chore: prepare coordinated TemPad Dev 1.0.0 release

.github/workflows/build.yml

@@ -2,7 +2,7 @@ name: build
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'ci/**']
   pull_request:
     branches: [main]
 
@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
@@ -31,13 +33,20 @@ jobs:
           cache: 'pnpm'
           cache-dependency-path: pnpm-lock.yaml
 
+      - name: Check agent plugin version
+        if: matrix.node == '24.x'
+        env:
+          PLUGIN_VERSION_BASE: ${{ github.event_name == 'pull_request' && 'HEAD^1' || startsWith(github.ref, 'refs/heads/ci/') && 'origin/main' || github.event.before }}
+        run: node scripts/check-agent-plugin-version.mjs
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Install browser runtime
         run: pnpm --filter @tempad-dev/extension test:setup
 
       - name: Check agent plugins
+        if: matrix.node == '24.x'
         run: >-
           pnpm agent-plugin:build &&
           test -z "$(git status --porcelain --untracked-files=all --
@@ -77,7 +86,39 @@ jobs:
         run: pnpm format:check
 
       - name: Check bridge compatibility
-        run: pnpm mcp:check-bridge
+        run: node packages/mcp-server/scripts/check-bridge-compatibility.mjs
+
+      - name: Check runtime profile isolation
+        run: node packages/mcp-server/scripts/check-runtime-profiles.mjs
+
+      - name: Check CLI host context isolation
+        run: node packages/mcp-server/scripts/check-host-context.mjs
+
+      - name: Check isolated runtime supervisor
+        run: pnpm mcp:check-runtime-prototype
+
+      - name: Check local runtime switching and recovery
+        run: pnpm mcp:check-runtime-switch
+
+      - name: Prepare dependency metadata for offline release packaging
+        run: pnpm mcp:prepare-release-dependencies
+
+      - name: Check verified release downloads and explicit activation
+        env:
+          npm_config_logs_dir: ${{ runner.temp }}/tempad-npm-logs
+        run: pnpm mcp:check-runtime-updates
+
+      - name: Preserve failure evidence
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: validation-failures-node-${{ matrix.node }}
+          path: |
+            packages/*/.vitest/attachments/**
+            ${{ runner.temp }}/tempad-npm-logs
+          include-hidden-files: true
+          if-no-files-found: ignore
+          retention-days: 14
 
   typescript-compatibility:
     runs-on: ubuntu-latest

.github/workflows/publish-mcp.yml

@@ -15,16 +15,11 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 jobs:
-  publish:
-    name: Publish @tempad-dev/mcp
+  guard:
+    name: Validate release branch
     runs-on: ubuntu-latest
-    concurrency:
-      group: publish-mcp
-      cancel-in-progress: true
-
     steps:
       - name: Require main branch
         env:
@@ -35,6 +30,22 @@ jobs:
             exit 1
           fi
 
+  windows-runtime:
+    name: Validate Windows runtime
+    needs: guard
+    uses: ./.github/workflows/windows-runtime.yml
+
+  publish:
+    name: Publish @tempad-dev/mcp
+    needs: [guard, windows-runtime]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    concurrency:
+      group: publish-mcp
+      cancel-in-progress: false
+    steps:
       - name: Checkout repository
         uses: actions/checkout@v7
 
@@ -55,27 +66,52 @@ jobs:
       - name: Build package
         run: pnpm build:mcp
 
+      - name: Prepare dependency metadata for offline release packaging
+        run: pnpm mcp:prepare-release-dependencies
+
       - name: Validate package
         run: |
           pnpm --filter @tempad-dev/mcp... typecheck
           pnpm --filter @tempad-dev/mcp... test:run
           pnpm mcp:check-bridge
           pnpm --filter @tempad-dev/mcp check:logging
+          pnpm mcp:check-runtime-updates
+          pnpm mcp:check-runtime-switch
+
+      - name: Prepare and verify the immutable release
+        run: pnpm mcp:prepare-release --output "$RUNNER_TEMP/tempad-mcp.tgz" --verify-baseline
+
+      - name: Check the exact release archive
+        run: |
+          release_check_dir=$(mktemp -d "$RUNNER_TEMP/tempad-mcp-installed.XXXXXX")
+          trap 'rm -rf "$release_check_dir"' EXIT
+          tar -xzf "$RUNNER_TEMP/tempad-mcp.tgz" -C "$release_check_dir" --strip-components=1
+          node packages/mcp-server/scripts/check-bridge-compatibility.mjs "$release_check_dir"
+          node packages/mcp-server/scripts/check-log-transport.mjs "$release_check_dir"
+
+      - name: Archive the reviewed release and manifest
+        uses: actions/upload-artifact@v7
+        with:
+          name: tempad-mcp-release
+          path: |
+            ${{ runner.temp }}/tempad-mcp.tgz
+            ${{ runner.temp }}/tempad-mcp.tgz.json
 
