code-foundry 1.20.2 → 1.25.3

package/.github/workflows/release_self-ci.yml

@@ -12,32 +12,235 @@ on:
         default: false
 
 permissions:
-  actions: write
-  contents: write
-  issues: write
-  pull-requests: write
-  id-token: write
+  contents: read
+
+# One owner for draft staging and npm publication. Never cancel an active release.
+concurrency:
+  group: code-foundry-qualified-release-${{ github.repository }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   qualification:
     name: Qualify consumers
-    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
     uses: ./.github/workflows/consumer-qualification.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
     permissions:
       actions: read
       contents: read
+
+  preflight:
+    name: Verify release prerequisites
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout trusted verifier
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Require activation and verify immutability without changing it
+        env:
+          REQUIRE_IMMUTABLE_RELEASES: ${{ vars.REQUIRE_IMMUTABLE_RELEASES }}
+          CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$REQUIRE_IMMUTABLE_RELEASES" = true || { echo 'Enable and review immutable release prerequisites before this cutover.' >&2; exit 1; }
+          gh release verify --help >/dev/null
+          gh release verify-asset --help >/dev/null
+          # Match the reusable producer's credential selection. A rejected
+          # configured token must not make the later staging job use it.
+          if [ -n "$CODE_FOUNDRY_TOKEN" ] && GH_TOKEN="$CODE_FOUNDRY_TOKEN" gh api "repos/${GITHUB_REPOSITORY}" --jq '.full_name' >/dev/null 2>&1; then
+            GH_TOKEN="$CODE_FOUNDRY_TOKEN" node src/commands/release-integrity.mjs settings --repo "$GITHUB_REPOSITORY"
+          else
+            node src/commands/release-integrity.mjs settings --repo "$GITHUB_REPOSITORY"
+          fi
+
   release:
     name: Release
-    needs: qualification
-    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)
+    needs: [qualification, preflight]
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
     uses: ./.github/workflows/release.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
       runner: ubuntu-slim
       runtime-repository: 0xPlayerOne/code-foundry
       runtime-ref: ${{ github.sha }}
+      config-file: .github/release-please-foundry.json
+      defer-publication: true
+    permissions:
+      actions: write
+      contents: write
+      issues: write
+      pull-requests: write
+      # Required by the reusable legacy workflow's declared npm job, which is disabled here.
+      id-token: write
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+
+  recovery:
+    name: Recover qualified draft identity
+    needs: [qualification, release]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && needs.qualification.result == 'success' && needs.release.result == 'success'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      found: ${{ steps.recover.outputs.found }}
+      tag: ${{ steps.recover.outputs.tag }}
+      sha: ${{ steps.recover.outputs.sha }}
+    env:
+      RELEASE_CREATED: ${{ needs.release.outputs.release_created }}
+      SOURCE_SHA: ${{ needs.qualification.outputs.source-sha }}
+    steps:
+      - name: Checkout trusted recovery runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Locate an exact existing draft
+        id: recover
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from "node:fs"
+          import { resolveTagCommit, runGh } from "./src/commands/release-integrity.mjs"
+          const output = process.env.GITHUB_OUTPUT
+          const write = (found, tag = "", sha = "") => appendFileSync(output, `found=${found}\ntag=${tag}\nsha=${sha}\n`)
+          if (process.env.RELEASE_CREATED === "true") {
+            write("false")
+            process.exit(0)
+          }
+          const version = JSON.parse(readFileSync("package.json", "utf8")).version
+          const tag = `v${version}`
+          // GitHub's get-by-tag endpoint does not return draft releases. Use
+          // the authenticated release list and inspect every page instead.
+          const endpoint = `repos/${process.env.GITHUB_REPOSITORY}/releases?per_page=100`
+          const response = runGh(["api", "--paginate", "--slurp", endpoint])
+          if (response.status !== 0) throw new Error("Could not inspect the expected draft release; recovery remains blocked")
+          let pages
+          try {
+            pages = JSON.parse(response.stdout)
+          } catch {
