release: bind website promotion to provider success

[0thernet]

Summary

• makes Release wait inside an exact 20-minute monotonic observation window for one verified Vercel Production outcome instead of treating a branch fast-forward as provider success
• splits the short contents: write publication boundary from the terminal read-only observer and binds recovery source, immutable npm/tag/Release state, bounded deployment inventory, exact candidate history, and REST/GraphQL provider identity fail closed
• rejects every retained failure/error/inactive status for the exact candidate, binds REST ref == sha == verified SHA, and anchors observations at absolute minute slots 0 through 19 without schedule drift
• raises the bounded Linux full-check timeout from 45 to 75 minutes after an unchanged source suite showed 31% runner variance; macOS remains 75, Required remains 5 and depends on both platform jobs
• keeps package version 0.16.2, npm staging, version tags, and live production controls unchanged

Exact scope

• parent: 3a8221dcd2b96b8b869be7207b57fa9f55b7e38e
• head: e906a9314808cb627801725b857c4456fc7e9ab1
• tree: 23886d8e7e551f6f641e9cb2ae2d715044690bc3
• seven files: CI and Release workflows, root and website agent guides, publishing runbook, workflow contract tests, and the new bounded provider-outcome helper
• cumulative diff: 5,205 insertions and 470 deletions; working tree, dist, and bun.lock remained clean

Verification

• focused release workflow contract: 25 passed, 0 failed, 2,493 assertions
• complete exact-tree bun run check: 3,338 main tests passed, 1 intentional skip, 0 failed, 136,243 assertions
• website/edge: 56 passed, 4,354 assertions; omni: 18 passed, 606 assertions
• package identity, clean npm consumer, build, generated-file check, standalone smoke, Node syntax, TypeScript, YAML, Bash, and diff checks passed
• independent exact-object and schedule reviews found no correctness, security, fail-open, bounds, timing, or unintended release-state blocker
• superseded/cancelled runs at 57ad34b and 50c496d are diagnostic only; replacement CI is bound to the exact head above

Deferred live control

This change does not claim website-production protection is already live. The separately authorized no-delete/no-force ruleset and fresh API readback remain mandatory before the downstream release handoff. The npm-stage workflow remains disabled, and this PR does not stage, tag, release, or deploy v0.16.3.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
wrench	Ready	Preview	Aug 29, 2026 11:57pm