v0.11.1 - trusted publishing verification

v0.11.1 - trusted publishing verification

Released 2026-08-07.

Release automation

• npm publishing now runs from .github/workflows/release.yml through GitHub Actions OIDC and the package-scoped npm Trusted Publisher.
• The workflow binds a stable SemVer tag to the exact main commit and package version before running release gates, the full test suite, and package inspection.
• Registry availability and npm provenance are verified before the matching GitHub Release is created.

Security posture

• The GitHub npm environment is restricted to v* release tags, and protected release tags cannot be deleted or retargeted.
• No npm automation token is configured in GitHub; the trusted connection grants only the npm publish action.

Canvas interaction reliability

• New-anchor comment focus now completes synchronously, so a delayed callback cannot steal focus after the user moves to another control.
• The browser regression test deterministically covers immediate focus handoff followed by Ctrl/Cmd+Z anchor undo.

Package compatibility

• Public contracts remain compatible with v0.11.0; this patch updates distribution metadata and fixes the Canvas focus race.
• Installable inventory remains 8 model skills, 4 commands, and 2 bundled MCP servers.

Validation

• Clean origin/main baseline: python -m pytest -q passed 190 tests plus 83 subtests.
• npm pack --dry-run: design-playbook@0.11.1, 53 files, 122.8 kB packed / 460.9 kB unpacked.