refactor(release): stage reproducible artifacts

Author: fullofcaffeine

.beads/issues.jsonl

@@ -197,29 +197,24 @@ jobs:
           "$haxe_bin" -version
           echo "HAXE_BIN=$haxe_bin" >> "$GITHUB_ENV"
 
-      - name: Configure git identity (for release commits)
-        if: steps.release_context.outputs.should_skip != 'true'
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
       - name: Release
         id: semantic_release
         if: steps.release_context.outputs.should_skip != 'true'
         env:
           GITHUB_TOKEN: ${{ github.token }}
           GH_TOKEN: ${{ github.token }}
+          RELEASE_SOURCE_SHA: ${{ steps.release_context.outputs.target_sha }}
         run: |
           set -euo pipefail
-          before_version="$(node -e "process.stdout.write(require('./scripts/release/sync-versions').latestReachableVersion())")"
+          before_tag="$(git describe --tags --abbrev=0 --match 'v[0-9]*.[0-9]*.[0-9]*' HEAD)"
           echo "[release] Publishing (semantic-release decides whether a new version is required)"
           npx semantic-release
-          after_version="$(node -e "process.stdout.write(require('./scripts/release/sync-versions').latestReachableVersion())")"
+          after_tag="$(git describe --tags --abbrev=0 --match 'v[0-9]*.[0-9]*.[0-9]*' HEAD)"
           published=false
           tag=""
-          if [[ "$after_version" != "$before_version" ]]; then
+          if [[ "$after_tag" != "$before_tag" ]]; then
             published=true
-            tag="v$after_version"
+            tag="$after_tag"
           fi
           {
             echo "published=$published"

.github/workflows/release.yml

@@ -3558,6 +3558,10 @@ identify shipped versions; `release/manifest.json` owns only release-line policy
 approval. Do not infer a shipped version or stable graduation from package metadata, generated
 current-version prose, or roadmap completion labels.
 
+Tracked npm, Haxelib, Mix, and scoped-HXML versions are development sentinels. Semantic-release
+injects an exact version, tag, and source SHA only into temporary Reflaxe package staging; normal
+publication must leave the tested commit unchanged and must not create a release commit.
+
 ## Test Status Summary
 **See**: [`docs/03-compiler-development/testing-infrastructure.md`](docs/03-compiler-development/testing-infrastructure.md) - Complete test architecture and status
 

AGENTS.md

@@ -39,11 +39,12 @@
 
 * **release:** replace mutable manifest-owned version/generation state with a tag-owned SemVer policy core; delegate Conventional Commit classification to the pinned official analyzer, validate versions with locked `semver`, keep `0.x` breaking changes minor until an independently approved graduation change, and require a durable approval for every stable major.
 * **release:** replace the original single graduation-evidence gate with independent, dated per-major approval records; approval remains non-releasing, and a subsequent new breaking commit is required to derive the authorized stable major.
-* **release:** keep the existing version metadata, scoped HXML, and current-posture generator as a compatibility bridge while release artifacts migrate to deterministic staging; release policy no longer contains its file inventory or mutable current version.
+* **release:** replace tracked version/changelog generation and release commits with development sentinels plus temporary Reflaxe package staging; tags now identify the unchanged tested source commit.
 * **release:** make no-op semantic-release runs skip published-package verification; successful publication passes the exact newly created tag to the verifier instead of inferring a prior release from tracked package metadata.
-* **release:** verify the prepared release commit and package before tag creation, verify the tag and tagged generated state before GitHub publication, and validate the downloaded GitHub Release asset afterward; document fail-closed partial-publication recovery.
+* **release:** build the complete Haxelib package twice with a pinned canonical ZIP writer, require byte-identical output, validate safe layout/modes and staged source identity, smoke the exact ZIP, and publish its SHA-256 sidecar.
 * **docs:** reconcile current-facing release language with the real pre-1.0 lineage; label old `v1.0.x`/`v1.1.x` milestones as unshipped historical plans and point entrypoints to the canonical generated posture.
-* **test:** derive synthetic release versions independently of release policy so generation and staged-verification contracts remain valid after each real publication.
+* **test:** add adversarial release-artifact coverage for metadata mismatch, missing/unexpected/unsafe entries, duplicate names, symlinks, unsafe modes, and environment-independent archive bytes.
+* **generator:** resolve scaffold package URLs from staged release metadata or the source checkout's nearest immutable tag, never from tracked development sentinels.
 * **stdlib:** classify `haxe.io.Mime` and `haxe.io.Scheme` as verified official Haxe fallback modules; add runtime, snapshot, and source-versus-package coverage without duplicating their String enum-abstract definitions in the target stdlib.
 * **compiler:** preserve omitted Haxe method defaults from Reflaxe's typed `ClassFuncData` instead of always passing `nil`, and keep multi-expression constructor blocks grouped when they are assigned as values.
 * **stdlib:** enable all upstream `haxe.io.ArrayBufferView` and typed-array runtime specs through the official Haxe fallback; preserve shared Bytes views while keeping source and built-package output identical.

