Repository navigation
Publish verified marketplace candidates with create-only remote writes #271
Description
🤖 Generated by the Agentic Engineer
Evidence and problem
The marketplace can prepare a version proposal, verify its exact release commit, and compare it with live GitHub state (#249, #253, #267). It still cannot deliver that checked version as a release consumers can pin. The remote assessment explicitly cannot reserve a tag or establish publication.
Audience: marketplace operators and consumers needing a versioned catalogue with release notes. Hypothesis: an explicit, create-only publication command can finish this path without allowing retries to overwrite another writer's work.
Smallest useful change
Add a manual publisher using the existing fresh remote assessment. Its default mode remains read-only; a deliberate publish option reserves the exact tag using GitHub's create-reference operation, checks the reservation and default branch, creates the release with the validated notes, and reads back the release and tag before reporting success. It never updates or deletes an existing tag/release and never retries an ambiguous write. Document partial-publication recovery and the independent readiness requirement. No scheduled publishing workflow is enabled.
Acceptance criteria
- Default invocation performs assessment only, with zero remote writes.
- Explicit publication requires complete verified candidate/source/release inputs and fresh remote state.
- Existing or raced tags/releases, moved default branches, malformed responses, failed reads and failed writes stop without a success result or overwrite.
- Successful output is bound to the exact repository, tag, commit and read-back published release; the notes match the reviewed candidate.
- Offline regression tests cover both modes, conflicting writers and every partial-failure boundary; CI runs them.
- After merge, exercise the initial real release against the reviewed main, read back its identity and install a bundled skill pinned to that release. Record any unmet step honestly.
Success signal: the first catalogue release can be installed by its tag and resolves to the verified commit. Guardrail: no existing remote object is modified or deleted. Size: M. Part of #101.
Metadata
Metadata
Assignees
Type
Fields
Priority
Start date
Target date
Effort
Projects
- Status
Activity
chore: agent-claim #271 nonce=26d777d51513e6220214c82dd4f6e74e
devantler commentedon Sep 30, 2026
Delivered through merge and publication. PR #272 merged as 65657df; the merged tree exactly matches reviewed head e64ef16. Post-merge CI 36722461204 and both code-analysis workflows passed at that exact commit.
The merged publisher created the first marketplace release, v1.0.0, release ID 400083568. Its independent GraphQL readback reported PUBLISHED; a separate REST read verified the release ID, published state, target commit, URL and exact generated note bytes. Independent Git resolution of refs/tags/v1.0.0 returned 65657df.
Native
gh skill install --all --pin v1.0.0installed all 26 skills across eight bundles into a disposable directory. Every installed repository, pin, source path and tree identity matches the released Git objects; all 26 instruction bodies and all 94 supporting files match byte-for-byte. No installed runtime cache was changed. The real read-only path also rejected the stale pre-merge proposal and, after publication, rejected the occupied v1.0.0 version; both failures emitted no success output.Validation includes 171 release regression cases (49 preparation, 37 verification, 39 remote assessment, 46 publication), all 26 skill specification checks and the repository/bundled suites. The initial substantive CodeRabbit review found no actionable code defects; its helper-documentation finding was fixed. All three providers then returned explicit limits at the final head, so the documented current-head local fallback review was posted and classified GREEN before normal protected promotion/merge. No merge bypass or existing tag/release overwrite was used.
All delivery acceptance criteria are satisfied. Parent #101 remains open for workflow orchestration of subsequent version proposals and guarded publication; this delivery provides the manual publisher and a verified first real release.