code-foundry 1.48.7 → 1.50.0

package/.github/workflows/validation.yml

@@ -7,6 +7,11 @@ on:
         description: Validation tier (fast, audit, or release).
         required: true
         type: string
+      release-qualification-receipts:
+        description: Reuse a recent exact-tree audit receipt for Release Please PRs.
+        required: false
+        type: boolean
+        default: false
       runtime-repository:
         description: Repository containing the Code Foundry runtime.
         required: false
@@ -70,6 +75,11 @@ on:
         required: false
         type: number
         default: 1
+      integration-total-shards:
+        description: Integration partitions (1 or 2); sharded scripts must honor INTEGRATION_SHARD_INDEX and INTEGRATION_TOTAL_SHARDS.
+        required: false
+        type: string
+        default: '1'
       e2e-shard-list:
         description: Comma-separated E2E shard indices passed to the test lane's matrix, e.g. "1,2".
         required: false
@@ -98,12 +108,35 @@ permissions:
   actions: read
   contents: read
   packages: read
+  pull-requests: read
   security-events: write
 
 jobs:
+  qualification:
+    name: Qualification
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      inputs.release-qualification-receipts == true && inputs.mode == 'release'
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/qualification-receipt.yml
+    with:
+      phase: verify
+      mode: ${{ inputs.mode }}
+      enabled: ${{ inputs.release-qualification-receipts }}
+      codeql-enabled: true
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      required-job-names-json: '["Validation / Gate"]'
+
   ci:
     name: CI
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    needs: qualification
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
     # Type-Check reads the issue-backed requirements ledger with github.token.
     permissions:
       actions: read
@@ -116,13 +149,23 @@ jobs:
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.ci-runner }}
       artifact-prefix: ${{ inputs.artifact-prefix }}
+      release-build-only: ${{ inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true' }}
+      release-package-check: ${{ inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true' }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
 
   test:
     name: Test
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    needs: qualification
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs.mode == 'fast' || inputs.mode == 'audit' ||
+      (inputs.mode == 'release' && needs.qualification.outputs.reuse != 'true'))
+    permissions:
+      actions: read
+      contents: read
+      packages: read
     uses: ./.github/workflows/test.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -130,11 +173,12 @@ jobs:
       runner: ${{ inputs.test-runner }}
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
-      # Release pull requests change version metadata only; their content was
-      # audited on the pull requests that merged into main. Integration, E2E,
-      # smoke, and performance lanes stay in the audit and scheduled lanes.
+      # Fast and Release Please pull requests run unit tests only. Until a
+      # successful full qualification is verifiable for the exact main tree,
+      # release mode keeps its CI and unit-test fallback.
       unit-only: ${{ inputs.mode == 'fast' || inputs.mode == 'release' }}
       artifact-prefix: ${{ inputs.artifact-prefix }}
+      integration-total-shards: ${{ inputs.integration-total-shards }}
       e2e-shard-list: ${{ inputs.e2e-shard-list }}
       e2e-total-shards: ${{ inputs.e2e-total-shards }}
     secrets:
@@ -143,6 +187,8 @@ jobs:
   security:
     name: Security
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    permissions:
+      contents: read
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -154,6 +200,11 @@ jobs:
     # Release-please pull requests also analyze with CodeQL so repository
     # rulesets requiring code scanning results never deadlock the release.
     if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'audit' || inputs.mode == 'release')
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
     uses: ./.github/workflows/codeql.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -165,10 +216,12 @@ jobs:
 
   eval:
     name: Eval
-    # Behavior evals cover content changes; the lean release lane skips them
-    # because its diff is version metadata only. The reusable workflow skips
-    # cleanly when the repository has no eval harness.
+    # Behavior evals are part of audit qualification. A release-only run may
+    # reuse that work only through the exact, unexpired source receipt below.
+    # The reusable workflow skips cleanly when there is no eval harness.
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    permissions:
+      contents: read
     uses: ./.github/workflows/eval.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -178,16 +231,16 @@ jobs:
 
