Scramjet 0.89.1 hardens forward-only releases against stale package versions and ambiguous partial publication.
Highlights
- Commit-bound release preflight: Validate the exact merged commit, clean release metadata, all five package manifests, fixed internal dependencies, workspace links, lockfile closure, and registry freshness before mutation.
- Five-fresh publication unit: Require unpublished forward versions for every package and publish each exactly once in dependency order, with bounded read-only propagation checks and no same-tag continuation.
- Independent release proofs: Verify npm attestation metadata, native signatures, isolated postinstall-enabled installation, exact five-package runtime closure, and the installed CLI as separate outcomes.
- Forward-only recovery: Treat partial or ambiguous publication as permanent for that tag, prohibit retries, and direct recovery through another release with five fresh versions.
- Exact merge targeting: Bind release creation to the confirmed merge SHA and preserve separate reporting for GitHub release creation, package publication, provenance, and clean installation.
- Portable release tests: Make Git and polling fixtures deterministic across shallow Linux and macOS CI checkouts.
Known limitations
- Publication is intentionally nontransactional: an external registry or transport failure can leave a partial package set that requires a new forward release.
- Final success depends on npm metadata propagation, provenance, native signature audit, and clean-install verification in the tag workflow; creating the GitHub release does not itself prove those outcomes.
Closes #514 by preventing stale package versions from reaching immutable release tags and enforcing five-fresh, forward-only recovery.
Reviewed by GPT-5.6 Sol