+            throw new Error("GitHub returned an invalid release response; recovery remains blocked")
+          }
+          if (!Array.isArray(pages) || pages.some((page) => !Array.isArray(page))) {
+            throw new Error("GitHub returned an invalid release list; recovery remains blocked")
+          }
+          const release = pages.flat().find((entry) => entry?.tag_name === tag)
+          if (!release || release.draft !== true) {
+            write("false")
+            process.exit(0)
+          }
+          if (release.tag_name !== tag) throw new Error("Existing draft tag does not match the expected package version")
+          const sourceSha = resolveTagCommit(process.env.GITHUB_REPOSITORY, tag, runGh)
+          if (sourceSha.toLowerCase() !== process.env.SOURCE_SHA.toLowerCase()) throw new Error("Existing draft tag does not match the qualified source SHA")
+          write("true", tag, sourceSha)
+          NODE
+
+  stage:
+    name: Stage qualified release
+    needs: [qualification, release, recovery]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      attestations: read
+      contents: write
+    env:
+      RELEASE_TAG: ${{ needs.release.outputs.tag_name || needs.recovery.outputs.tag }}
+      RELEASE_SHA: ${{ needs.release.outputs.sha || needs.recovery.outputs.sha }}
+      SOURCE_SHA: ${{ needs.qualification.outputs.source-sha }}
+      PACKAGE: ${{ needs.qualification.outputs.filename }}
+      CANDIDATE_SHA256: ${{ needs.qualification.outputs.sha256 }}
+      CANDIDATE_ARTIFACT: ${{ needs.qualification.outputs.candidate-artifact }}
+    steps:
+      - name: Checkout trusted staging runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Require the release to identify this qualified candidate
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict'
+          import { readFileSync } from 'node:fs'
+          const env = process.env
+          const version = JSON.parse(readFileSync('package.json', 'utf8')).version
+          assert.match(env.SOURCE_SHA, /^[a-f0-9]{40}$/)
+          assert.equal(env.SOURCE_SHA, env.GITHUB_SHA)
+          assert.equal(env.RELEASE_SHA, env.SOURCE_SHA)
+          assert.equal(env.RELEASE_TAG, `v${version}`)
+          assert.equal(env.PACKAGE, `code-foundry-${version}.tgz`)
+          assert.match(env.CANDIDATE_SHA256, /^[a-f0-9]{64}$/)
+          assert.equal(env.CANDIDATE_ARTIFACT, `qualification-candidate-${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`)
+          NODE
+      - name: Retrieve only this attempt's qualified bytes and reports
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+            --name "$CANDIDATE_ARTIFACT" --dir "$RUNNER_TEMP/candidate"
+          test "$(sha256sum "$RUNNER_TEMP/candidate/$PACKAGE" | cut -d' ' -f1)" = "$CANDIDATE_SHA256"
+          for node in 20 22 24; do
+            gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+              --name "consumer-qualification-$GITHUB_RUN_ATTEMPT-node-$node" \
+              --dir "$RUNNER_TEMP/reports/$node"
+          done
+      - name: Stage identical assets then publish and verify the immutable release
+        env:
+          GH_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && secrets.CODE_FOUNDRY_TOKEN || github.token }}
+        run: |
+          set -euo pipefail
+          node src/commands/qualified-publication.mjs stage \
+            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$SOURCE_SHA" "$PACKAGE" \
+            "$RUNNER_TEMP/candidate" \
+            "$RUNNER_TEMP/reports/20/report.json" \
+            "$RUNNER_TEMP/reports/22/report.json" \
+            "$RUNNER_TEMP/reports/24/report.json" > "$RUNNER_TEMP/staging.json"
+      - name: Retain staging identity
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: release-staging-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/staging.json
+          if-no-files-found: warn
+          retention-days: 14
+
+  publish:
+    name: Publish verified package
+    needs: [qualification, release, recovery, stage]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && needs.stage.result == 'success' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    uses: ./.github/workflows/qualified-foundry-publish.yml
+    permissions:
+      actions: read
+      attestations: read
+      contents: read
+      id-token: write
+    with:
+      tag: ${{ needs.release.outputs.tag_name || needs.recovery.outputs.tag }}
+      asset: ${{ needs.qualification.outputs.filename }}
+      billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
+    secrets:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/validation-no-codeql.yml

