Produces the exact public package tarballs of a platform release, validates
them, and proves a standalone module consumes those artifacts end to end.
Nothing is published and no credential is configured.
- scripts/package-release.ts (pnpm packages:release) is the canonical
release builder: from a clean commit it rebuilds the nine public
packages from clean output, packs each, inspects every tarball, checks
the release set and coordinated versions, and only then writes
ekklesia-packages-<version>/ with the tarballs, SHA256SUMS, and a
provider-neutral manifest (ekklesia-package-train.json: version,
revision, and each package's file, size, SHA-256, npm integrity).
- Packing uses a pack-only pnpm beforePacking hook (passed with
--config.pnpmfile, never the workspace's install settings). pnpm inserts
rewritten workspace: dependencies in async completion order, so two
checkouts of one commit packed module-pack's package.json with keys in a
different order; the hook restores the source key order (and the
inspection enforces it). It also drops devDependencies, which named
private packages outside the train.
- scripts/test-package-release.sh (pnpm test:package-release, the CI
package-release gate) builds the train twice, the second time from a
separate worktree, requires byte-identical release directories, then
runs the standalone consumer proof on the release: manifest checked,
offline install from the tarballs only, lockfile integrity equal to the
manifest's, frozen-lockfile reinstall, no Drizzle, one React, contracts
only transitive, every @ekklesia package and module-pack at the release
version, skipLibCheck: false, UI build, pack, and Core verification.
- docs/development/releases.md documents the release order, the train,
the artifacts, and the reproducibility findings; registry publication
remains unimplemented.
- ADR 0053 is Accepted: everything it decides that does not need a
registry is now proven, and registry provisioning is on its own
Deferred list.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