CHANGELOG.md

@@ -4,7 +4,7 @@
 
 # Reflaxe.Elixir (aka Haxir)
 
-[![Version](https://img.shields.io/badge/version-0.14.25-blue)](https://github.com/fullofcaffeine/reflaxe.elixir/releases)
+[![Release](https://img.shields.io/github/v/release/fullofcaffeine/reflaxe.elixir)](https://github.com/fullofcaffeine/reflaxe.elixir/releases)
 [![License: GPL-3.0](https://img.shields.io/badge/License-GPL%20v3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
 [![CI](https://github.com/fullofcaffeine/reflaxe.elixir/actions/workflows/ci.yml/badge.svg)](https://github.com/fullofcaffeine/reflaxe.elixir/actions/workflows/ci.yml)
 [![Haxe](https://img.shields.io/badge/Haxe-4.3.7+-orange)](https://haxe.org)
@@ -13,12 +13,10 @@
 **[Haxe](https://haxe.org) -> [Elixir](https://elixir-lang.org) compiler for the BEAM ecosystem, with first-class [Phoenix](https://phoenixframework.org)/[LiveView](https://www.phoenixframework.org/liveview) support.**
 Write application code in Haxe and compile to conventional Elixir shapes for pure Elixir/OTP services and Phoenix applications.
 
-<!-- BEGIN GENERATED: release-posture -->
 > [!WARNING]
-> **Stability**: v0.14.25 is on the pre-1.0 (`v0.x`) release line.
+> **Stability**: Reflaxe.Elixir is on the pre-1.0 (`v0.x`) release line.
 > Breaking changes to documented stable surfaces use minor releases until an explicitly reviewed stable graduation.
 > Some features remain experimental/opt-in; see [Known Limitations](docs/06-guides/KNOWN_LIMITATIONS.md) and [Versioning & Stability](docs/06-guides/VERSIONING_AND_STABILITY.md).
-<!-- END GENERATED: release-posture -->
 
 Immutable Git tags identify released versions. The
 [release policy manifest](release/manifest.json) contains only release-line approvals; it is not a
@@ -110,6 +108,9 @@ The release zip is the normal consumer package. Reflaxe builds it from the check
 sources and includes the generated `.cross.hx` files required by a single `-lib reflaxe.elixir`.
 The `www.github.com` host is intentional: it lets Lix treat the file as a generic immutable HTTPS
 archive instead of misclassifying the release URL as a GitHub source-repository dependency.
+Each release also publishes a `.sha256` sidecar, and the ZIP embeds its exact version, tag, and source
+commit. The release job builds the complete package twice and requires byte-identical output before
+it tags that already-tested source commit.
 
 ### Working from a source checkout
 

README.md

@@ -3,12 +3,10 @@
 Reflaxe.Elixir uses **semantic versioning** (`MAJOR.MINOR.PATCH`) and a **stability tier** model to
 make it clear what is safe to depend on and what may change.
 
-<!-- BEGIN GENERATED: release-posture -->
-> Current version: **v0.14.25**<br>
 > Current release line: **pre-1.0 (`v0.x`)**<br>
 > Breaking stable-surface changes produce a **minor** release on this line.<br>
-> Stable graduation: **not approved**.
-<!-- END GENERATED: release-posture -->
+> Stable graduation: **not approved**.<br>
+> Exact released version: the latest immutable `vMAJOR.MINOR.PATCH` GitHub Release tag.
 
 Experimental features remain opt-in and may evolve in minor releases. Breaking changes on the
 current line must still be documented clearly.
@@ -17,8 +15,8 @@ Reachable immutable `vMAJOR.MINOR.PATCH` Git tags are the source of truth for re
 [`release/manifest.json`](../../release/manifest.json) is intentionally version-independent: it
 contains only release-line policy and durable approval records. Semantic-release delegates
 Conventional Commit parsing to its official analyzer, then applies that small policy layer.
-Tracked package versions and current-version prose are compatibility mirrors during the release
-protocol migration; they do not decide the next version.
+Tracked package and HXML versions are development sentinels. They do not decide or mirror the
+current release; exact release metadata is injected only into temporary package staging.
 
