WP-RN-07 record: release machinery → Artifact Registry, `fabric/<branch>/v*` tags, waves, verifier, recovery

Executed 2026-10-03 on branch phase1/rename-train of a5c-ai/fabric (draft PR #4). Spec: docs/specs/platform-gaps/15-private-isolation-rename.md WP-RN-07 (§1.2 invariants, §1.3 retag discipline, §4.1–§4.3), 00-intent.md D10/D17–D21, 40-packaging.md §2.2/§2.3/§5. Owner decisions at Gate A: "Approve (Recommended)"; verifier workflow "Enable now" (enabled and first dispatched by the orchestrator); naming "Keep both". The public repository a5c-ai/babysitter was never written to (pushed_at 2026-09-16T19:59:50Z at start and end; tag count 404 at start and end, 0 fabric/ tags there; upstream remote push = no_push), nothing was published to any registry (npm publish ran only with --dry-run, locally against a fixture npm and once against Artifact Registry with a reader credential, which the registry refused at the existence query — see §6), and no tag was created (fabric tags: the same 3 gke-cutover-* tags before and after).

1. What the train looks like now

publish-npm-private.yml (push main|staging|develop; dispatch = dry run unless dry_run=false)
  resolve_release ──► verify_release_artifacts (release-artifact-verifier.yml, 43 pkgs, no tolerance)
        │                      │
        └──────────────────────┴──► publish_candidates  (needs both; if verifier == success)
                                      WIF auth ─► google-artifactregistry-auth ─► npm ping AR
                                      verify --write release-version.json (identity re-validated)
                                      sync-workspace-versions ─► verify-manifests ─► publish-isolation-guard
                                      assert-channel-tags --mode preflight --registry AR
                                      build waves (release-matrix --format waves, npm run build per member)
                                      publish waves (publish-package-from-tag.mjs, FABRIC_RELEASE_PUBLISH=1,
                                                     candidate-<version>, --registry AR)   [dry run: --dry-run]
                                      assert-channel-tags --dist-tag candidate-<v> --mode final
                                ──► published_consumer_validation (live-stack-published.yml, exact version)
                                ──► promote_release_channel  (release-promotion.cjs promote --evidence)
                                ──► assert_release_channel_tags (every package, channel == version)
                                ──► create_release_tag (release-tags.yml → fabric/<branch>/v<version>)

publish-packages-from-tag.yml (push tags fabric/**; dispatch tag=)
  release_identity (tag-source: version/channel/registry from the tag; refuses a tag the train created)
  ──► verify_release_artifacts (strict, against the TAG tree)
  ──► publish_non_plugin_packages (same sequence; existing versions only candidate-tagged → idempotent)
  ──► published_consumer_validation ──► promote_release_channel (+ final assertion)

live-stack-published.yml   WIF + AR credential; published_consumer = fresh project + .npmrc routing +
                           install/import/bin smoke of all 43 + §3.1 global-install smoke; live lanes install
                           the §3.1 CLIs from AR at the exact version (no --force), run the live stack
fix-npm-tags.yml           dispatch-only AR dist-tag repair (audit | set), dry run unless dry_run=false
release-tags.yml           fabric/<branch>/v<version>, fabric-release-* provenance, this repo only

Derived publication waves at HEAD (13 waves, 43 packages; node scripts/release-matrix.cjs --group all-publishable --format waves): 1 catalog control-plane harness-observability harness-tasks harness-triggers operator trust · 2 harness-extensions harness-hooks-core harness-policy · 3 harness-core + the 12 harness-hooks-* leaves · 4 console-ui harness-codecs harness-config harness-hooks-cli harness-mock model-gateway · 5 harness-gateway harness-launch harness-tools · 6 harness-cli · 7 harness-sdk · 8 console-tui harness-channels orchestrator-sdk · 9 agent-runtime-engine observer · 10 agent-runtime-core · 11 agent-runtime-platform · 12 agent-runtime-cli · 13 orchestrator.