@@ -42,6 +42,14 @@ on:
         required: false
         type: string
         default: ubuntu-slim
+      eval-runner:
+        description: >-
+          Runner used by the eval harness. Browser evals need a
+          Chrome-capable runner such as ubuntu-latest; ubuntu-slim does not
+          ship a browser.
+        required: false
+        type: string
+        default: ubuntu-latest
       codeql-runner:
         description: Runner used by CodeQL jobs.
         required: false
@@ -106,28 +114,47 @@ jobs:
       runner: ${{ inputs.test-runner }}
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
-      unit-only: ${{ inputs.mode == 'fast' }}
+      # Release pull requests change version metadata only; their content was
+      # audited on the pull requests that merged into main. Integration, E2E,
+      # smoke, and performance lanes stay in the audit and scheduled lanes.
+      unit-only: ${{ inputs.mode == 'fast' || inputs.mode == 'release' }}
       artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 
   security:
     name: Security
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'audit' || inputs.mode == 'release')
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.security-runner }}
 
+  eval:
+    name: Eval
+    # Behavior evals cover content changes; the lean release lane skips them
+    # because its diff is version metadata only. The reusable workflow skips
+    # cleanly when the repository has no eval harness.
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    uses: ./.github/workflows/eval.yml
+    with:
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      runner: ${{ inputs.eval-runner }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
+
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
-  # The release tier runs the available CI/test/security suite. Its generated
-  # release diff policy executes as a conditional step below, so no separate
-  # release-policy job renders skipped checks on ordinary pull requests.
+  # The release tier requires the available fast suite; its diff is version
+  # metadata (validated against the release policy below), its content was
+  # audited on the pull requests that merged into main, and the scheduled
+  # audit lane re-covers drift. Its generated release diff policy executes
+  # as a conditional step below, so no separate release-policy job renders
+  # skipped checks on ordinary pull requests.
   gate:
     name: Gate
-    needs: [ci, test, security]
+    needs: [ci, test, security, eval]
     if: vars.CI_BILLING_PAUSED != 'true' && always()
     runs-on: ubuntu-slim
     timeout-minutes: 10
@@ -136,6 +163,7 @@ jobs:
       FOUNDRY_CI: ${{ needs.ci.result }}
       FOUNDRY_TEST: ${{ needs.test.result }}
       FOUNDRY_SECURITY: ${{ needs.security.result }}
+      FOUNDRY_EVAL: ${{ needs.eval.result }}
       # This workflow is selected only for repositories whose canonical
       # configuration explicitly disables unavailable CodeQL. Treat that
       # policy decision as satisfied without registering a skipped PR check.

package/.github/workflows/validation.yml

@@ -42,6 +42,14 @@ on:
         required: false
         type: string
         default: ubuntu-slim
+      eval-runner:
+        description: >-
+          Runner used by the eval harness. Browser evals need a
+          Chrome-capable runner such as ubuntu-latest; ubuntu-slim does not
+          ship a browser.
+        required: false
+        type: string
+        default: ubuntu-latest
       codeql-runner:
         description: Runner used by CodeQL jobs.
         required: false
@@ -106,14 +114,17 @@ jobs:
       runner: ${{ inputs.test-runner }}
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
-      unit-only: ${{ inputs.mode == 'fast' }}
+      # Release pull requests change version metadata only; their content was
+      # audited on the pull requests that merged into main. Integration, E2E,
+      # smoke, and performance lanes stay in the audit and scheduled lanes.
+      unit-only: ${{ inputs.mode == 'fast' || inputs.mode == 'release' }}
       artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 
   security:
     name: Security
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'audit' || inputs.mode == 'release')
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -134,15 +145,30 @@ jobs:
       rust-threads: ${{ inputs.rust-threads }}
       rust-max-parallel: ${{ inputs.rust-max-parallel }}
 