 The current policy shape is deliberately small:
 

docs/06-guides/VERSIONING_AND_STABILITY.md

@@ -6,8 +6,8 @@ High level:
 
 - Merge changes to `main` using **Conventional Commits** (`feat:`, `fix:`, etc.)
 - When `CI` completes successfully on `main`, the separate **Release** workflow runs automatically
-- `semantic-release` determines the next version (if any), creates a `vX.Y.Z` tag, publishes a GitHub Release,
-  and updates repo version strings + `CHANGELOG.md`
+- `semantic-release` determines the next version (if any), builds the package from that tested commit,
+  creates a `vX.Y.Z` tag on the same commit, and publishes a GitHub Release
 
 ## What triggers a release?
 
@@ -54,55 +54,59 @@ Use clear, scoped messages (examples):
 
 3) **Let semantic-release do the rest**
 
-Immutable reachable tags are the source of truth for released versions.
-`release/manifest.json` contains only release-line policy and per-major approvals; it does not own a
-current version or generated-file inventory. During the release-protocol migration,
-`scripts/release/sync-versions.js` remains a compatibility bridge that writes the derived tag version
-to these tracked mirrors:
+Immutable reachable tags are the source of truth for released versions. `release/manifest.json`
+contains only release-line policy and per-major approvals. Tracked `package.json`, `haxelib.json`,
+`mix.exs`, and scoped HXML versions are development sentinels, not release mirrors.
 
-- `package.json` / `package-lock.json`
-- `haxelib.json`
-- `mix.exs`
-- `README.md` version badge
-- generated release-posture blocks in `README.md` and `VERSIONING_AND_STABILITY.md`
-- `CHANGELOG.md` (generated)
+The artifact plugin exports the exact tested Git commit to temporary storage, runs that commit's
+vendored Reflaxe builder, and injects the derived version, tag, and source SHA only into package
+staging. It builds the complete package twice under varied environment settings, requires identical
+bytes, validates the ZIP layout and metadata, runs installed-package parity against that exact ZIP,
+and emits `dist/reflaxe.elixir.zip.sha256`. Normal publication leaves tracked files unchanged and
+does not create a release commit. GitHub Release notes are the current release changelog.
 
-Check for drift without modifying files:
-
-```bash
-npm run guard:release-state
-```
-
-The bridge rejects unsafe paths, missing or duplicate generated markers, and stable versions without
-an approval for that exact major. Semantic-release obtains its transitional release-commit asset
-list from the same module through `release.config.js`. The local policy plugin delegates commit
-classification to the official semantic-release analyzer and changes only the explicit pre-1.0
-breaking rule; its verification hook enforces stable-major approval.
+Project scaffolding also respects that split. An installed Haxelib release reads the exact version
+injected into its staged `haxelib.json`; Haxe and Mix scaffolds running from a repository checkout
+resolve the nearest reachable immutable release tag when they encounter a development sentinel.
+They fail clearly when neither identity exists instead of generating a fake `v0.0.0`,
+`v0.0.0-development`, or `vlatest` download URL.
 
 ## Staged release verification
 
 Release verification runs at three boundaries:
 
-1. After the official git plugin creates and pushes the release commit, but before semantic-release
-   creates a tag, the prepared-state verifier checks committed generated assets, changelog version,
-   clean tracked state, and package contents. Failure here prevents tag creation.
-2. After semantic-release creates the tag, but before the GitHub plugin publishes, the tag verifier
-   checks that the tag targets the prepared commit and that tagged metadata/docs and package contents
-   agree.
+1. Before tag creation, the artifact plugin proves two complete builds are byte-identical, validates
+   canonical entries/modes/metadata, smokes the exact ZIP, records byte count and SHA-256, and checks
+   that the tracked tree stayed clean. Failure here prevents tag creation.
+2. After semantic-release creates the tag, but before GitHub upload, the plugin re-validates the
+   approved ZIP and checksum and confirms that tracked source was not modified.
 3. After semantic-release returns, the workflow downloads the GitHub Release asset and verifies the
-   published release state, exact asset name, non-empty upload, tagged generated state, and package
-   contents. This step receives the exact tag created by that run. If commit analysis produces no new
-   version, the workflow records a no-op and does not re-audit an older release as though it had just
-   been published.
+   exact asset, checksum, staged package metadata, and source SHA. This step receives the exact tag
+   created by that run. A no-op does not re-audit an older release as newly published.
 
