fix(release): publish validated artifact bytes

[steipete]

Fixes #73.

Summary

• recompute the downloaded release tarball's SHA-512 integrity and require it to match the validation manifest before publishing
• pass that exact absolute tarball path to npm, then require the registry integrity and provenance to match
• retry transient missing or stale registry metadata with capped exponential backoff for almost nine minutes without republishing an already-visible version
• raise the publish job timeout to leave headroom for the longer verification window

Proof

• pnpm exec vitest run test/publish-or-verify.test.ts
• pnpm check (58 test files passed, 602 tests passed, 23 skipped)
• downloaded the v0.5.0 release-package artifact from run 30316760633 and compared it with the registry tarball: identical size, SHA-512 integrity, and bytes
• autoreview clean with no accepted/actionable findings

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 28, 2026, 12:43 AM ET / 04:43 UTC.

ClawSweeper review

What this changes

This PR publishes the manifest-validated tarball rather than repacking the working tree, verifies the npm registry package identity and provenance with bounded retries, increases release-job time, and adds focused tests.

Merge readiness

⛔ Blocked until stronger real behavior proof is added - 3 items remain

Keep this PR open: it is a focused candidate fix for the linked release failure and the supplied review context shows no actionable code defect, but it still lacks inspectable after-fix real behavior proof from the changed npm publication and verification gate.

Priority: P2
Reviewed head: 83cb357e18c296631677aec595d24c656096b86f

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The supplied patch is focused and supported by targeted tests, but missing inspectable real release-path proof remains a merge gate.
Proof confidence	🦪 silver shellfish (2/6)	Needs stronger real behavior proof before merge: The PR body reports tests, checks, and a byte comparison, but it does not include inspectable after-fix live output from the changed publish-or-verify gate; add redacted terminal or CI output showing the validated artifact path, matching registry integrity, and provenance result. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The PR body reports tests, checks, and a byte comparison, but it does not include inspectable after-fix live output from the changed publish-or-verify gate; add redacted terminal or CI output showing the validated artifact path, matching registry integrity, and provenance result. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	4 items	Reported failure and candidate repair: The linked issue reports that the earlier workflow repacked the working tree and could not match the manifest integrity, while this PR explicitly publishes the validated tarball and adds registry propagation retry logic. Focused implementation and tests: The supplied PR diff changes the release workflow, the publish-or-verify script, a focused new test file, and the Unreleased changelog; the prior completed ClawSweeper cycle found no code-level findings. Repository policy applied: The full repository AGENTS.md requires preserving release/package integrity, updating the Unreleased changelog for operational changes, and using focused validation; this PR’s stated scope follows those expectations.
Findings	None	None.
Security	None	None.

How this fits together

The release workflow creates and validates a package tarball, downloads that release artifact, and passes it to a publish-or-verify gate before creating the GitHub release. That gate must ensure the bytes uploaded to npm and the bytes later reported by the registry match the release manifest.

flowchart LR
  A[Release source and tag] --> B[Assemble and validate package]
  B --> C[Manifest-validated tarball]
  C --> D[Publish or verify gate]
  D --> E[npm registry metadata and provenance]
  D --> F[GitHub release publishing]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The PR body reports tests, checks, and a byte comparison, but it does not include inspectable after-fix live output from the changed publish-or-verify gate; add redacted terminal or CI output showing the validated artifact path, matching registry integrity, and provenance result. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - The new gate controls which package bytes are published and may wait up to about 8 minutes 50 seconds for registry propagation; merge should wait for redacted live output that demonstrates the exact artifact, registry integrity, and provenance verification path on a real release-like run.
• Complete next step (P2) - The contributor needs to supply real release-gate proof; this cannot be generated safely by an automated repair lane on the contributor’s behalf.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Release-path scope	4 files affected; 242 added, 37 removed	The patch changes the npm publication gate, its workflow timeout, targeted tests, and release notes.
Registry retry window	12 delays totaling 530 seconds	The extended propagation allowance materially affects release-job duration and failure behavior.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #73
Summary: This PR is the explicit candidate implementation for the release artifact identity and registry propagation defects tracked by the linked issue.

