Prepare non-publishing release checks and resumable delivery

Author: foundev

.agents/plans/town.md

@@ -183,3 +183,31 @@ The remaining macOS smoke difference was precisely the transient PENDIN flag,
 which XNU sets when ICANON is restored. The smoke comparison accounts for that
 kernel-maintained state on macOS while checking all configured flags, control
 characters, and speeds. The application itself correctly restored its settings.
+
+## v0.1.0 publishability preflight (2026-09-10)
+
+- Preserved the npm-only 0.1.0-rc.1 bootstrap and all local history. The initial
+  release target 692830d already has successful exact-commit Linux/macOS CI;
+  no tags, GitHub releases or prior preparation PR existed at inspection.
+- Prepare on brb/release-ilamovjxd3ttri6z3cdpvpheqk and deliver through its PR to
+  master. No tag pushes, public releases, final assets or npm uploads are
+  authorized in this phase. Branch pushes run CI only.
+- Enumerated native GitHub assets, source/Go tag, four npm platform packages,
+  the npm launcher, npm/GitHub latest pointers, and npm's Sigstore provenance.
+  No other registry, container or hosted documentation targets were found.
+- Added a non-publishing exact-version build/verification path, actual Actions
+  publisher checks, strict remote run evidence checks and regression coverage.
+  Release orchestration validates all versions before uploads, retains partial
+  state and finalizes GitHub after npm verification. Independent archive checks
+  compare unpacked bytes and permissions after validating published checksums.
+- Local validation passed: make check smoke (race, vet, frontend and demo
+  integration), 31 Python tests and actionlint. Committed candidate packaging
+  and exact-SHA Actions validation follow the preparation commit/PR.
+- Blocked: packages-publish permits only v* tags and there are no tags; preserve
+  that policy until an administrator explicitly authorizes a reviewed preflight
+  branch. The local npm trust read returned 401. All five actual OIDC trust
+  configurations and createPackage permissions need same-job validation.
+- Remaining signing gate: establish non-publishing Fulcio/Rekor authorization
+  and independent provenance verification. The release authorization command
+  fails closed on this missing evidence; no signing request or log entry was
+  submitted. RELEASING.md records these limitations and the recovery commands.

.github/workflows/publish-packages.yml

@@ -1,80 +1,64 @@
 name: Publish packages
 run-name: Release ${{ inputs.tag || github.ref_name }} (publish=${{ github.event_name == 'push' || inputs.publish }})
-
 on:
   push:
     tags: ['v*']
   workflow_dispatch:
     inputs:
       tag:
-        description: Existing published release tag, such as v0.1.0 (dispatch from this tag)
+        description: Proposed version; publish=true requires dispatch from this exact existing tag
         required: true
         type: string
       publish:
-        description: Publish to npm after validation (false only builds and checks)
+        description: Publish validated deliverables (false never uploads release assets or packages)
         type: boolean
         default: false
-
 permissions:
   contents: read
-
 concurrency:
   group: brokk-town-packages
   cancel-in-progress: false
-
 jobs:
   native:
-    if: github.event_name == 'push'
-    permissions:
-      contents: write
     uses: ./.github/workflows/release.yml
+    with:
+      tag: ${{ inputs.tag || github.ref_name }}
   packages:
     needs: native
-    if: ${{ !cancelled() && (needs.native.result == 'success' || github.event_name == 'workflow_dispatch') }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 30
     environment: packages-publish
     permissions:
-      contents: read
+      actions: read
+      contents: write
       id-token: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      RELEASE_COMMIT: ${{ github.sha }}
+      RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
     steps:
-      - name: Require the exact release tag
-        env:
-          RELEASE_REF: ${{ github.ref }}
-          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
-        run: test "$RELEASE_REF" = "refs/tags/$RELEASE_TAG"
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version: '24'
           registry-url: https://registry.npmjs.org
           package-manager-cache: false
-      - name: Download the published native assets
+      - name: Require exact existing tag for publication
+        if: github.event_name == 'push' || inputs.publish
         env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
-        run: |
-          test "$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft)" = false
-          gh release download "$RELEASE_TAG" --dir dist/native
-      - name: Test launchers and build packages from verified assets
+          RELEASE_REF: ${{ github.ref }}
+        run: test "$RELEASE_REF" = "refs/tags/$RELEASE_TAG"
+      - name: Download candidate from this exact workflow run
         env:
-          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
-        run: |
-          python3 -m unittest discover -s scripts -p '*_test.py' -v
-          node --test --test-isolation=none npm/bt.test.cjs
-          python3 scripts/package_installers.py "$RELEASE_TAG" dist/native dist/packages
-          python3 scripts/smoke_installers.py --tag "$RELEASE_TAG" --assets dist/native --packages dist/packages
-      - name: Check version availability and existing package integrity
-        run: python3 scripts/package_registry.py check dist/packages
-      - name: Save validated packages for review and bootstrap publication
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
-        with:
-          name: packages-${{ inputs.tag || github.ref_name }}
-          path: dist/packages/
-          if-no-files-found: error
-      - name: Submit validated packages
+          RELEASE_RUN: ${{ github.run_id }}
+        run: gh run download "$RELEASE_RUN" --repo github.com/BrokkAi/brokk-town --name "release-candidate-$RELEASE_COMMIT-$RELEASE_TAG" --dir dist/candidate
+      - name: Check every version before any final upload
+        run: python3 scripts/release_checks.py version
+      - name: Validate actual publisher without publishing
+        if: github.event_name == 'workflow_dispatch' && !inputs.publish
+        run: python3 scripts/release_checks.py authorization
+      - name: Recheck credentials, resume uploads, and finalize last
         if: github.event_name == 'push' || inputs.publish
-        run: python3 scripts/package_registry.py publish dist/packages
+        run: python3 scripts/publish_release.py

