[anilkreddy]

Setup previously emitted installation outputs without a notification event or GitHub run summary. Add commercekit.setup.completed and the shared status/input/result summary layout after handled success or failure, including invalid input, release discovery, download and verification failures. Existing version input, installer, integrity checks, verified cache reuse and installation outputs remain unchanged; cache hits remain successful.

Reporting uses the existing notification-contract's public capture/redaction, event validation, allowlisted GitHub context and summary primitives. The version input is represented safely, JWT/credential-bearing URLs are redacted, absolute executable paths are omitted from notifications/summaries, and workflow references agree. Reporting failures preserve the original installation outcome. No webhook delivery, auth subsystem or local event schema is added.

Published registry adoption

The owner authorized package publication and green merges. Action-kit #13 merged; package-only run 43678067818 published actual notification-contract 0.0.6 from main 3fecce40414d709884fa48e48eca278f470b20b0 after exact-main CI/CodeQL passed. Setup now uses that exact registry dependency, reproducible lockfile, reviewed release-age exception and rebuilt standalone bundle. Consumers require no package credentials.

• Registry integrity: sha512-n6F84900sDPBeYm5dnf8HLCM9B2DUVATEeF717dqKsSXTJtq1FIj/3hZ2UcNTtXe7v8R90HYF6HIom4auM8Kyw==.
• Registry shasum: 8030f643d1dd6d741caa2c3c0ba321ad82b30cca.
• Artifact SHA256: e4b79576328c2992a96fed087e9ba6e63970e8b54d6fca976a6652702a7a73a9.
• Normal bundle SHA256: ccec5024b018a009fada020bb6cebe292160b45cc2ee1224f6e4d957d9c81bae, byte-identical to the final reviewed candidate.
• Final normal head: 0adfaabc67d734e034209c59d80de22013d41402.

No candidate flag, file dependency, source checkout or fake registry version remains in normal development. Historical candidate procedure/provenance is archived through immutable commit links.

Validation

PASS with normal published registry dependencies: frozen install/public exports, formatting, lint, strict types, 154 tests/11 files, full pnpm quality after committing regenerated dist, real public CLI bundle integration, scan, production audit (no known vulnerabilities), actionlint and diff checks. Coverage: 94.06% statements, 90.29% branches, 93.54% functions, 94.21% lines; existing thresholds/source inclusion are unchanged.

The actual normal bundle installed public CLI 0.1.0-preview.2 on darwin-arm64, verified exact version/integrity, reused its verified cache, emitted validated success events/summaries, and exercised the real entry point for invalid-JWT input failure without exposing the value. This installation was isolated in temporary runner/cache directories and cleaned up; no SAP operation occurred.

Final normal head 0adfaabc67d734e034209c59d80de22013d41402 passed CI 43678697973: quality plus all six native Linux/macOS/Windows x64/ARM64 integration jobs, executing the new registry-backed bundle. CodeQL 43678698006 and processed security check 132704576032 also passed. These are final-feature results, not earlier baseline-bundle jobs. This PR merged after all checks passed using the repository's existing explicit OrganizationAdmin review-bypass allowance. The authenticated organization administrator performed the merge; no ruleset was changed and no reviewer approval was fabricated.

Full registry-backed evidence records exact provenance, commands, coverage and remaining owner release/live validation gates. The dependency publication blocker is resolved; this remains an unreleased Action. Only the shared package was published. No Action release, Git tag, deployment, live provider send, real SAP operation or deletion enablement occurred.

Companions: action-kit #13, Notify #19, Build #8, Deploy #10, cleanup #8, integration harness #3. The coordinated implementation PRs are now merged.

Final coordinated registry validation

All seven original PRs are merged. The dependency-publication/adoption blocker is resolved. Each Action uses actual registry notification-contract 0.0.6 with a frozen reproducible lockfile and regenerated committed bundle. No candidate flag or local package link is required.

Final verified main 52a5a098d89f9ef2c42a234b4c3baa5d60a7a896: CI/validate 43679114996 and CodeQL 43679114994 PASS. Exact-main processed analysis 2169886190 has zero results, empty error/warning fields and zero open main alerts.

Final registry-installed validation report and sanitized exact-source/bundle evidence: 76 harness tests and the final 24-record five-action integration replay PASS. Four isolated local Sandbox runs were removed with absence verified; Cleanup performed zero target mutations. All 16 provider requests were strict mocks.

The final processed security review found five generated-code alerts in new Build/Deploy test preloads despite green workflow jobs. Narrow test-only follow-ups Build #10 and Deploy #11 removed data-to-code interpolation, passed full validation, and resolved all findings. Production source and bundle hashes are unchanged. Setup used its existing OrganizationAdmin merge exception after all six native jobs, quality and CodeQL passed; no branch rules were changed.

Only the requested shared package was published. No Git tags, Action releases, deployments, hosted Sandbox dispatches, live notifications or real SAP operations occurred. Production cleanup eligibility and separately authorized live/release validation gates remain closed.

Companions: action-kit #13, notify #19, ccv2-build #8, ccv2-deploy #10, setup-commercekit #14, ccv2-build-cleanup #8, action-integration-tests #3.