release: prepare public HRA CLI supply chain

[0thernet]

Summary

• publish the HRA CLI as the scoped MIT package @hraness/hra
• make immutable annotated tag objects and peeled commits the release authority
• admit only exact same-run or proven retry publication transitions
• bind GitHub and npm artifacts to exact bytes, tag object, commit, run ID, and attempt
• verify npm provenance cryptographically with bounded provider responses
• harden package acceptance while preserving isolated real local/global installs

Release contract

Tag creation may precede or follow merge, but publication requires the peeled tag commit to be an ancestor of current protected main. A later attempt may complete only the same annotated tag object, peeled commit, and tarball; npm provenance remains bound to the actual publishing run ID and attempt. GitHub release identity and uploaded assets are recovered and verified by exact numeric ID.

Validation

Exact reviewed commit: 6c29bca
Exact reviewed tree: 5ed17e449fe40cedd36ccdaa6184692e3455bf78

• bun run check
• 2,149 tests, 112,397 assertions
• lint, typecheck, site check/build, and CLI build
• package policy 10/10
• exact production tarball with real dependencies, isolated local/global consumers, PTY, and daemon lifecycle
• focused cache-custody suite 25/25, 131 assertions
• independent release-contract and final-delta reviews: clean

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hra	Ready	Preview	Aug 31, 2026 1:59am