2. What changed, per file

3. Decisions recorded

**Roadmap conflict and reconciliation (review M4, 2026-10-04):** 50-roadmap-workpackages.md wrote the M1 evidence as the literal fabric/staging/v7.0.0 (M1 exit criterion 1, risk 7, WP-RM-02 AC1), which parseReleaseTag rejects (from-tag --tag fabric/staging/v7.0.0 → "must encode a staging prerelease of the form <major>.<minor>.<patch>-staging.<short-sha>", exit 1), so the criterion could never be satisfied as written. Owner decision at the pre-Gate-B interview: **"Spec 15 wins: staging = 7.0.1-staging.<sha>"** — the resolver's inherited channel scheme is kept, and the roadmap wording was amended with a dated note: the staging evidence for M1 is the tag fabric/staging/v7.0.1-staging.<sha> publishing all 43 @fabricstack/* packages at that exact version under dist-tag staging; fabric/main/v7.0.0 (channel latest) is the promotion evidence of the later main train. The resolver's rejection message now names both accepted shapes (fabric/main/v<X.Y.Z> and fabric/<staging|develop>/v<X.Y.Z>-<branch>.<sha>); the runbook §0 carries the same reconciliation row.

• **Staging/develop version shape kept**: spec 15 §4.1 says the dist-tag/channel scheme "carries over unchanged … the resolver logic ports as-is" and §4.2 adds nothing about the version shape, so staging resolves 7.0.1-staging.<sha> (FIX-001 commit-pinned prerelease) and main resolves 7.0.0. Nothing re-derives either.
• **Registry is part of the release identity** (registry field) and named explicitly on every npm view / dist-tag add / publish of the train, on top of G1 and the committed .npmrc routing.
• **Opt-in instead of a token gate**: AR credentials live in $HOME/.npmrc after the helper, so "credentials present" is not observable the way NODE_AUTH_TOKEN was; publication now requires FABRIC_RELEASE_PUBLISH=1, set only by the two publish workflows after WIF auth. A local invocation can never publish; --dry-run rehearses.
• **Scope routing per call for global installs** (--@fabricstack:registry=<AR>), not --registry <AR>: a global --registry would send third-party dependencies to AR (a standard repository, not a proxy) and 404. The WP-RN-06 AC2 command list used --registry $AR; the runbook and the workflow use the scoped form.
• **No external-plugin sync in the release path**: sync-external-plugins.yml/sync-atlas-plugins.yml push public marketplace repositories; they are WP-RN-11's and are not called by either AR publish workflow (pinned by verify-release-artifacts.test.mjs).
• **Build order = publication waves**, sequential within the publish job (npm run build --if-present --workspace=<pkg> per member): several packages chain root build:* scripts through --prefix, so parallel wave builds would race on shared outputs; correctness over speed in the release lane. The verifier (its own job) builds every package the same way.
• **G2(c)/G3 hard in default mode**: with every publish path on AR there is no legacy train left to tolerate; the fixture that documented the tolerance is now the negative that proves the rule.
• **ci.yml/ar-smoke.yml wording**: the orchestrator's gate greps every workflow for the literal public-registry host (comments included), so the guard comment and the smoke assertion no longer spell it; the assertion got stricter (npmjs), the rule text lives in the script.

4. Tests rewritten (before → after) and added

Before this WP npm run test:release-tooling was red in CI with exactly 9 inherited names (run 37144046853, # tests 163 / pass 154 / fail 9); each asserted the PUBLIC train's publish.yml shape.

Also adjusted: the recovery workflow acts on the RESOLVED release tag, never on github.sha (the external-plugin sync assertion became "no such job may exist"); FIX-005: the hooks CLI Genty pin … (runbook = docs/RELEASE-RUNBOOK.md, leaf = @fabricstack/harness-hooks-agent-runtime); release-version.test.mjs (20 tag literals → fabric/, babysitter/* rejection + TAG_PREFIX pinned); publish-package-from-tag.test.mjs (FABRIC_RELEASE_PUBLISH opt-in, fabric/ refs); publish-guards.test.mjs (default-mode findings, no notices, the six release workflows scanned, no workflow mentions the public host, touching-private list = 11 workflows). No test deleted or skipped.

