requests and Release Please opens a versioned release PR against `main`. In
 the `staging-release` flow, a promotion PR promotes `staging` into `main`
-first. Either way, Release Please creates a GitHub release after the version
-PR is merged. npm publication is opt-in through `npm_publish: true` and
-supports npm trusted publishing or an `NPM_TOKEN` fallback.
+first. Generated consumer callers create a GitHub release after the version PR
+is merged; npm publication is opt-in through `npm_publish: true` and supports
+npm trusted publishing or an `NPM_TOKEN` fallback.
+
+Code Foundry's own release caller is stricter: it qualifies the package across
+Node 20, 22, and 24, stages the exact qualified archive, publishes the
+immutable GitHub Release, and publishes that archive through the verified
+publisher. See
+[Consumer qualification](docs/consumer-qualification.md) and [Qualified
+publication](docs/qualified-publication.md).
 
 Read [Release management](docs/RELEASES.md),
 [Release integrity and build provenance](docs/release-integrity.md), and
@@ -137,16 +146,10 @@ copied into other repositories.
 
 ## Documentation and extensions
 
-The `docs/` directory contains generalized operational guides. Add
-repository-specific documentation there as well; synchronization does not
-replace files in `docs/`.
-
-- [Documentation index](docs/README.md)
-- [Initialization and synchronization](docs/INITIALIZATION.md)
-- [Workflow and CI conventions](docs/WORKFLOWS.md)
-- [Release management](docs/RELEASES.md)
-- [Publishing packages](docs/PUBLISHING.md)
-- [Caching and remote caching](docs/CACHING.md)
+The `docs/` directory contains generalized operational guides. Start with the
+[documentation index](docs/README.md), which groups every guide by task. Add
+repository-specific documentation there as well; synchronization preserves
+files in `docs/`.
 
 ## License