+  eval:
+    name: Eval
+    # Behavior evals cover content changes; the lean release lane skips them
+    # because its diff is version metadata only. The reusable workflow skips
+    # cleanly when the repository has no eval harness.
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    uses: ./.github/workflows/eval.yml
+    with:
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      runner: ${{ inputs.eval-runner }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
+
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
-  # The release tier runs the full audit suite so Release Please pull requests
-  # expose no neutral suite checks. Its generated release diff policy executes
+  # The release tier requires the fast suite plus CodeQL: its diff is version
+  # metadata (validated against the release policy below), its content was
+  # audited on the pull requests that merged into main, and the scheduled
+  # audit lane re-covers drift. Its generated release diff policy executes
   # as a conditional step below, so ordinary pull requests still render no
   # skipped release-policy row.
   gate:
     name: Gate
-    needs: [ci, test, security, codeql]
+    needs: [ci, test, security, codeql, eval]
     if: vars.CI_BILLING_PAUSED != 'true' && always()
     runs-on: ubuntu-slim
     timeout-minutes: 10
@@ -152,6 +178,7 @@ jobs:
       FOUNDRY_TEST: ${{ needs.test.result }}
       FOUNDRY_SECURITY: ${{ needs.security.result }}
       FOUNDRY_CODEQL: ${{ needs.codeql.result }}
+      FOUNDRY_EVAL: ${{ needs.eval.result }}
     steps:
       - name: Checkout runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

package/.github/workflows/validation_audit_self-ci.yml

@@ -34,6 +34,7 @@ jobs:
       unit-runner: ubuntu-slim
       performance-runner: ubuntu-latest
       security-runner: ubuntu-slim
+      eval-runner: ubuntu-latest
       codeql-runner: ubuntu-latest
       rust-shards: '["all"]'
       rust-threads: '1'

package/.github/workflows/validation_self-ci.yml

@@ -85,6 +85,7 @@ jobs:
       unit-runner: ubuntu-slim
       performance-runner: ubuntu-latest
       security-runner: ubuntu-slim
+      eval-runner: ubuntu-latest
       codeql-runner: ubuntu-latest
       rust-shards: '["all"]'
       rust-threads: '1'

package/.gitignore

@@ -46,7 +46,7 @@ cache/
 !.github/actions/cache/action.yml
 typechain/
 coverage.json
-performance-results/
+.code-foundry/
 tests/.bin/
 **/.app/
 