New scripts/__tests__/private-release-train.test.mjs (15 tests at the first review, 21 after the 2026-10-04 review fixes — §9; the "19" this record carried until the second review predated the two additions that landed with the rehearsal fixes; cross-platform fake npm — .cmd shim on Windows): resolver prints AR + fabric/ tag for main/staging/develop and verify/from-tag carry the registry; public tags and provenance rejected; every workflow parses (yaml) and none mentions the public host or an npmjs secret; WIF + helper + .npmrc diff check on every AR workflow, no registry-url, id-token: write where auth runs; strict matrix gate before publish on both paths with step order sync → preflight → build → publish → candidate assertion and explicit --registry; promotion depends on validation, exactly one promote, assertion then tag, fabric/** tag trigger, no tag job in recovery; release-tags.yml shape; coverage gate live on both surfaces (0 violations over 43); consumer lane scope routing + §3.1 global-install smoke + exact-version live-lane installs; helper: no publish without opt-in, --dry-run shape (--tag candidate-<v> --ignore-scripts --registry <AR> --dry-run, no --access), opt-in publish + idempotent candidate-tag on re-run, G1 refusal with zero npm calls, fabric/ refs only; dist-tag repair: inventory-derived, every call ends with --registry <AR>, read-only audit, --fix, --set refuses a half-published train and a mutable version.

4b. Cross-platform test infrastructure (so the orchestrator's gate can be green on this machine)

The orchestrator's gate includes npm run test:release-tooling, which had never been green on this Windows machine: the fake-npm fixtures of four suites were #!/bin/sh files that cmd.exe cannot resolve (RN-05: 37 fail pristine, "npm-stub-on-PATH tests, impossible on Windows"), and the verifier's bin smoke spawned the POSIX .bin/<name> shim where npm on Windows links <name>.cmd. Fixed without touching any assertion: (1) scripts/__tests__/release-version.test.mjs and publish-package-from-tag.test.mjs fakes ported from sh to node (same behaviour: log, E404/error/appear-after/published-list), and all four fakes (release-promotion, verify-published-release included) gain an npm.cmd that delegates to the same node file; (2) the verify-published-release.test.mjs fake install now links <bin>.cmd like real npm does on Windows; (3) scripts/verify-release-artifacts.mjs and scripts/verify-published-release.mjs smoke <bin>.cmd through a shell on Windows (the verifier's exec no longer substitutes npm.cmd for a .cmd command). Windows result: release-version 31/31, publish-package-from-tag, release-promotion, verify-published-release 12/12, verify-release-artifacts 24/24, hooks-atlas-ownership 6/6 — the suites that were environmental are now proof on both platforms; CI (Linux) unchanged.

Incident while recording this (kept for honesty, like PKG-01's): an inline node -e "..." edit of this record carried backticks inside a bash double-quoted string, so bash executed the backtick fragments as command substitutions — one of them started scripts/verify-release-artifacts.mjs over the full matrix (read-only; builds into temp). It was stopped after 5 packages, the stray node process killed, git status confirmed only the 7 intended files were modified, and the edit was redone from a script file. Nothing was published, committed or pushed by the slip.

