Stable release handoff

Read first

• Release process
• Compatibility matrix
• Stability policy
• Security policy
• Repository rules

Ownership

release/manifest.json is the source of truth for the fixed public package graph and renderer set. Package manifests own exact peer ranges and exports. The conformance manifest owns component/event/platform evidence. Changesets own future version intent; accepted ADRs/RFCs own contract change decisions.

Do not publish from a developer machine. A stable tag contained in main starts the protected npm environment workflow. The stable workflow is OIDC-only. The protected npm environment must not contain NPM_TOKEN or NODE_AUTH_TOKEN; both public packages trust the GitHub Actions publisher for .github/workflows/release.yml and environment npm.

Checks

pnpm lint
pnpm test:conformance
pnpm test
pnpm build
pnpm conformance:gate
pnpm docs:bridge:gate
pnpm test:e2e
pnpm test:pty
pnpm release:gate
pnpm release:pack

Do not close a release issue until npm provenance, clean npm installation, GitHub checksums, host smoke tests, and human launch review are linked publicly.