Recover immutable v0.8.25 publication for native, SDK, and GHCR

[robinbraemer]

Parent

Canonical Windows epic: https://github.com/akua-dev/cnap/issues/390

Scope

Recover the already-created immutable v0.8.25 release publication without retagging, recreating the GitHub Release, or changing its assets. The tag must remain 6452eb662445d2ad7c108128f93b9c55138729bb; the existing GitHub Release is 352631784 with its 19 assets, including the Windows native asset. Do not use an npm token.

Acceptance criteria

• Before a recovery dispatch, probe all ten packages at 0.8.25 and their latest tags. Treat an already-published package as success only after verifying its exact version and provenance; do not overwrite or republish it.
• An npm administrator configures every package's Trusted Publisher to GitHub organization akua-dev, repository akua, workflow release-publish.yml, and no GitHub Environment:
  • @akua-dev/native-engines
  • @akua-dev/native-darwin-arm64
  • @akua-dev/native-darwin-x64
  • @akua-dev/native-linux-arm64-gnu
  • @akua-dev/native-linux-arm64-musl
  • @akua-dev/native-linux-x64-gnu
  • @akua-dev/native-linux-x64-musl
  • @akua-dev/native-win32-x64-msvc
  • @akua-dev/native
  • @akua-dev/sdk
• Reconfirm the exact tag SHA, green main CI run 29168109111, and the existing release/assets before a separately authorized recovery dispatch.
• Recover publication through GitHub OIDC (id-token: write) and the existing release-publish path; preserve probe-before-publish/idempotency for every package.
• Verify every package resolves at 0.8.25, @akua-dev/native and @akua-dev/sdk resolve at the intended dist-tag, and the Windows optional package is present.
• Repair or explicitly account for the GHCR/OIDC publication boundary: the original release Docker job 86596485362 failed while targeting stale ghcr.io/cnap-tech/akua; do not claim GHCR provenance for v0.8.25 until a safely authorized recovery proves immutable image digest/provenance.

Evidence

• Akua PR #68 merged the configured Git HTTPS CA-bundle preservation fix at the tag SHA.
• Release run 29171807994 built native Windows and release assets but failed only in Docker push; publish run 29172771842 failed before the first npm package and skipped SDK publication.
• 2026-07-20: All ten npm Trusted Publishers verified complete through the human-owned interactive npm bootstrap — every @akua-dev package resolves to GitHub org akua-dev, repository akua, workflow release-publish.yml, no Environment, npm-publish only; the prior cnap-tech/akua tuple is absent. Credential-free registry reads confirm all ten packages remain absent at 0.8.25 (latest 0.8.24), and GHCR still holds v0.8.24, not v0.8.25.

Current blocker

Trusted Publisher prerequisites, probes, and the tag/CI/assets reconfirmation are complete. This issue is now blocked only on the separately-authorized OIDC publication-recovery dispatch and its post-publish verification (per-package 0.8.25 resolution, intended dist-tags, Windows optional package, and any authorized GHCR provenance). No token, no retag, no release recreation.

Boundaries

No retag, no release recreation, no source change, and no cnap version update in this issue. The canonical epic remains blocked until this is verified.

[robinbraemer]

Recovery audit — 2026-07-15 (credential-free public npm registry read): all ten required packages return HTTP 200, 0.8.25=missing, and latest=0.8.24:

• @akua-dev/native-engines
• @akua-dev/native-darwin-arm64
• @akua-dev/native-darwin-x64
• @akua-dev/native-linux-arm64-gnu
• @akua-dev/native-linux-arm64-musl
• @akua-dev/native-linux-x64-gnu
• @akua-dev/native-linux-x64-musl
• @akua-dev/native-win32-x64-msvc
• @akua-dev/native
• @akua-dev/sdk

This fails #390 gate 1 before cnap#421 can update its ^0.8.24 catalog/lockfile or any Windows proof can begin. No npm token/configuration or local token material was used; no recovery workflow was dispatched.

