ptbk 0.115.0-2 → 0.115.0-3

package/changelog/_current-preversion.md

@@ -12,6 +12,9 @@
     tree, create the normal version commit/tag, and atomically push the current
     branch and exact new tag to trigger CI. Failed pushes can be retried with
     `npm run postversion`; local registry verification remains available without publishing.
+-   Wait for npm registry propagation after a successful upload instead of failing on the
+    first temporary missing-version response. Keep verification bounded and reject invalid
+    artifact metadata and authentication failures immediately.
 -   Implemented the coder task engine with legacy Markdown and task Books, strict scheduling,
     recurrence, deterministic migration, project initialization and authoring, safe Git/check
     phase persistence, recovery journals, harness adapters, agent context and TEAM tools,

package/docs/coder.md

@@ -146,7 +146,7 @@ If `postversion` fails, the version commit and tag remain local. Resolve the pus
 
 CI validates the pushed tag against the package manifest and lockfile, runs the full checks through `prepublishOnly`, and publishes the package. Prereleases use `next`; stable releases use `latest`. `release:publish` requires GitHub Actions, the official `webgptorg/promptbook` repository and a matching `RELEASE_TAG` before calling npm. Registry credentials and trusted-publisher setup belong to CI rather than the local version command.
 
-A successful publish then verifies the exact registry version, dist-tag and artifact integrity, installs that registry version locally and globally into temporary directories, and checks both executable versions. `npm run release:verify` is also available locally for registry verification; it reads registry metadata and performs temporary installs without publishing. If publication succeeded but verification failed, use that command instead of attempting to overwrite the published version.
+A successful upload can take a few minutes to become publicly available. Verification waits up to ten minutes for registry propagation, retrying temporary missing-version and network responses and an out-of-date dist-tag. Invalid version, tarball or integrity metadata and authentication failures stop verification immediately. Once available, it verifies the exact registry version, dist-tag and artifact integrity, installs that registry version locally and globally into temporary directories, and checks both executable versions. `npm run release:verify` is also available locally for registry verification; it reads registry metadata and performs temporary installs without publishing. If the upload succeeded but verification failed, use that command instead of attempting to overwrite the published version.
 
 Configure npm trusted publishing for owner `webgptorg`, repository `promptbook` and workflow filename `publish.yml`. Enable its direct `npm publish` permission; a newly created publisher defaults to staged publishing. Complete its first successful publication within two days or recreate the expired connection. The workflow uses a hosted Node 24 runner, disables release caches, grants OIDC permission and requests provenance. See [npm’s trusted publisher setup](https://docs.npmjs.com/trusted-publishers/).
 

package/docs/compatibility.md

@@ -23,7 +23,7 @@ This record maps the implementation to [the coder specification](https://github.
 | Planning | Codex planning requires advertised read-only controls and exposes host-mediated reads. Task saves require exact preview and explicit approval; other providers reject planning without equivalent capability. | Planning read-boundary, unsupported-capability and approved-save fixtures; U09. The installed provider may reject setup before inference if required controls are absent. |
 | Persistent server | Loopback HTTP supervision uses the shared engine. Host, session token, origin, source revision, body limits and mutation lease protect its API. Source changes can make work eligible without idle inference. | `test/server.test.mjs`: real HTTP guards, duplicate IDs, symlinks, pause/resume and one shared-engine execution; U11. Browser rendering and prolonged server operation are not end-to-end stress-tested. |
 | Output and secrets | Failed outcomes remain visible; known project/env secrets are redacted across split stream chunks and in durable traces. Legacy trace filenames coexist with immutable occurrence history; a journal supplies authoritative finalization outcomes. Interactive controls and bounded buffers are implemented. | Harness/engine secret, cancellation, legacy single/multisection/latest/user-edit trace and durable metadata fixtures; terminal split-JSON, controls, active-wait skipping, scroll/resize, truncation and non-TTY fixtures; U10, U14, E17. Full interactive navigation has not been manually verified. |
-| CLI and release configuration | Unknown/command-inapplicable flags fail; historical test flags point to check flags. Read-only commands do not initialize a project. Local npm version hooks check a named branch and clean tracked/untracked tree and atomically push the version commit's branch and exact tag. GitHub Actions validates the single manifest/lockfile against that tag and publishes: prereleases target `next`, stable releases `latest`. After publication, registry version/tag/integrity and installed local/global executable versions are verified. | `test/cli.test.mjs`, `test/release.test.mjs`, `test/version.test.mjs` and package smoke; U02–U03, U13. Documentation task examples are parsed by the runtime adapters. Publication requires CI registry authentication; the remote workflow has not been verified here. |
+| CLI and release configuration | Unknown/command-inapplicable flags fail; historical test flags point to check flags. Read-only commands do not initialize a project. Local npm version hooks check a named branch and clean tracked/untracked tree and atomically push the version commit's branch and exact tag. GitHub Actions validates the single manifest/lockfile against that tag and publishes: prereleases target `next`, stable releases `latest`. After publication, registry version/tag/integrity and installed local/global executable versions are verified. | `test/cli.test.mjs`, `test/release.test.mjs`, `test/version.test.mjs`, `test/published.test.mjs` and package smoke; U02–U03, U13. Documentation task examples are parsed by the runtime adapters. GitHub Actions uploaded `ptbk@0.115.0-2`; its immediate verification hit registry propagation delay. Later public-registry metadata and actual local/global installations verified that release. |
 