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
-  # The release tier requires the fast suite plus CodeQL: its diff is version
-  # metadata (validated against the release policy below), its content was
-  # audited on the pull requests that merged into main, and the scheduled
-  # audit lane re-covers drift. Its generated release diff policy executes
-  # as a conditional step below, so ordinary pull requests still render no
-  # skipped release-policy row.
+  # Release Please branches require CI, CodeQL, and the exact generated-diff
+  # audit below. The runtime gate also requires unit tests unless the separate
+  # qualification job verified a matching source receipt. Ordinary PRs still
+  # render no skipped release-policy row.
   gate:
     name: Gate
-    needs: [ci, test, security, codeql, eval]
+    needs: [ci, test, security, codeql, eval, qualification]
     if: vars.CI_BILLING_PAUSED != 'true' && always()
+    permissions:
+      contents: read
     runs-on: ubuntu-slim
     timeout-minutes: 10
     env:
@@ -197,6 +250,8 @@ jobs:
       FOUNDRY_SECURITY: ${{ needs.security.result }}
       FOUNDRY_CODEQL: ${{ needs.codeql.result }}
       FOUNDRY_EVAL: ${{ needs.eval.result }}
+      FOUNDRY_SOURCE_QUALIFICATION: ${{ needs.qualification.outputs.reuse }}
+      FOUNDRY_QUALIFICATION: ${{ needs.qualification.result }}
     steps:
       - name: Checkout runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -216,8 +271,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # The content audit needs historical blobs after checkout removes credentials.
           fetch-depth: 0
-          filter: blob:none
       - name: Validate generated release diff
         if: ${{ inputs.mode == 'release' }}
         env:
@@ -228,3 +283,29 @@ jobs:
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation release_diff
       - name: Evaluate aggregate gate
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation gate
+
+  qualification-receipt:
+    name: Qualification receipt
+    needs: [ci, test, security, codeql, eval, gate]
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
+      inputs.release-qualification-receipts == true &&
+      github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' &&
+      needs.ci.result == 'success' && needs.test.result == 'success' &&
+      needs.security.result == 'success' && needs.codeql.result == 'success' &&
+      needs.eval.result == 'success' && needs.gate.result == 'success'
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/qualification-receipt.yml
+    with:
+      phase: produce
+      mode: ${{ inputs.mode }}
+      enabled: ${{ inputs.release-qualification-receipts }}
+      codeql-enabled: true
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      job-results-json: >-
+        {"ci":"${{ needs.ci.result }}","test":"${{ needs.test.result }}","security":"${{ needs.security.result }}","codeql":"${{ needs.codeql.result }}","eval":"${{ needs.eval.result }}","gate":"${{ needs.gate.result }}"}
+      required-job-names-json: '["Validation / Gate"]'

package/.github/workflows/validation_self-ci.yml

@@ -80,15 +80,17 @@ jobs:
       contents: read
       issues: read
       packages: read
+      pull-requests: read
       security-events: write
     uses: ./.github/workflows/validation.yml
     with:
       mode: ${{ needs.mode.outputs.mode }}
       runtime-repository: 0xPlayerOne/code-foundry
-      # Pull requests validate the proposed runtime commit. Scheduled and
-      # manually dispatched audits use a separate default-branch-pinned caller,
-      # so this caller-selected ref never runs with default-branch cache access.
-      runtime-ref: ${{ github.sha }}
+      # Source PRs validate their proposed runtime commit. A Release Please PR
+      # uses its main base, keeping version-only metadata out of the runtime
+      # content identity. Scheduled audits use a separate default-branch caller.
+      runtime-ref: >-
+        ${{ startsWith(github.event.pull_request.head.ref, 'release-please--branches--main') && github.event.pull_request.base.sha || github.sha }}
       ci-runner: ubuntu-latest
       test-runner: ubuntu-latest
       unit-runner: ubuntu-slim
@@ -101,6 +103,7 @@ jobs:
       rust-max-parallel: 1
       # The sync renderer rewrites both values from the e2e_shards config key;
       # the defaults keep repositories without that key on one unsharded job.
+      integration-total-shards: '1'
       e2e-shard-list: '1'
       e2e-total-shards: '1'
     secrets:

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## [1.50.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.3...v1.50.0) (2026-10-29)
+
+
+### Features
+
+* **release:** support npm OIDC publishing ([#791](https://github.com/0xPlayerOne/code-foundry/issues/791)) ([74b5155](https://github.com/0xPlayerOne/code-foundry/commit/74b5155157b9f163d70b00b138673c981e19c925))
+
+## [1.49.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.2...v1.49.3) (2026-10-29)
+
+
+### CI
+
+* **validation:** require release checks until evidence exists ([#789](https://github.com/0xPlayerOne/code-foundry/issues/789)) ([a5f8be6](https://github.com/0xPlayerOne/code-foundry/commit/a5f8be64b7b28d2248aa71b80e321aa0fe82f30a))
+
+## [1.49.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.1...v1.49.2) (2026-10-29)
+
+
+### Bug Fixes
+
+* safely categorize npm publication failures ([#787](https://github.com/0xPlayerOne/code-foundry/issues/787)) ([a4268af](https://github.com/0xPlayerOne/code-foundry/commit/a4268af5ce7cd0a32407420424419c0cad01dce8))
+
+## [1.49.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.0...v1.49.1) (2026-10-28)
+
+
+### Bug Fixes
+
+* handle empty security audit matrices ([#785](https://github.com/0xPlayerOne/code-foundry/issues/785)) ([02f0565](https://github.com/0xPlayerOne/code-foundry/commit/02f05652e68267a2aa2df5d5af8f13df9ba1e3aa))
+
+## [1.49.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.9...v1.49.0) (2026-10-27)
+
+
+### Features
+
+* support isolated integration test shards ([#783](https://github.com/0xPlayerOne/code-foundry/issues/783)) ([ad1123f](https://github.com/0xPlayerOne/code-foundry/commit/ad1123ff3bb9654bfbdaef4219490cca3e7e3d20))
+
+## [1.48.9](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.8...v1.48.9) (2026-10-26)
+
+
+### Bug Fixes
+
+* **release:** preserve fallback stdin and paginate existing releases ([#781](https://github.com/0xPlayerOne/code-foundry/issues/781)) ([ede4d2c](https://github.com/0xPlayerOne/code-foundry/commit/ede4d2c7e3bc7d1174580c9a0bc83bdaa160c2da))
+
+## [1.48.8](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.7...v1.48.8) (2026-10-24)
+
+
+### Bug Fixes
+
+* **release:** hydrate audit blobs and refresh changing PR state ([#779](https://github.com/0xPlayerOne/code-foundry/issues/779)) ([8734ed7](https://github.com/0xPlayerOne/code-foundry/commit/8734ed77d159818cd5ff613f40a5dab796789d8a))
+
 ## [1.48.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.6...v1.48.7) (2026-10-23)
 
 
@@ -91,58 +140,9 @@
 
 * **doctor:** pin the machine-hook shadow warning ([#753](https://github.com/0xPlayerOne/code-foundry/issues/753)) ([f634269](https://github.com/0xPlayerOne/code-foundry/commit/f634269424580d8d34323319288747587b6d6ae3))
 