5. Gates and runs

6. Dry-run proof and what the registry answered

node scripts/publish-package-from-tag.mjs --workspace=@fabricstack/trust --release-version=7.0.0 --skip-build --dry-run against the real Artifact Registry with the reader credential (google-artifactregistry-auth for tal@a5c.ai, npm ping → PONG): the helper stopped at the existence query with Registry query for @fabricstack/trust@7.0.0 failed (exit 1) without reporting E404 … npm error code E403 … The caller does not have permission — the fail-closed path (a non-404 answer is never read as "unpublished"). The same 403 came back for @fabricstack/smoke (which exists) and for a made-up name, from npm view and from a direct bearer-token GET, so it is the account's read permission on the npm endpoint, not a resolver defect; gcloud artifacts … get-iam-policy shows tal@a5c.ai as roles/artifactregistry.reader (phase 0 record), which was enough for the phase-0 install transcript. Follow-up for the owner (not in this WP's power): confirm the reader binding still resolves for npm reads (possibly a conditional/expired grant); CI's service account is the writer and is the identity every workflow uses. The helper's --dry-run shape itself is proven by the fixture-backed test (publish --workspace … --tag candidate-<v> --ignore-scripts --registry <AR> --dry-run, no --access, no mutation).

**Correction (review M1, 2026-10-04) — what the whole-train rehearsal actually is.** The sentence this record first carried here ("the whole-train rehearsal is the workflow_dispatch default of publish-npm-private.yml, which is what Gate B should run first") was false on two counts, both found by the release-machinery review: (a) the helper ran its exact-internal-dependency gate under --dry-run against the registry, and on the first train the registry is empty, so every wave ≥ 2 failed (--workspace=@fabricstack/harness-policy … --dry-run → "Required internal dependency @fabricstack/harness-tasks@7.0.0 is not published yet", exit 1 against a fake E404 npm); (b) publish-npm-private.yml is unregistered on any branch GitHub can dispatch from (gh api repos/a5c-ai/fabric/actions/workflows/publish-npm-private.yml → 404) until it lands on staging, and that push IS the live train (dry_run=false on a push event). Fixes: the helper's --dry-run now accepts an exact internal pin that a publishable workspace of the checkout carries at exactly that version ("published by an earlier wave of this train"; every other pin keeps the strict registry check), and a new --rehearsal mode (implies --dry-run) issues no registry query at all for a credential-less job while still running the real npm publish --dry-run (npm never contacts the registry on a dry run — lib/commands/publish.js: if (!dryRun) await libpub(...)); the real publication path is byte-for-byte the strict one (fixture tests: dry-run passes on a two-wave fixture with an empty registry, the opt-in path still fails with the dependency-order message, a pin outside the train still fails in both modes). ci.yml gained the job **release-train-rehearsal** (pull_request): the train's publish_candidates sequence end-to-end for the staging identity of the PR head — resolve → lockstep check + guards → release plan written and validated → sync + verify-manifests + guard → derived wave build → SDK package health → wave publish --rehearsal (same parallelism) → proof that all 13 waves completed, 43/43 packages dry-run-published, 43 publish commands all carrying --dry-run, no published line, no dist-tag add, no npmjs in any log; the packed-artifact gate is logged as covered by release-artifact-verifier.yml on the same PR and the two registry-facing assertions as skipped by design. No credential, no id-token: write, no FABRIC_RELEASE_PUBLISH. **Gate B should read it this way: the first real run of publish-npm-private.yml is the staging merge; the rehearsal evidence is this job (run URL in §9) plus the verifier's 43/43.**

