Cull Release Publish

Cull Release Publish

Authority

An explicit “Release Cull patch|minor|major” or direct “Publish prepared Cull

release X.Y.Z” request authorizes publication. Do not ask for another confirmation

after gates pass. That authority does not waive or bypass any gate.

Implicit invocation is disabled. Without that explicit authority, stop before any

tag, push, workflow dispatch, release, or tap mutation.

Publish

• Resolve the Cull checkout and parse one JSON envelope from

npm run release:cull -- state show --version "$VERSION" --json.

• Require state prepared, exact metadata, a clean release commit already pushed

on main, green required checks, active branch/tag protection, publication

enablement, and no conflicting tag.

• Create one annotated tag for the prepared commit and push that tag normally.

Never move, replace, or force-push a tag.

• Watch the tag-bound GitHub release workflow. Never substitute a local build.
• Require the secret-free verifier's exact artifact inventory, signatures,

notarization, checksums, and provenance before automatic publication.

• Wait for checksum-pinned Homebrew promotion and its audit/install/launch proof.
• Record evidence transitions through published and homebrew-promoted using

the repository CLI's state commands.

On failure, use cull-release-recover. Never delete or rewrite a tag, delete a

release, replace published assets, bypass verification, or force workflow state.