-## [1.47.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.6...v1.47.0) (2026-10-08)
-
-
-### Features
-
-* **release:** configurable dev channel on top of batched releases ([#749](https://github.com/0xPlayerOne/code-foundry/issues/749)) ([8fd8556](https://github.com/0xPlayerOne/code-foundry/commit/8fd85567a1a89735ab0db589649741253fbbeb21)), closes [#699](https://github.com/0xPlayerOne/code-foundry/issues/699)
-
-## [1.46.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.5...v1.46.6) (2026-10-08)
-
-
-### Bug Fixes
-
-* **pre-commit:** build before lint and type-check when the gate opts in ([#748](https://github.com/0xPlayerOne/code-foundry/issues/748)) ([f56454f](https://github.com/0xPlayerOne/code-foundry/commit/f56454f313a1a5b802b8a17b09d850902de1ba55)), closes [#691](https://github.com/0xPlayerOne/code-foundry/issues/691)
-
-## [1.46.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.4...v1.46.5) (2026-10-08)
-
-
-### Bug Fixes
-
-* **sync:** chain machine-level hooks instead of silencing them ([#747](https://github.com/0xPlayerOne/code-foundry/issues/747)) ([7fcad52](https://github.com/0xPlayerOne/code-foundry/commit/7fcad52d400dbb2aaa9ba46c0c76f14e8d63f660)), closes [#690](https://github.com/0xPlayerOne/code-foundry/issues/690)
-
-## [1.46.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.3...v1.46.4) (2026-10-08)
-
-
-### Bug Fixes
-
-* **release:** preserve current-head validation ownership ([#737](https://github.com/0xPlayerOne/code-foundry/issues/737)) ([aa8bfcf](https://github.com/0xPlayerOne/code-foundry/commit/aa8bfcfbfcd3c213d15ba9e1fbfb5c65ab8ddb6b))
-
-## [1.46.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.2...v1.46.3) (2026-10-07)
-
-
-### Bug Fixes
-
-* **billing:** keep lint standalone; join fast-lane receipts in parallel ([#744](https://github.com/0xPlayerOne/code-foundry/issues/744)) ([574690b](https://github.com/0xPlayerOne/code-foundry/commit/574690b707abffe9350ccc67589540afb82323ee))
-
-## [1.46.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.1...v1.46.2) (2026-10-07)
-
-
-### Bug Fixes
-
-* **billing:** join fast-lane receipts in a second parallel group ([#742](https://github.com/0xPlayerOne/code-foundry/issues/742)) ([c63a39c](https://github.com/0xPlayerOne/code-foundry/commit/c63a39cf5e236d6747bd85cf10b04bd10f690b11))
-
-## [1.46.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.0...v1.46.1) (2026-10-07)
-
-
-### Bug Fixes
-
-* **qualification:** skip parallel-syntax files until actionlint supports them ([#740](https://github.com/0xPlayerOne/code-foundry/issues/740)) ([db98c7f](https://github.com/0xPlayerOne/code-foundry/commit/db98c7f40cae080cdc9dcab7baac4976e5e0656e))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 255 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 262 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CONFIGURATION.md

@@ -175,6 +175,7 @@ See [Merge queue validation](merge-queues.md) before enabling it.
 | `rust_nextest`                            | `true`, `false`                                      | Install cargo-nextest and prefer `cargo nextest run` over `cargo test` in Rust test lanes.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `e2e_shards`                              | `1`–`8`                                              | Fan the `Validation / Test / E2E` job into one runner per shard. The repository's `test:e2e`/`e2e` script receives `E2E_SHARD_INDEX` and `E2E_TOTAL_SHARDS` and partitions itself (Playwright takes `--shard=$E2E_SHARD_INDEX/$E2E_TOTAL_SHARDS`); each shard owns a runner-local test database, so shards stay isolated.                                                                                                                                                                                                                             |
 | `billing_lanes`                           | `true`, `false`                                      | Route validation through the merged-lane billing orchestrator: format, build, performance, smoke, and eval run as sequential steps of one shared runner, and profile plus dependency audit share one job, so GitHub's whole-minute rounding stops dominating billed minutes on private repositories. Coverage and the `Validation / Gate` check are unchanged; only merge a lane into the shared job when its work stays under the longest separate lane, so CI completion time does not grow. Requires all runner inputs on standard hosted runners. |
+| `release_qualification_receipts`          | `true`, `false` (default `false`)                    | Opt in to seven-day source qualification receipts for eligible version-only Release Please PRs. Defaults to false; see [workflow policy](WORKFLOWS.md#standard-triggers) for requirements and fallback behavior.                                                                                                                                                                                                                                                                                                                                      |
 | `release_batching_schedule`               | five-field numeric cron                              | Batch Release Please into scheduled windows. Ordinary pushes skip the producer; release-PR squashes and manual dispatches still run. Batched releases are created privately as drafts and published with prerelease visibility atomically. Manual dispatches publish stable hotfixes. Absent, releases publish per merge. Requires a single root Release Please package.                                                                                                                                                                              |
 | `release_batching_prerelease`             | `true`, `false`                                      | Defaults to `true` with a schedule. Sync enables `draft` and `force-tag-creation` in Release Please; the producer publishes the draft with the selected visibility. `false` keeps scheduled releases stable-visible.                                                                                                                                                                                                                                                                                                                                  |
 | `release_batching_soak_hours`             | `1`–`336`                                            | Generate a daily promoter that promotes the newest prerelease when the oldest candidate since the last stable has soaked this many hours, stitching batch notes. Requires a batching schedule and prerelease publication. Set `STABLE_PROMOTION_HELD=true` in repository Actions variables to hold scheduled and manual promotion; `force` overrides the hold or soak, and `version` selects a plain semantic version.                                                                                                                                |
@@ -272,6 +273,7 @@ installed hook predates chaining.
 | ------------------------- | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
 | `release_type`            | `auto`, `node`, `python`, `rust`, `simple`, `none`                               | Select a release manifest; `auto` detects one.                          |
 | `npm_publish`             | `true`, `false`                                                                  | Opt into npm publication.                                               |
+| `npm_publish_auth`        | `auto`, `oidc`, `token`                                                          | Select trusted OIDC publication or preserve an explicit token workflow. |
 | `license`                 | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `apache-2.0`, `mit`, `preserve`, `none` | License policy for initialized repositories.                            |
 | `git_workflow`            | `direct`, `staging-release`                                                      | Choose the branch topology.                                             |
 | `merge_strategy`          | `squash` or `rebase`                                                             | Required topology-specific merge method.                                |
@@ -300,6 +302,15 @@ described in [Qualified publication](qualified-publication.md). A self-sync of
 the Code Foundry source does not advance its own `runtime_ref`; this prevents a
 self-referencing runtime pin from creating a release loop.
 
