Module registry hand-over must wait for the full source validation verdict

[rbuergi]

Part of #3842, requirement 3: a red or cancelled source build must not become visible to portals.

The shared node-repo-module-pack.yml workflow hands each module bundle to the live registry inside its pack matrix entry, immediately after that module's own suite. A sibling module, the portal-host suite, compile-check or the runtime gate can still fail afterwards. modules-floor artifacts are inputs to those later gates, so adding their jobs as dependencies of the existing pack job creates a cycle.

Evidence from the current workflow:

• Hand the bundle to the registry runs under inputs.publish && steps.plan.outputs.need_publish == 'true' inside pack.
• The module-bundle-<module> artifact is uploaded before the hand-over and already supplies downstream compile/runtime checks.
• Plugins modules-floor and modules-rest enable publishing on main push, schedule and repository dispatch. Their dependencies cover initial validation and platform selection, not the later full-source verdict.
• The core main-CD caller uses publish: false for its compose artifacts and independently publishes a NodeType/module set through plugins-bake. That separate publication path is outside this early module hand-over fix and remains in No platform pins in module repos — build against the released platform, and be TOLERANT of drift (same major serves) #3842.

Repair contract:

1. Keep packing, artifact upload and tests available before the full source verdict; move only live-registry hand-over into a downstream shared publication operation.
2. The caller must provide a positive verdict from every required validation job. Failed, skipped, cancelled, missing and unknown results must prevent every publication request.
3. Publish the exact validated artifact bytes for the selected source, framework identity, module and version. Refuse missing, substituted or foreign-lane receipts and artifacts. Reuse existing credential scope; no access-control or credential changes are included.
4. Preserve ledger reuse/coalescing and test ownership. A staged artifact is not a Published ledger record, and a failed hand-over must not be recorded as published.
5. Exercise both directions: green validation publishes the expected bytes, and a later sibling/source failure leaves the registry untouched even though the module was successfully packed. Mutation tests must detect a missing required dependency or a status-function override.
6. Carry the core and Plugins caller changes through green review/CI and verify supported production publication before closing this issue.

This issue removes publication before the source validation verdict. Atomic visibility if publication itself fails or is cancelled, all publishers' source provenance, and last-green source selection remain obligations of #3842 and the generation work in #3461. They must not be described as solved by moving this one hand-over step.

Related: Plugins #1583 blocks its bake publisher on the portal-host aggregate; it does not cover this earlier registry hand-over. Core #3876/#3877 repairs HTTP behavior while a publication seal is absent, not whether the producer was entitled to publish that source.

[rbuergi]

Status of the caller adoption (requirement 6), 2026-09-11 ~15:00Z.

Landed in core

• Module registry hand-over: Plugins caller wiring — roster pending state, declared output, pre-merge check-callers (#3878) #4032: the fleet roster can record an arriving caller as pending:. This PR adds the Plugins publish-modules row that way. It also adds node-repo-module-pack.yml's declared output, and module-publication.py check-callers, which node-repo-validate now runs on every satellite PR. The lane's caller-graph check therefore runs before merge instead of first on main.
• #3878 review follow-up: empty exemption reasons and expression publish-mode refuse; spent pending marker reads its reason #4034: review fixes. These refuse an unrelated-jobs exemption with an empty reason, refuse a publish-mode that isn't exactly staged or direct, and make a spent pending: marker that has an empty reason fail. The docs are scoped to what actually ships.

Durable write-up: Doc/Architecture/ModulePublicationGate (caller, both directions, check-callers, landing order, not-solved list) and Doc/Architecture/WorkflowPermissionPairing (pending:).

Open

• Systemorph/MeshWeaver.Plugins#1663 switches modules-floor to publish-mode: staged and adds publish-modules. Auto-merge is armed.
  • At 15:11Z, 4 of its 7 required contexts are green (both validate contexts, Repo policy gates, Module bundles / All selected bundles built), and 2 were still running (Compile every NodeType (vs core), test-repos). Build + test the portal hosts is red on shard 3 only, the known red on Plugins main from core set 8345 (NodeTypeRecompileAlcLeakTest). Shards 0 to 2 pass. The fix isn't on Plugins main yet; Plugins#1656 is diagnostics only.
  • Once the fix lands, merge origin/main into fix/3878-staged-module-publication, run python3 scripts/gen-manifests.py, and push. The new run then goes green and auto-merge lands it.
• After feat(hosting): the endpoint-contribution hook — modules map HTTP routes (#1655) #1663 merges, open the PR from core branch fix/3878-roster-marker-spent (f41b0dc28), which removes the spent marker. Do not open it earlier: I checked that this roster against a Plugins main without the caller fails --assert-fleet-row (exit 1).
• Production verification is still owed. The first trunk run after feat(hosting): the endpoint-contribution hook — modules map HTTP routes (#1655) #1663 must show publish-modules / Hand the validated bundles to the registry succeeding, with registry 2xx lines for the staged bytes. A PR run exercises neither staging nor the hand-over (publish is false there).

Not solved, and not claimed

• Atomic visibility if the publication itself fails part-way (one POST per module).
• Every publisher's provenance, and last-green selection (No platform pins in module repos — build against the released platform, and be TOLERANT of drift (same major serves) #3842, Two publish lanes write prebuilt-bundles/<identity>/plugins — an overlap seals a mix no reader can detect #3461).
• Core main-CD's plugins-bake.
• MeshWeaver.SocialMedia's in-leg publisher, which check-callers names on every PR there.
• The Plugins jobs declared unrelated (rn-app, e2e-static, test-drift, memex-template) gate neither publisher.