Members:

• canonical: Release workflow: publish re-packs instead of publishing the validated tarball, and registry verification times out #73 - The PR body identifies the issue as the problem it addresses, and the issue describes the same two defects repaired by this branch.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Add release-gate proof before merge (recommended)
   Attach or link redacted terminal or CI output from a real publish-or-verify execution that shows the validated artifact identity, matching registry integrity, and provenance result.
2. Accept verification without live evidence
   Maintainers may accept the test-only evidence, but would be taking ownership of an unobserved release-path change that determines published package bytes.

Technical review

Best possible solution:

Land the focused byte-identity and retry repair after the PR includes redacted real execution evidence showing the manifest-validated tarball is the publish input and the registry result matches its integrity and provenance.

Do we have a high-confidence way to reproduce the issue?

Yes, with medium confidence from the linked report and supplied diff: the former workflow compared a manifest-validated artifact with a package that npm had repacked from the working tree, so the identity mismatch follows from the described path. A local current-main reproduction was not run because this review is read-only and the available shell could not start.

Is this the best way to solve the issue?

Yes, provisionally: publishing the already validated artifact removes the competing byte source, while bounded registry retries address delayed metadata. The remaining requirement is live release-gate evidence that the combined path succeeds under real npm conditions.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 40925fca8ee5.

Labels

Label justifications:

• P2: The fix addresses a real release-completion failure with limited runtime blast radius.
• merge-risk: 🚨 compatibility: The chosen npm publish input determines the exact package bytes installed by users.
• merge-risk: 🚨 automation: The patch changes GitHub release workflow timing and npm registry verification behavior.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body reports tests, checks, and a byte comparison, but it does not include inspectable after-fix live output from the changed publish-or-verify gate; add redacted terminal or CI output showing the validated artifact path, matching registry integrity, and provenance result. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Reported failure and candidate repair: The linked issue reports that the earlier workflow repacked the working tree and could not match the manifest integrity, while this PR explicitly publishes the validated tarball and adds registry propagation retry logic. (scripts/publish-or-verify.mjs:1, 83cb357e18c2)
• Focused implementation and tests: The supplied PR diff changes the release workflow, the publish-or-verify script, a focused new test file, and the Unreleased changelog; the prior completed ClawSweeper cycle found no code-level findings. (test/publish-or-verify.test.ts:1, 83cb357e18c2)
• Repository policy applied: The full repository AGENTS.md requires preserving release/package integrity, updating the Unreleased changelog for operational changes, and using focused validation; this PR’s stated scope follows those expectations. (AGENTS.md:1, 40925fca8ee5)
• Review continuity: The previous completed review of commit 3209240 reported no patch findings and requested inspectable real behavior proof; the current PR body still provides test claims and an artifact comparison but no attached or linked live publish-or-verify output. (83cb357e18c2)

Likely related people:

• steipete: The supplied context attributes both the concrete v0.5.0 release diagnosis and the current focused repair commit to steipete; current-main history could not be independently inspected in the read-only shell. (role: release-path reporter and proposed repair author; confidence: low; commits: 83cb357e18c2; files: scripts/publish-or-verify.mjs, .github/workflows/release.yml, test/publish-or-verify.test.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach redacted live CI or terminal output from the after-fix publish-or-verify path.
• If updating the PR body does not trigger review automatically, ask a maintainer to comment @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-07-28T01:57:54.259Z sha 3209240 :: needs real behavior proof before merge. :: none

[steipete]

Merged after exact-head release-path verification.

Tested at rebased head 83cb357e18c296631677aec595d24c656096b86f:

• fnm exec --using 24 pnpm exec vitest run test/publish-or-verify.test.ts — 3 passed
• fnm exec --using 24 pnpm check — 58 test files passed, 602 tests passed, 23 skipped; build, filesystem-boundary lint, file-size lint, and package check passed
• git diff --check origin/main...HEAD
• /Users/steipete/Projects/agent-skills/skills/autoreview/scripts/autoreview --mode commit --commit 83cb357e18c296631677aec595d24c656096b86f — clean, no accepted/actionable findings
• Exact-head CI run 30329386209 — complete Node 22/24, native, package-smoke, workflow-lint, clippy, and audit matrix green; CodeQL, coverage, benchmarks, and Socket checks also green

The first exact-head CI attempt hit an unrelated transient Windows EPERM in file-lock-reentrancy; the unchanged failed-job rerun passed. Landed as 0206c4b567b444fed4a5695ccaa620ff5c1cd0c2, closing #73. No npm publication was attempted because this change hardens the next tagged release rather than republishing v0.5.0.