7. Verifier run(s)

8. Honesty: what is proven and what waits for Gate B

• **Prepared + dry-run-proven, not done**: AC1 (an end-to-end staging release publishing all 43 packages to AR, moving staging, creating one fabric/staging/v… tag), AC2 (verify/channel assertions against AR with published packages), AC3 (a from-tag recovery rehearsal under a candidate dist-tag), and the published-consumer validation against AR (including the §3.1 global-install smoke) can only run once Gate B merges the branch and the train publishes. Every mechanism is wired, parses, is shape-tested, and is exercised against fixture registries; nothing was published to any registry.
• **AC4 holds now**: the public repository's tag namespace shows no new tags (404 before and after; 0 fabric/ tags).
• **Windows**: 32 release-tooling tests are environmental here (sh fake-npm shims); CI's release-tooling job is the proof of the full suite. The baseline run of the suite was started before the first edit and finished after several edits, so its failing-name set is contaminated by an edit-in-flight (one test later fixed); the comparison was repeated against the final tree.
• **Reader 403 (review M6) — resolved 2026-10-04**: §6 keeps the original fail-closed transcript. The orchestrator verified with a fresh gcloud access token that the human reader binding works: gcloud artifacts repositories get-iam-policy fabric-npm --location=us-central1 --format=json shows roles/artifactregistry.reader for user:tal@a5c.ai; npx -y google-artifactregistry-auth --repo-config=.npmrc --credential-config="$HOME/.npmrc" followed by npm view @fabricstack/smoke --@fabricstack:registry=https://us-central1-npm.pkg.dev/boot-464019/fabric-npm/ printed 0.0.0-smoke.4; a direct bearer-token GET of the package document answered 200. The 2026-10-03 E403 was an expired token (the helper had been run against a stale credential), not a missing or conditional binding. Prerequisite kept: **re-authenticate first** (npx google-artifactregistry-auth; tokens live about an hour) before any local read-only runbook command; the runbook's "CI-only until verified" markers are lifted (runbook §0a, §6). No workflow depends on the human credential.
• **Workflow state (review M2, amended by review-2 M8) — 2026-10-04**: live-stack-published.yml, release-tags.yml, publish-packages-from-tag.yml and fix-npm-tags.yml were disabled_manually on a5c-ai/fabric (never run there) and nothing listed enabling them as a Gate-B prerequisite; the owner enabled all four at the pre-Gate-B interview ("Enable all four now"). **No trigger fires pre-merge** — the legacy copies of those files on main/staging are workflow_call/dispatch-only or trigger on babysitter/** tags — **but a MANUAL dispatch of fix-npm-tags.yml without --ref, or with --ref main, or with --ref staging before the merge, would run the legacy npmjs copy**, and that copy is armed: main and staging carry the same blob (git rev-parse origin/staging:.github/workflows/fix-npm-tags.yml origin/main:… → 44112b847 twice), whose workflow_dispatch input dry_run defaults to false, which checks out staging, uses registry-url: https://registry.npmjs.org/ with NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}, and whose else branch runs scripts/fix-broken-latest-tags.mjs --fix — a live npm dist-tag add @a5c-ai/<pkg>@<v> latest against the PUBLIC packages with the still org-wide NPM_TOKEN (M7 pending). The runbook never lists that form (its §5 dispatches carry -f mode=…, which the legacy inputs reject with 422), so the exposure was narrow, but until this amendment only human restraint prevented it — the earlier sentence here ("Nothing can fire pre-merge") asserted more than the triggers show. **Mitigation taken by the orchestrator on 2026-10-04**: fix-npm-tags.yml was re-DISABLED (workflow 352401959, disabled_manually, updated 2026-10-04T09:22:41+03:00, 0 runs ever on fabric); the other three — live-stack-published.yml 352401978, release-tags.yml 352401989, publish-packages-from-tag.yml 352401984 — stay active, as does release-artifact-verifier.yml 352401988. The orchestrator re-enables fix-npm-tags.yml immediately after PR #4 merges to staging, as part of Gate B, once M7 is verified. Do not dispatch fix-npm-tags.yml until PR #4 is on staging and main and M7 is verified. Every gh workflow run in the runbook carries --ref for the same reason (review M3), and the runbook now states that --ref staging is itself the legacy copy until the merge.
• **Not done by design**: sync-external-plugins.yml / sync-atlas-plugins.yml (public marketplace repos, WP-RN-11); documented_install lane of live-stack-published.yml still exercises the public marketplace bootstrap and stays channel-gated (skipped pre-promotion; WP-RN-11); scripts/release-notes.mjs, bump-version.mjs, rollback-release.sh legacy helpers untouched (no workflow invokes them); the fabricstack npmjs org (G4) remains an owner action. **G3 / review M7 — owner action, required BEFORE anyone dispatches fix-npm-tags.yml, i.e. before its Gate-B re-enable** (moved forward from "before Gate B" by review-2 M8, 2026-10-04): the organization secret NPM_TOKEN is still visible to all repositories (gh api orgs/a5c-ai/actions/secrets/NPM_TOKEN --jq .visibility → all, re-checked 2026-10-04), fabric included, and the legacy workflow copies on main and staging reference it; the owner restricts its repository selection in the GitHub UI. Verification: gh api orgs/a5c-ai/actions/secrets/NPM_TOKEN --jq .visibility → selected, and fabric absent from gh api orgs/a5c-ai/actions/secrets/NPM_TOKEN/repositories --jq '.repositories[].name'.
• **Owner decision 2026-10-05 — "Consumer-only gate for the first train"**: after publish run 37279009004 (7.0.1-staging.643131fbd416: all 43 candidates published and asserted, the exact-version published-consumer validation green, the three openai/gpt-5.5 live lanes red — an invalid OPENAI_API_KEY organization secret, invalid_api_key, plus Claude Code 2.1.2xx's unauthenticated /api/hello preflight against the transport-adapter proxy, fixed in the same fix-forward PR), the owner chose not to rotate the key now and to gate the first train's promotion on the exact-version consumer job. Implemented on fix/consumer-only-gate: promote_release_channel (branch train and from-tag recovery) depends on the callee outputs consumer_result and promotable and evaluates with !cancelled() while checking every upstream result explicitly; record_validation records the lanes with --live-lanes-gate derived from the repository/organization variable FABRIC_LIVE_LANES_GATE (unset or informational → informational, listed under informationalFailures; required → the full gate, and then the called workflow's aggregate result must be green too; the script's own default is required); no lane is continue-on-error. Unchanged: the consumer job itself (install/import/bin smoke of all 43 + §3.1 global-install), the packed-artifact gate, the candidate assertion, the tag-after-promotion order, the no-npmjs invariants. Condition to restore the full gate: a valid OPENAI_API_KEY (runbook §7.2). Spec 15 §4.2 does not state the live-lane gate as binding (WP-RN-07's test requirement names the consumer job), so no spec amendment was needed; the runbook §0a/§1/§3/§7.2 carry the dated amendment.
• **No guard or test weakened**: the flipped fixture became a negative; --private-train is accepted as a no-op; every rewritten assertion is listed in §4 with its stricter form.