       - name: Publish
-        working-directory: packages/mcp-server
-        run: npm publish --access public --tag "${{ inputs.tag }}"
+        run: npm publish "$RUNNER_TEMP/tempad-mcp.tgz" --ignore-scripts --access public --tag "${{ inputs.tag }}"
 
       - name: Verify published version
         working-directory: packages/mcp-server
         env:
           NPM_DIST_TAG: ${{ inputs.tag }}
         run: |
           version=$(node -p "require('./package.json').version")
+          expected=$(node -p "require(process.env.RUNNER_TEMP + '/tempad-mcp.tgz.json').integrity")
           for attempt in {1..20}; do
             published=$(npm view "@tempad-dev/mcp@$version" version --prefer-online 2>/dev/null || true)
             tagged=$(npm view "@tempad-dev/mcp@$NPM_DIST_TAG" version --prefer-online 2>/dev/null || true)
-            if [[ "$published" == "$version" && "$tagged" == "$version" ]]; then
+            integrity=$(npm view "@tempad-dev/mcp@$version" dist.integrity --prefer-online 2>/dev/null || true)
+            if [[ "$published" == "$version" && "$tagged" == "$version" && "$integrity" == "$expected" ]]; then
               echo "Verified @tempad-dev/mcp@$version on $NPM_DIST_TAG"
               exit 0
             fi

.github/workflows/publish-plugins.yml

@@ -5,16 +5,11 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 jobs:
-  publish:
-    name: Publish @tempad-dev/plugins
+  guard:
+    name: Validate release branch
     runs-on: ubuntu-latest
-    concurrency:
-      group: publish-plugins
-      cancel-in-progress: true
-
     steps:
       - name: Require main branch
         env:
@@ -25,6 +20,17 @@ jobs:
             exit 1
           fi
 
+  publish:
+    name: Publish @tempad-dev/plugins
+    needs: guard
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    concurrency:
+      group: publish-plugins
+      cancel-in-progress: false
+    steps:
       - name: Checkout repository
         uses: actions/checkout@v7
 

