fix(release-kit): repair confirmed quality findings in the payload

.claude-plugin/marketplace.json

@@ -61,6 +61,36 @@
       "source": "./skills/socket-scan/socket-scan-setup",
       "skills": "./",
       "description": "Set up prerequisites for Socket scanning — install the CLI, configure auth with the public demo token, and verify scan access."
+    },
+    {
+      "name": "socket-release",
+      "source": "./skills/socket-release",
+      "skills": "./",
+      "description": "Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo: copy in the release kit and run its bootstrap — name reservation, GitHub environments, npm trusted publisher, staged publish config, verification."
+    },
+    {
+      "name": "npm-publish",
+      "source": "./skills/socket-release/npm-publish",
+      "skills": "./",
+      "description": "Operate the socket-release npm flow end to end — bootstrap (permissive-then-staged-only publishing access), staged publish dispatch, soak, --approve promote, backfill, and rollback/deprecate."
+    },
+    {
+      "name": "gh-release",
+      "source": "./skills/socket-release/gh-release",
+      "skills": "./",
+      "description": "Cut, verify, and reconcile immutable GitHub releases — the registry-resolvability ORDER RULE, the draft-upload-undraft cut, checksums.txt, and tag-gap healing."
+    },
+    {
+      "name": "crates-publish",
+      "source": "./skills/socket-release/crates-publish",
+      "skills": "./",
+      "description": "Operate the socket-release crates.io flow — the cargo staged model, trusted publishing (OIDC), index-propagation waits, and yank-as-rollback."
+    },
+    {
+      "name": "brew-tap",
+      "source": "./skills/socket-release/brew-tap",
+      "skills": "./",
+      "description": "Operate the socket-release Homebrew tap flow — tap repo layout, formula bumps tied to published releases, and sha256 verification against the release's own checksums.txt."
     }
   ]
 }

.config/repo/coverage.json

@@ -0,0 +1,10 @@
+{
+  "include": ["release-kit/**/*.mts", "release-kit/**/*.mjs"],
+  "exclude": {
+    "add": [
+      "release-kit/examples/**",
+      "release-kit/**/*.d.mts",
+      "release-kit/payload/scripts/socket-release/templates/**"
+    ]
+  }
+}

.config/repo/socket-wheelhouse.json

@@ -11,7 +11,7 @@
   },
   "fuzz": {
     "exempt": true,
-    "reason": "Skills content repo: the published artifact is markdown skills plus generated manifests. The only parsers (scripts/repo/lib/frontmatter.mts, scripts/repo/lib/validate-marketplace.mts) consume repo-tracked SKILL.md/marketplace.json files, never untrusted input — no fuzzable boundary."
+    "reason": "The release-kit payload's pure parsers (brew formula rewrite, npm access/trusted-publisher/staged page parsers, the pnpm-workspace catalog editor, and the installer manifest/path-safety + byte-parity checker) ARE covered by Tier-1 fast-check property suites under test/repo/unit/release-kit/fuzz/*.fuzz.test.mts. The Tier-2 vitiate coverage-guided lane (*.fuzz.ts) is not adopted: vitiate is not a catalog dependency here, and the skills content tooling itself parses only repo-tracked SKILL.md/marketplace.json, never untrusted input."
   },
   "hooks": {
     "enablePrePush": true,

.config/repo/tsconfig.release-kit.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../fleet/tsconfig.check.base.json",
+  "compilerOptions": {
+    "rootDir": "../.."
+  },
+  "include": ["../../release-kit/**/*.mts"],
+  "exclude": ["**/node_modules"]
+}

README.md

@@ -142,10 +142,15 @@ This repository contains security-focused skills for dependency management. You
 
 Install, authenticate, and configure Socket for your project.
 
-| Name                | Description                                                                                                                                                                                     | Documentation                                             |
-| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
-| `socket-scan-setup` | Set up prerequisites for Socket scanning — install the CLI, configure auth with the public demo token, and verify scan access.                                                                  | [SKILL.md](skills/socket-scan/socket-scan-setup/SKILL.md) |
-| `socket-setup`      | Set up Socket — prompt for API key, install the CLI, authenticate, configure policies and tokens, set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems. | [SKILL.md](skills/socket-setup/SKILL.md)                  |
+| Name                | Description                                                                                                                                                                                                                                 | Documentation                                             |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
+| `brew-tap`          | Operate the socket-release Homebrew tap flow — tap repo layout, formula bumps tied to published releases, and sha256 verification against the release's own checksums.txt.                                                                  | [SKILL.md](skills/socket-release/brew-tap/SKILL.md)       |
+| `crates-publish`    | Operate the socket-release crates.io flow — the cargo staged model, trusted publishing (OIDC), index-propagation waits, and yank-as-rollback.                                                                                               | [SKILL.md](skills/socket-release/crates-publish/SKILL.md) |
+| `gh-release`        | Cut, verify, and reconcile immutable GitHub releases — the registry-resolvability ORDER RULE, the draft-upload-undraft cut, checksums.txt, and tag-gap healing.                                                                             | [SKILL.md](skills/socket-release/gh-release/SKILL.md)     |
+| `npm-publish`       | Operate the socket-release npm flow end to end — bootstrap (permissive-then-staged-only publishing access), staged publish dispatch, soak, --approve promote, backfill, and rollback/deprecate.                                             | [SKILL.md](skills/socket-release/npm-publish/SKILL.md)    |
+| `socket-release`    | Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo: copy in the release kit and run its bootstrap — name reservation, GitHub environments, npm trusted publisher, staged publish config, verification. | [SKILL.md](skills/socket-release/SKILL.md)                |
+| `socket-scan-setup` | Set up prerequisites for Socket scanning — install the CLI, configure auth with the public demo token, and verify scan access.                                                                                                              | [SKILL.md](skills/socket-scan/socket-scan-setup/SKILL.md) |
+| `socket-setup`      | Set up Socket — prompt for API key, install the CLI, authenticate, configure policies and tokens, set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems.                                             | [SKILL.md](skills/socket-setup/SKILL.md)                  |
 