 ## Deliberate changes and limits
 
@@ -41,10 +41,12 @@ On 10 October 2026, before the release lifecycle changes, `npm run check` passed
 
 After the lifecycle changes, all 15 focused `test/version.test.mjs` fixtures passed using real npm commands and local bare Git remotes. They cover exact atomic pushes, upstream selection, failure preservation, dirty/detached preflight rejection, retry and the explicit Git-tagging opt-out. The updated full `npm run check` passed on macOS with Node `v24.17.0` and npm `11.13.0`: type checking, all 141 fixtures, and the packed `ptbk@0.115.0-1` installed locally and globally with external-project task execution, checks and phase commits.
 
-The workflow defines macOS/Linux checks on Node 22 and 24. Linux execution and the remote workflow have not been run as part of this local record. WSL/native Windows, paid real-provider inference, remote advisor inference and a manual full terminal session have not been verified here.
+After adding registry propagation polling, the full check passed on the same macOS Node/npm versions with all 150 fixtures and the packed `ptbk@0.115.0-2` installation smoke. The nine new deterministic fixtures cover temporary missing-version/network responses, stale dist-tags, timeout bounds, authentication failures and invalid artifact metadata without real waits.
+
+The workflow defines macOS/Linux checks on Node 22 and 24. The `v0.115.0-2` publish job passed all 141 fixtures and package smoke on Linux with Node `v24.21.0` and npm `11.19.0`. WSL/native Windows, paid real-provider inference, remote advisor inference and a manual full terminal session have not been verified here.
 
 Control-only native startup probes, without user prompts or paid model turns, verified tool discovery with Codex `0.162.0`, Claude Code `2.1.289` and Copilot `1.0.95` (matching published SDK `1.0.19`). Cline `3.0.70` also discovered an idle MCP server under a real TTY, but its tool permissions do not establish safe advisor capability. Gemini/Qwen ACP and OpenCode discovery controls were reviewed against primary sources and tested with executable doubles; they were not live provider-inference tests.
 
-An earlier local `npm run release:publish` attempt prepared `ptbk@0.115.0-0`, but npm refused the upload with `ENEEDAUTH`. A fresh public-registry query then confirmed that exact version was absent and the only dist-tag remained `latest: 0.114.0-50`; that attempt published no new version. The release flow has since changed: publication is CI-only, and local `npm version` creates and atomically pushes its version commit/tag after basic checks. A failed postversion push can be retried with `npm run postversion`; it does not require another version increment. No version commit, tag or push has been performed in this checkout during implementation, and successful CI publication is not yet confirmed. GitHub trusted-publisher configuration or a publishing-capable Actions secret requires external npm account access. Successful publication automatically verifies registry metadata and installations; optional local `npm run release:verify` performs registry verification without publishing.
+An earlier local `npm run release:publish` attempt prepared `ptbk@0.115.0-0` but failed with `ENEEDAUTH` and uploaded nothing. Publication now runs only in GitHub Actions, triggered by the version commit/tag that local `npm version` atomically pushes. The [first tagged publish job](https://github.com/webgptorg/promptbook/actions/runs/38018816282/job/114115037379) successfully uploaded `ptbk@0.115.0-2` with provenance, but the immediate registry query returned E404 while npm processed the artifact. A later `npm run release:verify` passed: the public version, `next` tag, SHA-512 metadata and installed local/global executables all matched. Verification now waits for bounded registry propagation instead of failing on that first temporary response. A failed postversion push can be retried with `npm run postversion`; after an accepted upload, use `npm run release:verify` without attempting to overwrite the npm version.
 
 For usage and release setup, see [the coder guide](coder.md). Fixture evidence is maintained in the repository's `test/` directory; the npm package ships the runtime and user documentation rather than the test suite.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "ptbk",
-    "version": "0.115.0-2",
+    "version": "0.115.0-3",
     "description": "A local coding agent CLI with Book tasks, safe Git persistence, scheduling and interchangeable coding harnesses.",
     "private": false,
     "sideEffects": false,