.github/workflows/windows-runtime.yml

@@ -0,0 +1,127 @@
+name: Windows runtime
+
+on:
+  push:
+    branches: [main, 'ci/**']
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  runtime:
+    runs-on: windows-latest
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        node: ['22.x', '24.x']
+        suite: [contracts, prototype, switch, updates]
+    env:
+      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
+      TEMPAD_RUNTIME_EVIDENCE_DIR: ${{ github.workspace }}/runtime-ci-logs/fixtures
+    steps:
+      - name: Preserve reviewed source bytes
+        run: git config --global core.autocrlf false
+
+      - name: Share dependency metadata across install and offline packaging
+        run: '"pnpm_config_cache_dir=$env:RUNNER_TEMP/tempad-pnpm-cache" >> $env:GITHUB_ENV'
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Prepare dependency metadata for offline release packaging
+        if: matrix.suite == 'updates'
+        run: pnpm mcp:prepare-release-dependencies
+
+      - name: Record runtime environment
+        env:
+          EXPECTED_NODE: ${{ matrix.node }}
+        run: |
+          New-Item -ItemType Directory runtime-ci-logs | Out-Null
+          node -p 'JSON.stringify({platform:process.platform,arch:process.arch,node:process.version,execPath:process.execPath})' | Tee-Object runtime-ci-logs/environment.log
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          pnpm --version | Tee-Object -Append runtime-ci-logs/environment.log
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          $runtimePlatform = pnpm exec node -p process.platform
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          $runtimeVersion = pnpm exec node -p process.versions.node
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          "pnpm runtime: $runtimePlatform $runtimeVersion" | Tee-Object -Append runtime-ci-logs/environment.log
+          if ($runtimePlatform -ne 'win32' -or $runtimeVersion.Split('.')[0] -ne $env:EXPECTED_NODE.Split('.')[0]) {
+            throw 'Unexpected test runtime'
+          }
+          $metadataCache = pnpm config get cache-dir
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          "pnpm metadata cache: $metadataCache" | Tee-Object -Append runtime-ci-logs/environment.log
+          $metadataFiles = @(Get-ChildItem -LiteralPath $metadataCache -Recurse -File -Filter '*.jsonl' | Where-Object { $_.DirectoryName -match '[\\/]metadata-full[\\/]' })
+          "Full metadata files: $($metadataFiles.Count)" | Tee-Object -Append runtime-ci-logs/environment.log
+          $metadataFiles | Where-Object { $_.Name -in @('body-parser.jsonl', 'es-object-atoms.jsonl') } | ForEach-Object { $_.FullName } | Tee-Object -Append runtime-ci-logs/environment.log
+
+      - name: Build runtime packages
+        run: |
+          pnpm --filter @tempad-dev/shared build
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          pnpm build:mcp
+
+      - name: Test runtime contracts and platform boundaries
+        if: matrix.suite == 'contracts'
+        shell: cmd
+        run: |
+          call pnpm --filter @tempad-dev/mcp exec vitest run --config vitest.config.ts tests/runtime- tests/stable-edge.test.ts --maxWorkers=2 --testTimeout=30000 --hookTimeout=30000 > runtime-ci-logs\unit.log 2>&1
+          set "test_exit=%errorlevel%"
+          type runtime-ci-logs\unit.log
+          exit /b %test_exit%
+
+      - name: Check supervisor recovery and concurrent edges
+        if: matrix.suite == 'prototype'
+        shell: cmd
+        run: |
+          call pnpm mcp:check-runtime-prototype > runtime-ci-logs\prototype.log 2>&1
+          set "test_exit=%errorlevel%"
+          type runtime-ci-logs\prototype.log
+          exit /b %test_exit%
+
+      - name: Check switching, in-flight requests, crashes and rollback
+        if: matrix.suite == 'switch'
+        shell: cmd
+        run: |
+          call pnpm mcp:check-runtime-switch > runtime-ci-logs\switch.log 2>&1
+          set "test_exit=%errorlevel%"
+          type runtime-ci-logs\switch.log
+          exit /b %test_exit%
+
+      - name: Check verified downloads and automatic activation
+        if: matrix.suite == 'updates'
+        shell: cmd
+        run: |
+          call pnpm mcp:check-runtime-updates > runtime-ci-logs\updates.log 2>&1
+          set "test_exit=%errorlevel%"
+          type runtime-ci-logs\updates.log
+          exit /b %test_exit%
+
+      - name: Preserve runtime evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows-runtime-node-${{ matrix.node }}-${{ matrix.suite }}
+          path: runtime-ci-logs
+          retention-days: 14
+          if-no-files-found: warn

AGENTS.md

@@ -99,6 +99,10 @@ default authority unless a routed document says otherwise.
   generated output, and include it in the change. `agent-plugin/targets/` is marked as
   generated for review; read `agent-plugin/src/` instead. Ordinary `pnpm build` must
   not modify agent-plugin artifacts.
+- Installed payload changes (including skills, hooks, manifests, and assets) require a stable
+  version increase in `agent-plugin/src/plugin.json` and regenerated targets. Package-root
+  README and changelog edits alone are exempt. Before pushing, check committed changes with
+  `pnpm agent-plugin:check-version origin/main` against the intended release baseline.
 - Keep Codex and Claude development support equivalent. Both manifests must
   launch the same working-tree MCP runtime.
 - Release MCP configuration must use `@tempad-dev/mcp@latest`, never an alpha
@@ -148,6 +152,7 @@ check is sufficient.
 | ------------------------------------------------------- | --------------------------------------------------------------- |
 | Test selection, required checks, or troubleshooting     | `TESTING.md`                                                    |
 | Test runtime or coverage architecture                   | `docs/testing/architecture.md`                                  |
+| Release preparation or compatibility retirement         | `docs/releasing.md`                                             |
 | Codex desktop IPC discovery, lifecycle, or feedback     | `docs/engineering/codex-desktop-ipc.md`                         |
 | End-to-end authoring evolution or live agent evaluation | `docs/testing/agent-authoring-evolution.md`                     |
 | Extension implementation or MCP behavior                | `packages/extension/AGENTS.md`, then its routed design document |