 #### Analysis
 

agents/README.md

@@ -6,12 +6,17 @@ You have additional SKILLs documented in directories containing a "SKILL.md" fil
 
 | Skill              | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| brew-tap           | Operate the socket-release Homebrew tap flow — the binary-download formula model, tap repo layout, formula bumps tied to published releases, and sha256 verification against the release's own checksums.txt. Use when bumping a Homebrew formula or standing up a tap for a Socket CLI.                                                                                                                                                                   |
+| crates-publish     | Operate the socket-release crates.io flow — the cargo staged model (dry-run default), trusted publishing via OIDC under the cargo-publish environment, index-propagation waits, and yank-as-rollback. Use when publishing a Rust crate in a repo carrying scripts/socket-release/.                                                                                                                                                                         |
+| gh-release         | Cut, verify, and reconcile immutable GitHub releases with the socket-release kit — the registry-resolvability ORDER RULE, the three-step draft-upload-undraft cut, checksums.txt production, and tag-gap healing. Use when tagging a release, healing a missing tag/release, or when the github-release workflow gate refuses a tag.                                                                                                                       |
+| npm-publish        | Operate the socket-release npm flow end to end — bootstrap a package (name reservation, permissive-then-staged-only publishing access, trusted publishing), dispatch a staged publish, soak, promote with --approve, backfill an old version, and roll back with deprecate. Use when publishing an npm package in a repo carrying scripts/socket-release/.                                                                                                 |
 | socket-dep-cleanup | Evaluate and remove a single unused dependency from your project. Searches the entire codebase for all usages (imports, requires, config refs, scripts, type packages, indirect usage), reports findings, and performs full removal with verification.                                                                                                                                                                                                     |
 | socket-dep-patch   | Apply Socket's binary-level security patches without changing dependency versions. Uses socket-patch apply to fix vulnerabilities in-place, then verifies automated patching is configured so patches persist across installs.                                                                                                                                                                                                                             |
 | socket-dep-replace | Replace a dependency with an alternative package, eliminate it via code rewrite, or use socket-optimize for optimized replacements.                                                                                                                                                                                                                                                                                                                        |
 | socket-dep-upgrade | Use socket fix to find and update vulnerable dependencies, then fix any breaking changes in the codebase. Security-audited upgrades with automated code migration.                                                                                                                                                                                                                                                                                         |
 | socket-fix         | Fix dependency security issues — either scan and fix everything (requires /socket-scan), or target a single named package. Orchestrates /socket-dep-cleanup, /socket-dep-replace, /socket-dep-patch, and /socket-dep-upgrade as subskills.                                                                                                                                                                                                                 |
 | socket-inspect     | Research a package before you depend on it — pull every signal from Socket (scores, alerts, malware verdicts, CVEs, supply-chain risk), check the socket.dev package page, evaluate alternatives, and surface available Socket patches.                                                                                                                                                                                                                    |
+| socket-release     | Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo — copy in the socket-release kit from a sauce checkout and run its bootstrap through name reservation, GitHub environments, npm trusted publisher, publishing-access tightening, staged publish config, and verification.                                                                                                                                          |
 | socket-scan        | Run a dependency scan using the Socket CLI. Prompts unauthenticated users to log in or create a free account. If the user skips login, falls back to cdxgen with greatly reduced alert accuracy and poor SBOM accuracy. Authenticated users get temporary read-only scans by default (--tmp). Creates a persistent dashboard scan only when explicitly requested. Includes reachability analysis for enterprise customers and license compliance auditing. |
 | socket-scan-setup  | Set up prerequisites for Socket scanning — install the CLI, configure auth with the public demo token, and verify scan access. Use this before the first scan or when encountering auth errors.                                                                                                                                                                                                                                                            |
 | socket-setup       | Set up Socket — prompt for API key, install the CLI, authenticate, configure policies and tokens, set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems.                                                                                                                                                                                                                                                            |
@@ -28,6 +33,14 @@ Paths referenced within SKILL folders are relative to that SKILL. For example th
 
 The skills are located in:
 
+- `skills/socket-release/brew-tap/SKILL.md`
+
+- `skills/socket-release/crates-publish/SKILL.md`
+
+- `skills/socket-release/gh-release/SKILL.md`
+
+- `skills/socket-release/npm-publish/SKILL.md`
+
 - `skills/socket-fix/socket-dep-cleanup/SKILL.md`
 
 - `skills/socket-fix/socket-dep-patch/SKILL.md`
@@ -40,6 +53,8 @@ The skills are located in:
 
 - `skills/socket-inspect/SKILL.md`
 
+- `skills/socket-release/SKILL.md`
+
 - `skills/socket-scan/SKILL.md`
 
 - `skills/socket-scan/socket-scan-setup/SKILL.md`