.github/workflows/release.yml

@@ -1,49 +1,40 @@
 name: Release
 on:
   workflow_call:
+    inputs:
+      tag:
+        required: true
+        type: string
 permissions:
   contents: read
-concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: false
 jobs:
   checks:
     uses: ./.github/workflows/ci.yml
-  publish:
+  build:
     needs: checks
     runs-on: ubuntu-latest
     timeout-minutes: 20
-    permissions:
-      contents: write
     steps:
-      - name: Require a release tag
-        env:
-          RELEASE_REF: ${{ github.ref }}
-          RELEASE_TAG: ${{ github.ref_name }}
-        run: test "$RELEASE_REF" = "refs/tags/$RELEASE_TAG"
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
           go-version-file: go.mod
           cache: false
-      - name: Package
-        env:
-          RELEASE_TAG: ${{ github.ref_name }}
-        run: python3 scripts/package_release.py "$RELEASE_TAG"
-      - name: Check archives
-        run: |
-          cd dist
-          sha256sum --check checksums.txt
-          tar -xzf brokk-town-*-linux-amd64.tar.gz bt
-          ./bt --help
-          rm bt
-      - name: Publish
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
+        with:
+          node-version: '24'
+          package-manager-cache: false
+      - name: Build all native and npm deliverables without publication
         env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          RELEASE_TAG: ${{ github.ref_name }}
-        run: |
-          gh release create "$RELEASE_TAG" dist/*.tar.gz dist/checksums.txt dist/release.json --verify-tag --draft --title "Brokk Town $RELEASE_TAG" --generate-notes
-          gh release edit "$RELEASE_TAG" --draft=false --latest
+          RELEASE_COMMIT: ${{ github.sha }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: python3 scripts/release_checks.py build
+      - name: Retain exact-commit candidate and build evidence
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: release-candidate-${{ github.sha }}-${{ inputs.tag }}
+          path: dist/candidate/
+          if-no-files-found: error
+          retention-days: 14

CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 0.1.0 — prepared, not published
+
+- Local multi-repository agent town with browser, terminal and CLI clients.
+- Durable bot supervision, revision-bound review and merge gates, and isolated demo mode.
+- Linux and macOS binaries for amd64 and arm64, plus the npm launcher and platform packages.
+- Apache-2.0 licensing with reviewed dependency notices in every package.
+- Release preparation validates all deliverables before uploads and preserves partial outcomes.
+
+The historical npm-only `0.1.0-rc.1` bootstrap remains unchanged. Publication of
+0.1.0 is blocked on the authorization gates documented in RELEASING.md.