Qualify the exact versioned release package set and distinguish version maintenance from publication

[ScriptedAlchemy]

Priority and scope

P3 — release evidence and outcome reporting, not a demonstrated publishing defect. Companion to Version Packages #411; not a replacement release PR or a request to enable publishing.

Audited main: b435f7b9179271cbff81d3e40d14ee342cbd65dd. Record the exact versioned candidate SHA used for qualification when this work is executed; do not assume a moving release-PR head is already qualified.

Problem

The existing Release packages workflow intentionally supports version maintenance without publication. A successful run can therefore mean that the Version Packages PR was refreshed, not that the final versioned package set was tested or published.

Green checks on the pre-version main commit also do not, by themselves, establish qualification of a later versioned candidate. The review has not established a failed release or inspected secret values; this issue makes the outcome and supporting evidence explicit.

Existing implementation to preserve

• release.yml conditionally supplies a publish script and already has a publish-disabled release-gate path.
• run-packed-tests.mjs builds/packs public packages, runs actual installed package bins, isolates synthetic rebundling fixtures, and checks that tests did not mutate publishable dist.
• Existing packed tests already cover generated plugins, lifecycle execution, source deletion, hidden host files, installed bins, and npm mode normalization. Do not report those as missing or create a second qualification harness.

Acceptance

• Add explicit outcomes to the existing workflow summary: version-maintenance-only, qualified-without-publish, published, or failed, with executed/skipped qualification stages identified.
• Run qualification against the exact final versioned candidate, not merely the pre-version base; record its commit SHA.
• Record package names/versions, tarball digests, and executed test groups for that candidate set.
• Use clean installed consumers to exercise every declared executable in the candidate packages, reusing the current packed infrastructure.
• Preserve and run the generated-plugin, web-command, deleted-source, lifecycle-script, hidden-host-file, executable-mode, and packed Workbench regression coverage.
• Verify final inter-package dependency ranges and absence of unintended workspace-only references in packed manifests.
• When publication is separately authorized and actually performed, verify the expected registry artifacts and report publication distinctly. Otherwise explicitly report not published; disabled publication remains a supported outcome.
• Record the disposition of the review follow-ups against the qualified SHA: Workbench: resolve exact compiled executable from manifest; fail-closed preflight (no flight probing) #680 executable/preflight selection; Bound Workbench producer / completed-envelope render history end to end #681 retention; Prove successful native Claude Code / Codex host sessions in Workbench #683 native acceptance; Legacy uninstall must not infer external state purge ownership from the current environment #685 legacy purge; Stream generated MCP/event Flight bytes before render completion #686 production Flight streaming; Workbench inspector must not infer resultSchema declaration or validation from result presence #688 schema-label provenance. Do not automatically reopen resolved architecture umbrellas.

Evidence-map disposition

#682 was closed during issue filing with a production-file/test evidence map and no code change. Preserve that completed reconciliation. The separate concrete resultSchema display defect is now #688; qualification should not confuse closing the evidence map with fixing that display condition.

Test and workflow owners

• .github/workflows/release.yml
• root package.json release/check scripts and scripts/run-packed-tests.mjs
• packages/agent-bundle/tests/packed-web-command.test.ts
• packages/agent-bundle/tests/prepack.test.ts
• packages/agent-bundle/tests/install.test.ts
• packages/workbench/tests/packed-release.e2e.test.ts

Non-goals

No automatic publish enablement, token/credential changes, unauthorized merge or publication of #411, duplicate package compiler, new release service, or claim that the current green workflow is broken.

[ScriptedAlchemy]

Current-main reconciliation — keep the delivered release machinery closed

At b5cf7575e0bcfa6da23e12d2c5628146bdbe5cb1, .github/workflows/release.yml already has candidate evidence, a publication-only registry check, and an always-run release outcome summary. Do not reopen this as a request to build another release reporting or packed-qualification system.

Qualification of a particular candidate is still separate from implementation of that machinery. #411 currently proposes agent-bundle@0.2.0 with @agent-bundle/runtime@0.1.0 at 00d0a42d437320e53a852ee2a7dc70eaaa792c4b. The commit-specific review records a remaining scaffolder pairing defect: runtimeSpecForFramework mirrors a compiler selector/versioned tarball suffix and therefore selects runtime 0.2.0, not this candidate's 0.1.0. I re-read the helper on current main; that assumption remains.

Track its correction through the existing #411 review and a normal source fix, then let Changesets regenerate the release branch. Add an actual differently-versioned compiler/runtime tarball scaffold test to the existing qualification path. Preserve correct same-SHA preview pairing and the deliberate refusal to guess a non-preview default. Do not force all packages into lockstep or edit generated release versions by hand merely to work around the helper.

This comment does not claim current-head qualification passed, that publication occurred, or that any credentials/workflow settings were changed. No duplicate release issue is needed for the already-reviewed finding.