rules: add publication and release safety to common repository rules

rules/common/repository.md

@@ -28,6 +28,49 @@
 - If a needed behavior does not fit the current abstraction, refine the
   abstraction instead of patching around it locally.
 
+## Publication And Release Safety
+
+Releasing crates or packages to a registry is irreversible. These rules apply
+to every repository that publishes:
+
+- Maintain a canonical, versioned publication DAG for all publishable
+  packages, derived from the package dependency graph (topological order over
+  cross-package normal/build dependencies). A package must publish only after
+  every package it depends on exists on the registry at the target version.
+- A publishable package must not carry a **versioned** dev-dependency on a
+  package that publishes later in the canonical order: versioned requirements
+  resolve against the registry during packaging even without verification.
+  Path-only (unversioned) dev-dependencies are safe for cross-layer tests
+  because dev-dependencies are stripped from published manifests and never
+  registry-resolve for consumers; a declared dev version must still match the
+  workspace version.
+- The complete dependency graph among publishable packages must not contain a
+  publication cycle over versioned edges (versioned edges are the only ones
+  that registry-resolve at package time; unversioned path dev-edges cannot
+  create a publish-time cycle).
+- Publication is a human-only action. Agents prepare and validate, then stop:
+  they never execute publication and never type the final confirmation.
+- For human execution, generate a guarded handoff script instead of asking
+  the human to retype commands. The generated script must be mode 0700,
+  `bash -n` clean, non-append, restart-safe, require a TTY, re-run the
+  fail-closed preflight, and then ask for one exact lowercase confirmation
+  immediately before invoking the publish helper with the execute flag. Pin
+  the helper and canonical workflow with checksums computed at generation and
+  re-verified at run time, so a later helper change cannot silently alter
+  publication behavior. Write the script outside the release worktree when
+  untracked files abort the release.
+- Revalidation at release time is change-aware: classify the diff between the
+  previous release and the tag (helper/workflow-only, publication-metadata
+  only, semantic manifest, or source/ambiguous) and run only the validation
+  lane the strongest change demands. Conservative by default: source or
+  ambiguous changes run the full validation.
+- Before skipping a rerun on the strength of previously passed CI, verify
+  every required check run for the exact release commit (per-repository
+  canonical query, e.g. GitHub check-runs with `--paginate`), requiring the
+  run's commit to match, `status == "completed"`, and
+  `conclusion == "success"`; anything else fails closed and reruns the
+  applicable tier.
+
 ## Dependency And Boundary Discipline
 
 - Shared dependencies should be declared once at the workspace or package

rules/index.md

@@ -6,7 +6,8 @@ load language-specific rules when the task touches that language.
 ## Common
 
 - [`common/repository.md`](common/repository.md): source of truth, API surface,
-  layering, dependency boundaries, and repository-local overrides.
+  layering, dependency boundaries, publication/release safety, and
+  repository-local overrides.
 - [`common/performance.md`](common/performance.md): general performance review
   checklist for tensor, compiler, cache, and backend work.
 - [`common/docs-and-tests.md`](common/docs-and-tests.md): documentation audits,