 ### Partial-publication recovery
 
 - **Failure before tag creation:** fix the cause and rerun the Release workflow. Do not create a tag
   manually; no public release identity exists yet.
 - **Tag exists but the GitHub Release or asset is missing:** do not move or recreate the tag. Check
-  out that exact tag in a temporary clone, run `scripts/release/package-haxelib.sh`, verify the zip,
-  then create the missing GitHub Release or upload the exact `reflaxe.elixir-X.Y.Z.zip` asset with
-  `gh release create` / `gh release upload --clobber` as appropriate.
+  out that exact tag in a temporary clone, then rebuild with the release identity explicitly:
+
+  ```bash
+  tag=vX.Y.Z
+  version=${tag#v}
+  source_sha=$(git rev-parse "${tag}^{commit}")
+  scripts/release/package-haxelib.sh dist/reflaxe.elixir.zip "$version" "$tag" "$source_sha"
+  archive="reflaxe.elixir-${version}.zip"
+  mv dist/reflaxe.elixir.zip "dist/${archive}"
+  node scripts/release/verify-release-artifact.js \
+    --zip "dist/${archive}" --version "$version" --tag "$tag" --source-sha "$source_sha"
+  hash=$(node -e 'const c=require("crypto"),f=require("fs");process.stdout.write(c.createHash("sha256").update(f.readFileSync(process.argv[1])).digest("hex"))' "dist/${archive}")
+  printf '%s  %s\n' "$hash" "$archive" > "dist/${archive}.sha256"
+  ```
+
+  Compare the rebuilt SHA-256 with the release job record before creating the missing GitHub Release
+  or uploading the exact `reflaxe.elixir-X.Y.Z.zip` and checksum assets. Never rebuild with the
+  script defaults for recovery: those intentionally produce development metadata.
 - **Published metadata is wrong:** treat the release as immutable until the discrepancy is understood.
   Prefer correcting GitHub Release notes/assets against the existing tag. Delete or move a public tag
   only as an explicitly reviewed release revocation.
@@ -113,10 +117,9 @@ Finish every recovery with:
 scripts/release/verify-published-package.sh vX.Y.Z
 ```
 
-Tags created before release policy schema v2, including tags with the earlier generated-state
-manifest, can be audited with `ALLOW_LEGACY_RELEASE=1`; this bypasses only tagged policy/generated-
-state comparison and is never set by the Release workflow. Package structure and hosted-asset checks
-still run.
+Tags created before package provenance/checksum metadata can be audited with
+`ALLOW_LEGACY_RELEASE=1`; this keeps legacy package-structure checks explicit and is never set by the
+Release workflow.
 
 ## Token / permissions notes
 

docs/10-contributing/RELEASING.md

@@ -518,7 +518,8 @@ CMD ["_build/prod/rel/todo_app/bin/todo_app", "start"]
 
 ## 🤝 Contributing
 
-This example is part of Reflaxe.Elixir v1.1.x. Contributions welcome!
+This example tracks the current pre-1.0 Reflaxe.Elixir source tree and is part of the repository's
+compiler, Phoenix runtime, and browser QA.
 
 1. Fork the repository
 2. Create your feature branch
@@ -531,7 +532,7 @@ GPL-3.0 - See LICENSE file in project root
 
 ---
 
-**Built with Reflaxe.Elixir v1.1.x** - Write once in Haxe, run everywhere! 🚀
+**Built with Reflaxe.Elixir** - Haxe authoring with Phoenix and LiveView on the BEAM.
 
 ## Template Mode
 

examples/todo-app/README.md

@@ -34,7 +34,7 @@
 -lib reflaxe
 
 # Define the library version
--D reflaxe.elixir=0.14.25
+-D reflaxe.elixir=0.0.0-development
 # Match Reflaxe-generated target entrypoints: type the compiler package with
 # Haxe null-safety metadata before bootstrap/init macros run.
 --macro nullSafety("reflaxe.elixir")

haxe_libraries/reflaxe.elixir.hxml

@@ -10,9 +10,9 @@
     "macro"
   ],
   "description": "A Haxe compilation target for Elixir/BEAM enabling gradual typing in Phoenix applications with compile-time type-safe Ecto queries and HXX→HEEx template transformation.",
-  "version": "0.14.25",
+  "version": "0.0.0",
   "classPath": "src",
-  "releasenote": "v0.14.25: See CHANGELOG.md",
+  "releasenote": "Development checkout; release metadata is injected during package staging",
   "contributors": [
     "fullofcaffeine"
   ],