The separately preserved cnap preload-retry commit c124f2a8b6615af38c42a898a8280498603beca4 was not carried forward: its narrow patch was already squash-merged as cnap PR #400 at 55d1d5420.

Required action: an npm administrator must configure the exact GitHub Trusted Publisher (akua-dev / akua / release-publish.yml / no GitHub Environment) for each of the ten packages above. This worker cannot perform that external administration; any OIDC recovery dispatch remains separately authorization-gated.

[robinbraemer]

Trusted Publisher source reconciliation — 2026-07-16 (read-only):

The current Akua source checkout (25ee8f73abccf1d4a8bc158ce6a76c518d376e5d) has no diff in .github/workflows/release-publish.yml or the ten publishing package manifests from immutable release tag 6452eb662445d2ad7c108128f93b9c55138729bb. The tag workflow is workflow_dispatch, declares repository-level id-token: write, publishes with npm provenance, and contains no environment: declaration. For stable tag v0.8.25, it selects the latest dist-tag.

Required Trusted Publisher tuple — configure separately for each package:

GitHub organization=akua-dev; repository=akua; workflow=release-publish.yml; GitHub Environment=none

• @akua-dev/native-engines
• @akua-dev/native-darwin-arm64
• @akua-dev/native-darwin-x64
• @akua-dev/native-linux-arm64-gnu
• @akua-dev/native-linux-arm64-musl
• @akua-dev/native-linux-x64-gnu
• @akua-dev/native-linux-x64-musl
• @akua-dev/native-win32-x64-msvc
• @akua-dev/native
• @akua-dev/sdk

A fresh credential-free public-registry read still reports 0.8.25=missing and latest=0.8.24 for every package above. Public npm metadata cannot reveal Trusted Publisher configuration, so this verifies the exact source-derived checklist, not that an administrator has completed it. No token/configuration, workflow dispatch/rerun, release mutation, provider action, deployment, or source change occurred.

Exact captain/npm-admin action: configure the tuple above for every listed package in npm Trusted Publishers, then return per-package confirmation. A recovery dispatch remains separately authorization-gated.

[robinbraemer]

2026-07-18 release-recovery reconciliation — material contract conflict, no dispatch performed.

PR #69 is OPEN with 2/2 required checks passing. Its reviewed recovery source explicitly updates an existing Release in place with gh release upload ... --clobber (two paths in release.yml), and its stated intent is to rebuild from the immutable tag and replace assets by name. This conflicts with this issue and cnap#390, which require preserving the existing 19 Release assets without changes.

Both statements cannot govern one recovery operation. The immutable tag 6452eb662445d2ad7c108128f93b9c55138729bb, existing Windows native digest, and existing CLI ZIP digest remain recorded provenance; no asset, tag, release, package, GHCR, workflow, credential, or provider action was taken.

Captain decision required before any merge or recovery authorization: choose either (A) npm/GHCR recovery that preserves all existing Release assets, or (B) explicitly authorized, checksum-bound replacement of named Release assets from the immutable tag. The chosen policy must be made consistent across PR #69, akua#71, and cnap#390 before a separate Trusted-Publisher/admin gate and recovery-dispatch gate can proceed.

[robinbraemer]

2026-07-18 public-registry refresh (read-only).

All ten required @akua-dev packages remain HTTP 404 at 0.8.25 and latest=0.8.24. PR #69 remains OPEN at ce255935fb1c49d33b9b005e8075dbc4d206722e with 2/2 checks passing, but its gh release upload --clobber paths conflict with this issue’s no-change preservation requirement for Release 352631784 and all 19 assets. Record this as the sole destructive/admin recovery-policy boundary; no choice, merge, dispatch, publication, credential, or release-asset action was taken. The required next action is a captain decision that aligns the preserve-all-assets policy with the recovery implementation before any Trusted Publisher administration or recovery dispatch.