+`npm_publish_auth` defaults to `auto`: a configured `NPM_TOKEN` keeps the
+legacy token publisher, while a missing token uses npm trusted publishing.
+Choose `oidc` to force trusted publishing and prevent `NPM_TOKEN` from reaching
+the reusable release workflow; choose `token` to require `NPM_TOKEN`. The
+separate optional `NPM_READ_TOKEN` is passed only to dependency installation
+when private npm packages need read access. For OIDC, configure npm's trusted
+publisher for the package repository and its generated `.github/workflows/release.yml`
+caller, with `id-token: write` available to both caller and reusable job.
+
 ## Synchronization and extensions
 
 | Key                     | Values                                                   | Purpose                                                           |

package/docs/PUBLISHING.md

@@ -12,8 +12,13 @@ Choose the release path that matches the repository:
 ## npm publication for consumer repositories
 
 Set `npm_publish: true` only when the repository owns an npm package. Configure
-npm trusted publishing for the generated `release.yml` workflow whenever
-possible. Use an `NPM_TOKEN` secret only when trusted publishing is unavailable.
+npm trusted publishing for the generated `release.yml` workflow. The
+`npm_publish_auth` setting defaults to `auto`: existing `NPM_TOKEN` users keep
+token publication, and tokenless repositories use OIDC. Set it to `oidc` to
+force trusted publishing and keep `NPM_TOKEN` out of publication and install;
+use `NPM_READ_TOKEN` separately when private dependencies must be installed.
+Set `npm_publish_auth: token` only when a long-lived publishing token is still
+required.
 
 Declare the package's intended visibility explicitly:
 
@@ -26,8 +31,11 @@ Declare the package's intended visibility explicitly:
 ```
 
 Publication occurs only from a Release Please tag; ordinary pushes do not
-publish. The release workflow fails clearly when npm publication is enabled but
-neither trusted publishing nor a token is configured.
+publish. `token` mode fails clearly unless `NPM_TOKEN` is configured. `auto`
+uses OIDC when the publishing token is absent, and `oidc` always uses the
+workflow's short-lived trusted identity. For private dependency installation,
+the workflow consumes `NPM_READ_TOKEN` first; `NPM_TOKEN` is an install fallback
+only outside explicit OIDC mode.
 
 After enabling publication, make one controlled release and verify both the
 registry version and its provenance link before treating the setup as complete.
@@ -43,7 +51,7 @@ callers:
 3. Publish the immutable GitHub Release after verifying the tag, source commit,
    archive digest, immutable-release setting, and qualification reports.
 4. Publish the already-qualified archive through the qualified publisher using npm
-   trusted publishing or the optional token fallback.
+   trusted publishing.
 
 The final publisher does not rebuild or reinstall the package. It publishes only
 the bytes selected from the same workflow run and attempt. See [Consumer

package/docs/WORKFLOWS.md

@@ -56,15 +56,27 @@ workflow_dispatch:
 ```
 