9. Release-machinery review fixes (2026-10-04)

The release-machinery review of 20ef45aa9 scored 87 (threshold 90; every criterion ≥ 80; no blocking finding) with seven mustFix items. Owner decisions at the pre-Gate-B interview, verbatim: M4 "Spec 15 wins: staging = 7.0.1-staging.<sha>"; M2 "Enable all four now" (done by the orchestrator); M6/M7 "I'll do both before Gate B". Each fix is its own commit on phase1/rename-train; the gates of §5 were re-run (tails in the review-fix task output). Nothing was published, no tag was created, no workflow was enabled or disabled by the fixes, and the public repository's pushed_at stayed 2026-09-16T19:59:50Z.

9.1 What the rehearsal job found on its first runs — three defects of the real train

The release-train-rehearsal job runs the train's publish_candidates sequence over the real tree, and its first runs failed on three defects that the live staging train would have hit in the same step, before publishing anything. Each was fixed in its own commit with a pinning test; none is a rehearsal-only problem.

9.2 The green rehearsal and the CI state of the final head

**ci.yml run 37179946474 (head cb8ab8c54) — <https://github.com/a5c-ai/fabric/actions/runs/37179946474>**: Release train rehearsal (dry-run, all packages) **success** (job 111370301481, <https://github.com/a5c-ai/fabric/actions/runs/37179946474/job/111370301481>); its proof step printed waves completed: 13/13; packages dry-run-published: 43/43; publish commands: 43 and Rehearsal reached wave 13/13; 43/43 packages dry-run-published; 0 publish commands without --dry-run — no published line, no dist-tag add, no npmjs in any helper log, no credential, no OIDC token, no opt-in. Other jobs of the same run: Release tooling tests **success** (the 21-test private-release-train suite included), Lint/Tests/Package **success**, Public-push guard **success**, Publish-isolation guards **success**, Observer Dashboard **success**, Workspace Coverage **success**; Docs QA **failure** (inherited: docs:links passed, docs:freshness fails with the baseline's identical 7-entry stale list — verified on runs 37176658216 and 37178840931 as well), Gateway Node engine floor (22) / (22.13.0) **failure** (inherited, as before this WP). The run's overall conclusion is therefore failure for the three inherited jobs only. Release-tooling was green on every pushed head of this revision (37176658216, 37176949592, 37178013213, 37178840931, 37179946474).