[robinbraemer]

2026-07-18 captain policy resolution: preserve all 19 existing immutable Release 352631784 assets byte-for-byte. PR #69 must not contain gh release upload --clobber, any named-asset replacement, or any recovery path that changes existing Release bytes. The allowed recovery scope is SHA-bound source rebuild plus future-authorized npm/GHCR recovery from verified workflow artifacts; publication and every release/workflow dispatch remain unauthorized. Trusted Publisher administration remains a separate authorized-admin action.

[robinbraemer]

2026-07-18 source reconciliation is pushed to PR #69 at b73db1fe7be04fb4730ec69657a541e5a6cfbe93: recovery now preserves all 19 existing Release assets byte-for-byte, removes Release upload/clobber paths, and uses a SHA-bound source-run artifact handoff. No publication, release/workflow dispatch, credential, provider, or registry action occurred.

Current validation blocker: both required native PR checks (Rust and SDK) are still pending/queued at that exact head (0 passed, 0 failed). No rerun or cancellation was performed. Required action: GitHub Actions scheduler completes the existing checks; only then can the source correction be treated as review-ready.

[robinbraemer]

2026-07-18 exact-head source-only merge preflight PASS.

Akua PR #69 remains OPEN at exact head b73db1fe7be04fb4730ec69657a541e5a6cfbe93; current main is 25ee8f73abccf1d4a8bc158ce6a76c518d376e5d. A fresh exact git merge-tree of that head into current main is conflict-free and git diff --check is clean. Both required checks are green at that head: Rust (fmt + clippy + test) and SDK (bun + node WASI).

The complete 25-file, 643-insertion/279-deletion PR diff remains the declared immutable-v0.8.25 release-recovery scope: release workflow/publisher hardening, the ten package coordinates, and directly related guards and documentation. The exact tree contains no gh release upload, --clobber, or GitHub Release download path; the recovery flow only verifies the existing Release and binds a future separately authorized publisher to a SHA-verified source-run artifact. This preserves all 19 existing Release 352631784 assets byte-for-byte.

No merge, publication, workflow dispatch, credential, registry, provider, deployment, or runtime action occurred. Review-ready handoff only: captain may authorize merge of PR #69. Any Trusted Publisher administration and any recovery dispatch remain separate, unauthorized actions.

[robinbraemer]

2026-07-18 exact-head check-suite correction — external blocker, no action taken.

PR #69 remains OPEN at b73db1fe7be04fb4730ec69657a541e5a6cfbe93, with clean merge-tree into Akua main 25ee8f73abccf1d4a8bc158ce6a76c518d376e5d. Rust and SDK are green, but the PR is not fully green: GitHub external check suite 80317667761 (Claude) and 80317667830 (Akua Renovate) are queued with zero jobs. Do not merge, rerun, or cancel. Required external action: the GitHub App/scheduler must complete or resolve those two suites at this exact head.

Independent credential-free registry refresh was also completed: all ten required @akua-dev packages still lack 0.8.25, and every latest tag remains 0.8.24. Thus #390 publication gate 1 and cnap#421 remain blocked; provenance cannot be established for unpublished versions. No npm administration, publication, dispatch, credential, registry write, provider, or runtime action occurred.

[robinbraemer]

2026-07-19 credential-free registry checkpoint: all ten required @akua-dev packages remain absent at 0.8.25; each current latest tag is 0.8.24. Akua PR #69 remains OPEN at b73db1fe7be04fb4730ec69657a541e5a6cfbe93 with Rust and SDK passing, but no merge, dispatch, publication, credential, or release mutation occurred. Required next external prerequisites remain completion of the App check boundary and npm-administrator configuration of all ten Trusted Publisher tuples (akua-dev / akua / release-publish.yml / no Environment). Only separately authorized recovery may then establish package and GHCR provenance.

[robinbraemer]

2026-07-19 captain-authorized Trusted Publisher attempt stopped safely before any package change. The existing approved browser session reaches https://www.npmjs.com/package/@akua-dev/native-engines/access only to npm Cloudflare “Performing security verification”; package settings and authentication state are unavailable. No token was requested, read, copied, or used; no publisher, package, dist-tag, workflow, release, or asset changed.

