# Release Process

## Checklist

1. Confirm only approved skills exist.
2. Run `node scripts/validate-pack.mjs .`.
3. Run `node scripts/test-pack.mjs`.
4. Run `node scripts/validate-maintainer-loop.mjs .`.
5. Run `node scripts/verify-evidence-bundle.mjs tests/fixtures/evidence-bundles/valid-bundle/evidence-bundle.json`.
6. Run `node scripts/render-evidence-archive-report.mjs tests/fixtures/evidence-bundles/valid-bundle/evidence-bundle.json`.
   Confirm the sanitized report includes archive-index status, retention-expiry advisory
   status, and detached-signature verification planning metadata without raw evidence.
7. Run `node --test`.
8. Parse every JSON file.
9. Run a secret-pattern scan without printing values.
10. Run `git diff --check`.
11. Run `npm publish --dry-run --access public --registry=https://registry.npmjs.org/`.
12. Create a tarball with `npm pack` into a temporary directory.
13. Inspect tarball contents for local-only files, credentials, `.env` files, dependency
    folders, generated output, and unrelated repositories.
14. Install the tarball into a temporary npm prefix and smoke-test the installed CLI.
15. Smoke-test human-readable and `--json` output for public commands touched by the
    release. JSON output must include safety flags, `recommendedNextAction`, and
    `exitCodeMeaning` without secrets or `.env` contents.
16. Smoke-test any new CLI command such as `coding-agent-skills route-trace`,
    `coding-agent-skills env-audit`, `coding-agent-skills secret-audit`,
    `coding-agent-skills api-contract-audit`, `coding-agent-skills migration-review`,
    `coding-agent-skills github-handoff`, or `coding-agent-skills deployment-preflight`
    against synthetic fixtures only unless a real project read-only smoke is explicitly
    approved.
17. Review changelog, ledger, run evidence, and versioning impact.
18. Commit with approved identity.
19. Push `main` using credential-free remotes.
20. Confirm a clean synchronized worktree.
21. Create and push the annotated version tag.
22. Publish with `npm publish --access public --registry=https://registry.npmjs.org/`.
23. Install the published package into a temporary prefix and smoke-test the installed CLI.
24. Create the GitHub Release for the pushed tag.

Deployments, migrations, runtime mutation, platform actions, and target-project builds or
tests remain outside this release process unless separately approved.

The [npm package release guide](npm-package.md) documents the public package shape,
dry-run inspection, publication checks, and safety boundaries.

## Maintainer-Loop Boundary

The maintainer loop may run release preflight when `release-preflight` is explicitly
allowed. The `commit`, `tag`, and `push` permissions represent separate human approval
boundaries; the initial runner records and stops at those gates rather than publishing
silently.