 In the `staging-release` topology, pull requests into `staging` run the fast
-tier, ordinary pull requests into `main` run the full audit tier, and exact
-Release Please pull requests into `main` run a lean release lane — CI, unit
-tests, and CodeQL plus the release-diff policy. Their diff is version
-metadata only: the content was fully audited on the pull requests that
-merged into `main`, and the scheduled audit lane re-covers drift, so the
-release lane keeps repository rulesets satisfiable without re-running the
-runner-heavy suites. The managed branch rulesets require only the aggregate
-`Validation / Gate` check, so skipped non-required jobs never deadlock the
-release; do not hand-require individual job contexts on release branches.
+tier and ordinary pull requests into `main` run the full audit tier. Exact
+Release Please pull requests into `main` must pass the release-diff policy and
+configured CodeQL scan. They also run the full CI and unit-test fallback unless
+the workflow verifies a seven-day source qualification receipt. A receipt is
+usable only when a successful full audit tested the exact current `main` tree
+with the same validation workflow, Code Foundry runtime, CodeQL policy, and
+pull-request/run identity. Verification checks the merged source PR, the
+aggregate gate's success in the exact run attempt, the required component
+results, and the artifact's bounded download size and SHA-256 digest. The release-diff preflight must confirm a
+version-only patch. Reuse is currently supported only for a public npm package
+released from the repository root; private roots, workspaces, and unknown
+Release Please layouts use the full CI and test fallback. A root package may
+use `prepublishOnly` only when it exactly invokes the configured package
+manager's `run build` task; other lifecycle hooks and custom prepublish commands
+use the full fallback. With a verified
+receipt, the applicable build is forced even when path filtering would skip it,
+and the versioned root npm package inspection still runs. Only duplicate
+format, lint, type-check, and unit-test work is skipped. The receipt never
+replaces the release-diff audit or configured CodeQL scan.
+The managed branch rulesets require only the aggregate `Validation / Gate`
+check; do not hand-require individual job contexts on release branches.
 In the
 `direct` topology (the default) every pull request targets `main` and runs the
 full audit tier, because there is no integration branch for a fast pass.
@@ -185,9 +197,10 @@ Use concise job names such as `CI / Format`, `Test / Unit`, and
 included) and security audits run through a detection-built matrix, so a
 repository only ever shows checks for languages it actually uses — never
 skipped rows for other languages. The release tier validates the generated
-diff as a step inside the gate rather than a separate job, for the same
-reason. Required checks should match the jobs actually enabled for the
-repository profile — in practice, require only the aggregate
+diff inside the gate and requires CodeQL when configured. It reuses prior
+source tests only when the short-lived exact-tree receipt verifies; otherwise
+it runs the full CI and unit-test fallback. Required checks should match the
+jobs actually enabled for the repository profile — in practice, require only the aggregate
 `Validation / Gate`, which fails closed unless every generated check
 succeeds.
 

package/docs/qualified-publication.md

@@ -29,17 +29,19 @@ package.
 The publishing job serializes publication for a tag and has no dependency
 installation/build step. Qualification has no npm credential. This self-only
 publisher has no environment approval gate; publication is automatic after its
-completed gates. npm trusted publishing is preferred; an explicit optional token
-supports environments that cannot use it. Configure the trusted publisher for the
-**actual caller and reusable-workflow relationship** before enabling this route.
+completed gates and uses OIDC only. Configure npm trusted publishing for the
+actual caller workflow filename, `release_self-ci.yml`, in repository
+`0xPlayerOne/code-foundry`, with direct publish permission and no GitHub
+environment. Both the caller and reusable publisher grant `id-token: write`.
+For generated consumer workflows, the caller filename is `release.yml` and the
+auth mode remains configurable with `npm_publish_auth`.
 Existing version publication is not overwritten: retrying an already-published
 version fails rather than treating a registry conflict or network error as proof
 of identity.
 
 The publisher never rebuilds the package, publishes a directory, or treats an
-already-published version conflict as proof of success. The workflow uses npm
-trusted publishing when no `NPM_TOKEN` is supplied; the optional token is a
-fallback for environments that cannot use trusted publishing.
+already-published version conflict as proof of success. It never accepts or
+forwards `NPM_TOKEN`.
 