Credential-owner action required: in an already authenticated npm administrator browser session, complete the normal npm verification and, for each of the ten packages named in this issue, open Package settings → Trusted Publisher and configure exactly GitHub organization akua-dev, repository akua, workflow release-publish.yml, with no GitHub Environment. Re-read the non-secret setting for each package afterward. Do not publish or dispatch.

[robinbraemer]

2026-07-19 downstream source-only update: cnap PR #146 merged from 3cea651087f667f7ba6f5ea6442a75c8e93f8a31 as cnap main 120db1a7575a8e824d1493d593587b3d119b63a1, with 9 passed/0 failed checks. This does not publish or alter any Akua asset, package, dist-tag, release, or workflow. The established npm-owner action remains: after normal npm verification, configure exactly the ten named package Trusted Publishers as akua-dev / akua / release-publish.yml / no Environment, then confirm settings non-secretly before any separately authorized recovery.

[robinbraemer]

2026-07-19 corrected Trusted Publisher design report (sanitized, design-only): the prior claim that npm lacks a supported CLI was wrong. npm supports npm trust github, npm trust list, and npm trust revoke; current writes require npm 11.15+ and --allow-publish. The exact target remains ten packages, tuple akua-dev / akua / release-publish.yml / no Environment, npm-publish permission only.

Recommended option A: a human package writer uses npm 11.15+ for a static ten-row, read-before-write/read-after-write batch; the writer completes the first browser/2FA challenge, uses the npm website five-minute skip window if offered, and processes rows two seconds apart. Option B: the same human-owned CLI batch with a credential-free witness validating tuple/receipts. Option C: npm Settings → Trusted Publisher writes with CLI read-back, only if A cannot be made available. Unattended CI cannot bootstrap trust because it cannot satisfy the human browser/2FA boundary. Never auto-revoke a mismatch.

Public metadata lists only robinbraemer; no alternate authorized maintainer is established. No authentication, trust mutation, publication, release dispatch, source change, token access, or credential access occurred.

[robinbraemer]

2026-07-20 Trusted Publisher prerequisite complete (human-owned bootstrap; verified read-back). All ten required packages now read back exactly one GitHub Actions publisher: organization akua-dev, repository akua, workflow release-publish.yml, no environment, and npm-publish permission only. The prior cnap-tech/akua tuple is absent from every read-back. The redacted per-package ledger is retained privately.

This completes trust configuration only. It does not publish packages, alter dist-tags, dispatch recovery, touch Release assets, or establish package/GHCR provenance. This issue remains open pending separately authorized, SHA-bound publication recovery and remote verification.

[robinbraemer]

2026-07-20 post-trust public registry verification (credential-free): despite completed Trusted Publisher setup, all ten required packages still lack 0.8.25 and each latest remains 0.8.24. Akua PR #69 remains OPEN with Rust and SDK passing. Trust setup is complete; publication remains a separately authorized recovery gate, and no package/release/GHCR action was taken.

[robinbraemer]

2026-07-20 decision packet — immutable publication recovery (no action authorized by this packet).

Action: separately authorize one SHA-bound recovery only after PR #69 is fully reviewable and its external App-suite boundary is resolved. Scope: publish only verified-missing 0.8.25 packages from the approved source-run artifact path; preserve tag, Release 352631784, and all 19 assets byte-for-byte; do not alter dist-tags except as the approved workflow proves necessary.

Evidence: all ten Trusted Publisher tuples are now privately verified; public registry still reports all ten 0.8.25 versions missing and latest=0.8.24; PR #69 remains the source recovery candidate. Rollback: immutable npm publication cannot safely be undone—abort before dispatch on any identity/artifact/read-back mismatch; do not unpublish, retag, replace assets, or auto-retry. Recommendation: wait for full PR #69 gate resolution plus explicit publication authority, then use the idempotent per-package read-back contract.