package/AGENTS.md

@@ -106,7 +106,10 @@ This repository uses the `direct` workflow. Topic pull requests target `main`.
 - Keep ordinary pull requests in draft while preparing them. The generated
   Draft Guard converts ready ordinary pull requests to draft when they are
   opened or reopened, and runner-heavy validation starts only after an
-  explicit `ready_for_review` transition.
+  explicit `ready_for_review` transition unless `draft_protection: false` is
+  configured for generated callers. That opt-out does not disable Draft Guard
+  or draft-PR automation. Cloudflare reusable callers use
+  `draft-protection: false`.
 - Run local validation and finish review preparation before marking an ordinary
   pull request ready. Ready pull requests stay ready when new commits arrive,
   and validation reruns for the current head; draft updates allocate no
@@ -146,6 +149,7 @@ node src/runtime.mjs ci unit
 node src/runtime.mjs ci integration
 node src/runtime.mjs ci e2e
 node src/runtime.mjs ci smoke
+node src/runtime.mjs ci eval
 node src/runtime.mjs ci performance
 Security and dependency audits run through the GitHub Security workflow.
 ```

package/CHANGELOG.md

@@ -1,5 +1,100 @@
 # Changelog
 
+## [1.25.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.25.2...v1.25.3) (2026-09-10)
+
+
+### Bug Fixes
+
+* **release:** cover the attestation lag in publication retries ([#587](https://github.com/0xPlayerOne/code-foundry/issues/587)) ([7ae5e4b](https://github.com/0xPlayerOne/code-foundry/commit/7ae5e4bb95f68cbf4e2b48778776a0396c877271))
+
+## [1.25.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.25.1...v1.25.2) (2026-09-10)
+
+
+### Bug Fixes
+
+* **release:** retry integrity verification through the publication consistency window ([#585](https://github.com/0xPlayerOne/code-foundry/issues/585)) ([5b997dd](https://github.com/0xPlayerOne/code-foundry/commit/5b997dda7e272b59a386eeeda115e60ad284f6ce))
+
+## [1.25.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.25.0...v1.25.1) (2026-09-10)
+
+
+### Bug Fixes
+
+* **release:** wait for the release index before verifying a published release ([#583](https://github.com/0xPlayerOne/code-foundry/issues/583)) ([7823c14](https://github.com/0xPlayerOne/code-foundry/commit/7823c1473d8c5e7c17b039dc755ff5c8d1dba39c))
+
+## [1.25.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.24.0...v1.25.0) (2026-09-10)
+
+
+### Features
+
+* **eval:** run the eval tier as a managed Validation / Eval lane ([#580](https://github.com/0xPlayerOne/code-foundry/issues/580)) ([9414889](https://github.com/0xPlayerOne/code-foundry/commit/94148894da9a627a6bd7c71c846848c198c1dfec))
+
+## [1.24.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.23.0...v1.24.0) (2026-09-10)
+
+
+### Features
+
+* **validation:** run a lean release lane for Release Please pull requests ([#579](https://github.com/0xPlayerOne/code-foundry/issues/579)) ([a38ca75](https://github.com/0xPlayerOne/code-foundry/commit/a38ca75c7da577af8368467b8b026d0ec563fc41))
+
+## [1.23.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.22.1...v1.23.0) (2026-09-09)
+
+
+### Features
+
+* add ci eval tier with shared report contract and budget gate ([#576](https://github.com/0xPlayerOne/code-foundry/issues/576)) ([7d881dd](https://github.com/0xPlayerOne/code-foundry/commit/7d881dd1bc6ace8e48dffff45b1a22a12bdae1c9))
+
+## [1.22.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.22.0...v1.22.1) (2026-09-09)
+
+
+### Bug Fixes
+
+* **release:** use shell-safe recovery script ([#574](https://github.com/0xPlayerOne/code-foundry/issues/574)) ([264036f](https://github.com/0xPlayerOne/code-foundry/commit/264036f34afa4d7bc405285918395f2ce075bde3))
+
+## [1.22.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.21.3...v1.22.0) (2026-09-09)
+
+
+### Features
+
+* **workflows:** protect draft pull requests by default ([#572](https://github.com/0xPlayerOne/code-foundry/issues/572)) ([6fa4ce1](https://github.com/0xPlayerOne/code-foundry/commit/6fa4ce1b2dde5eddff361b819722912fed7a9815))
+
+## [1.21.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.21.2...v1.21.3) (2026-09-09)
+
+
+### Bug Fixes
+
+* **release:** unblock draft publication and PR deployment links ([#570](https://github.com/0xPlayerOne/code-foundry/issues/570)) ([35ab90f](https://github.com/0xPlayerOne/code-foundry/commit/35ab90f185483b0cd6a9c622b9793e46c90dd60c))
+
+## [1.21.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.21.1...v1.21.2) (2026-09-09)
+
+
+### Documentation
+
+* refresh documentation for current workflows ([#568](https://github.com/0xPlayerOne/code-foundry/issues/568)) ([d0028e0](https://github.com/0xPlayerOne/code-foundry/commit/d0028e096371e1019c466f72f8744bdf832e067c))
+
+## [1.21.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.21.0...v1.21.1) (2026-09-09)
+
+
+### Bug Fixes
+
+* release-hook-and-performance-safety ([#565](https://github.com/0xPlayerOne/code-foundry/issues/565)) ([0d410c6](https://github.com/0xPlayerOne/code-foundry/commit/0d410c68abfbc0d9fdd03b7aa81676489e459c19))
+* **release:** automate self publication after CI ([91b2655](https://github.com/0xPlayerOne/code-foundry/commit/91b265585aa03e742e5bfc8a839b2794bf234491))