 Qualification and publication are gated on `main` push or an explicitly
 requested `workflow_dispatch`. The shared billing pause blocks normal runs. A
@@ -89,15 +91,16 @@ jobs:
     with:
       tag: ${{ needs.release-producer.outputs.tag }}
       asset: ${{ needs.release-producer.outputs.npm-asset }}
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 ```
 
 For the self repository, `release_self-ci.yml` supplies the release output and
-uses the protected `npm` environment. Configure trusted publishing for the
-actual caller/reusable-workflow relationship, not only for a similarly named
-workflow. Protect both the `release` and `npm` environments with the intended
-branch restrictions and approvals.
+uses the qualified publisher job without a GitHub environment. The actual
+caller filename must match npm's trusted-publisher configuration; a similarly
+named reusable workflow does not match. A prior publisher entry named
+`release.yml` did not match the self-publish caller; the repository owner reports
+adding the `release_self-ci.yml` entry. A successful OIDC publication still
+needs to verify that identity before any old trust entry or secret is removed.
+This source change does not edit npm trust settings.
 
 ## Identity and retry rules
 
@@ -131,8 +134,8 @@ administration-read, contents-write, and verification access; it is never expose
 to qualification jobs. Preflight and staging reuse the producer's validated
 credential selection, falling back to the workflow token only when the configured
 token is rejected. Configure npm trusted-publisher identity for the actual
-caller/reusable-workflow relationship, or explicitly retain the optional npm
-token in the final publisher.
+caller workflow filename. This self-only publisher does not support a token
+fallback.
 
 ## Trust boundaries
 
@@ -168,6 +171,11 @@ publisher from the same source-bound workflow after confirming npm has not alrea
 accepted that version. Never weaken the SHA guard, move an immutable tag, or treat
 npm's version-conflict response as success.
 
+If npm fails, the publisher reports only a fixed diagnostic category for known
+npm error codes. Unknown errors remain generic; stderr, registry URLs, paths, and
+credentials are not logged by this diagnostic. A category is a clue, not proof
+of the cause, and does not change the publication gates.
+
 ## Validation
 
 Run the focused local suites before changing this path:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.48.7",
+  "version": "1.50.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {
@@ -16,6 +16,9 @@
   },
   "files": [
     "src",
+    "!src/commands/qualification-receipt.mjs",
+    "!src/lib/qualification-receipt.mjs",
+    "!src/lib/release-package-contract.mjs",
     "docs",
     ".github",
     "!.github/actions/**",

package/src/commands/qualified-publication.mjs

@@ -31,6 +31,29 @@ export const REQUIRED_FIXTURES = [
 function ensure(condition, message) {
   if (!condition) throw new Error(message)
 }
+// Extract only fixed categories from npm's code line. Never echo stderr or the
+// captured code: npm output may contain credentials, paths, or registry URLs.
+/** @param {string} stderr */
+export function npmFailureCategory(stderr) {
+  const categories = {
+    E401: 'authentication',
+    E403: 'authorization-or-policy',
+    E404: 'registry-or-package',
+    E409: 'version-conflict',
+    EOTP: 'authentication',
+    ENEEDAUTH: 'authentication',
+    ECONNRESET: 'network',
+    ECONNREFUSED: 'network',
+    ENOTFOUND: 'network',
+    ETIMEDOUT: 'network',
+  }
+  for (const line of stderr.split(/\r?\n/)) {
+    const code = /^npm (?:ERR!|error) code ([A-Z0-9]+)\s*$/.exec(line)?.[1]
+    if (code && Object.hasOwn(categories, code))
+      return categories[/** @type {keyof typeof categories} */ (code)]
+  }
+  return 'unknown'
+}
 /** @type {Run} */
 export function runCommand(command, args, cwd) {
   const result = spawnSync(command, args, {
@@ -40,6 +63,10 @@ export function runCommand(command, args, cwd) {
     maxBuffer: 8 * 1024 * 1024,
     env: { ...process.env, GH_HOST: 'github.com', GH_PROMPT_DISABLED: '1' },
   })
+  if (command === 'npm' && (result.error || result.status !== 0)) {
+    const category = npmFailureCategory(result.stderr ?? '')
+    throw new Error(`npm failed (category: ${category}); publication remains blocked`)
+  }
   ensure(
     !result.error && result.status === 0,
     `${command} failed (${result.status ?? result.error?.message}); publication remains blocked`