**ci.yml run 37180964707 (head 6c9f9eed9, the final head of this revision) — <https://github.com/a5c-ai/fabric/actions/runs/37180964707>** (closes the "its ci.yml run was not awaited" gap of the previous revision of this record): Release train rehearsal (dry-run, all packages) **success** (job 111373287978: waves completed: 13/13; packages dry-run-published: 43/43; publish commands: 43), Release tooling tests **success** (job 111373288077, # tests 184 / # pass 184), Lint/Tests/Package **success** (job 111373288079, 47/47 steps), Public-push guard, Publish-isolation guards, Observer Dashboard, Workspace Coverage **success**; the three inherited reds only: Docs QA (job 111373288051 — docs:lint, docs:snippets, docs:links pass; docs:freshness fails on the identical 7-entry stale list: 04-agent-events, GAP-PROMPT-011, reference-repos/README, repo-with-babysitter-processes, faq, glossary, advanced-multi-phase), Gateway Node engine floor (22) job 111373288074 and (22.13.0) job 111373288031 (62 ##[error] lines each, the pre-existing TS2307/TS7006 set, scope-normalised diff against the baseline empty). Verifier run **37180964710** (release-artifact-verifier.yml, pull_request, 6c9f9eed9) — <https://github.com/a5c-ai/fabric/actions/runs/37180964710> — **success** (packed matrix 43/43, allowKnownFailures=false).

**Gate B reads it this way:** the first real run of publish-npm-private.yml is the staging merge; its rehearsal evidence is this job (the whole publish_candidates sequence over the real tree, dry-run, all 43 packages through all 13 waves — which already found and forced the fix of three defects the live train would have hit, §9.1) plus the verifier's 43/43 (release-artifact-verifier.yml on the same PR).

Nice-to-haves taken: the dry-run fixture now carries an exact internal pin (the M1 class cannot recur silently); runbook §4.2 makes "re-run the failed publish_candidates job" the first recovery option and keeps §4.3 for a dead run; §4.3 carries the /-ref dispatch note; §4 states that the failed wave is *partially* published (parallel helpers, wait collects every sibling). Not taken: operator --version / orchestrator-mcp --version printing versions (product-code changes in two CLIs, outside a review-fix revision; the live lanes smoke --version on the five §3.1 CLIs that implement it and the verifier smokes --help on these two).

9.3 Second release-machinery review (2026-10-04, score 91) — M8 and nice-to-haves

The second release-machinery review of 6c9f9eed9 scored 91 (threshold 90; every criterion ≥ 88; no blocking finding) and confirmed M1–M7 addressed. It raised one docs-only mustFix, **M8**, and this revision of the record is its fix; nothing in code, workflows or manifests changed.

Not taken in this revision (recorded for the follow-up list): ci.yml re-cats every accumulated helper log after each wave (410 notice lines for 43 publishes) — cosmetic, CI-only; the 16 real-named fixture manifests under scripts/ci/fixtures/publish-guards/g5/negative/duplicate-bin/packages/ remain a shadowing hazard for any OTHER tool that walks package.json files (the publish helper itself is immune since cb8ab8c54); ruleset 24103129 still enforces no required status checks; operator --version / orchestrator-mcp --version; the ESM-only posture note in docs/reference/package-publics.md. The first review's remaining nice-to-haves (console-tui vitest suite in CI, ci-oracle/staging-test-shape deletion, pkg-02 §5a lockfile numbers) are also carried to the follow-up list in the PR body.