+
+
+### Performance
+
+* **ci:** batch native Rust test targets by category ([#564](https://github.com/0xPlayerOne/code-foundry/issues/564)) ([6def882](https://github.com/0xPlayerOne/code-foundry/commit/6def8826e90b23d021a4f4587fa843dbb37df0e7))
+
+## [1.21.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.20.2...v1.21.0) (2026-09-09)
+
+
+### Features
+
+* **release:** wire qualified draft staging and immutable publication ([#558](https://github.com/0xPlayerOne/code-foundry/issues/558)) ([19aea32](https://github.com/0xPlayerOne/code-foundry/commit/19aea32f50c747cdc5642d1752a9f02008c157f6))
+
+
+### Bug Fixes
+
+* **quality:** harden HTML filtering ([#562](https://github.com/0xPlayerOne/code-foundry/issues/562)) ([ea45590](https://github.com/0xPlayerOne/code-foundry/commit/ea45590db24dc05ef12db57e80c7405fa217514f))
+
 ## [1.20.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.20.1...v1.20.2) (2026-09-09)
 
 

package/README.md

@@ -39,6 +39,9 @@ contract. For normal updates, edit that file and run `npx code-foundry sync`.
   audits, Draft Guard, Draft PR, Release PR, and Release.
 - A deterministic performance lane with ordered command support, stable result
   artifacts, and an optional shared Node package budget profile.
+- A deterministic eval tier (`ci eval`) that runs a repository's behavior-eval
+  harness against a shared report contract with optional budgets, keeping task
+  outcomes comparable across revisions and executors.
 - An opt-in product-quality runner for static sites, web apps, Workers, and
   published packages.
 - A small `.githooks/pre-commit` launcher with language-aware formatting and
@@ -58,7 +61,7 @@ preserved and can coexist with the standard baseline.
 The generated configuration is the one place to control the baseline. See
 [Configuration reference](docs/CONFIGURATION.md) for the visual configuration
 guide and [Initialization and synchronization](docs/INITIALIZATION.md) for
-the two-command workflow.
+the init, sync, and doctor workflow.
 
 New repositories default to GPL-3.0-or-later. Existing projects preserve an
 authored license unless a replacement is explicitly selected. Our maintained
@@ -82,9 +85,11 @@ PRs: it converts them to drafts without checking out PR code. It verifies the
 event head and update timestamp before changing state, and excludes Release
 Please version PRs whose release workflow owns readiness. Pull-request
 validation runs on the ready-for-review transition and on new commits while a
-PR remains ready; draft updates allocate no validation runner. Converting a PR
-to draft runs only the lightweight cancellation control. Scheduled and manually
-dispatched audits are unaffected.
+PR remains ready; draft updates allocate no validation runner by default. Set
+`draft_protection: false` in generated consumer configuration, or pass
+`draft-protection: false` to a Cloudflare reusable workflow, to run those gates
+for drafts. Converting a PR to draft runs only the lightweight cancellation
+control. Scheduled and manually dispatched audits are unaffected.
 
 Jobs are language-aware and skip irrelevant setup inside the applicable
 aggregate checks. TypeScript uses Oxlint, Oxfmt, and Bun's native
@@ -125,9 +130,16 @@ workflow runs.
 In the default `direct` flow, changes reach `main` through feature pull
 requests and Release Please opens a versioned release PR against `main`. In
 the `staging-release` flow, a promotion PR promotes `staging` into `main`
-first. Either way, Release Please creates a GitHub release after the version
-PR is merged. npm publication is opt-in through `npm_publish: true` and
-supports npm trusted publishing or an `NPM_TOKEN` fallback.
+first. Generated consumer callers create a GitHub release after the version PR
+is merged; npm publication is opt-in through `npm_publish: true` and supports
+npm trusted publishing or an `NPM_TOKEN` fallback.
+
+Code Foundry's own release caller is stricter: it qualifies the package across
+Node 20, 22, and 24, stages the exact qualified archive, publishes the
+immutable GitHub Release, and publishes that archive through the verified
+publisher. See
+[Consumer qualification](docs/consumer-qualification.md) and [Qualified
+publication](docs/qualified-publication.md).
 
 Read [Release management](docs/RELEASES.md),
 [Release integrity and build provenance](docs/release-integrity.md), and
@@ -137,16 +149,10 @@ copied into other repositories.
 
 ## Documentation and extensions
 
-The `docs/` directory contains generalized operational guides. Add
-repository-specific documentation there as well; synchronization does not
-replace files in `docs/`.
-
-- [Documentation index](docs/README.md)
-- [Initialization and synchronization](docs/INITIALIZATION.md)
-- [Workflow and CI conventions](docs/WORKFLOWS.md)
-- [Release management](docs/RELEASES.md)
-- [Publishing packages](docs/PUBLISHING.md)
-- [Caching and remote caching](docs/CACHING.md)
+The `docs/` directory contains generalized operational guides. Start with the
+[documentation index](docs/README.md), which groups every guide by task. Add
+repository-specific documentation there as well; synchronization preserves
+files in `docs/`.
 
 ## License