ARCADIA-Studio/harness/experiments/navigation-prerelease-publication-20260912/payload/publication

Navigation publication adapters — unexecuted preparation

Prepared by Codex-9e8r6t /root/linux_readiness; root is the sole executor. This directory contains no publication, upload or tag result. The existing RELEASE-NOTES.draft.md was read and preserved unchanged. Its pending marker is deliberately unsuitable for publication. These helpers are a fresh adaptation of the previously executed contextual publish.py and push-tag.py; no contextual release ID, attempt receipt, note hash or validation hash is reused.

Fixed identity and final binding

• Reserved tag: v0.2.0-preview.navigation.20260911.
• Published raw-source target: 802855f7e6f2f00a107a12196b458b267f586b8d, branch codex/navigation-repair-prerelease-source-20260911.
• Package: .local/nav-repair-retry-20260911/packages/ArcadiaStudio-0.2.0-preview.navigation.20260911-x86_64-pc-windows-gnullvm.zip, exactly 32,971,712 bytes, SHA256 d7228c542f162663933ea002739a78c722bcca41e437df63b7c868ea2af201f1.
• Its .zip.sha256 file: SHA256 435b6fff3fbc1640b4db31c5d848dbcde101aa54cc86fe0eef9c8da6a501ccac; its text must bind the exact ZIP filename/hash.
• Root must finish and review RELEASE-NOTES.md and VALIDATION.md from actual native/independent acceptance. Then set their lowercase SHA256 values in bindings.json. Both hashes are currently null; all mutating actions refuse before reading credentials or making network requests. No automatic binding or acceptance inference is provided. Existing draft pending markers are rejected.

releaseId is initially null. A successful create writes an exclusive release-created.json immediately, identifying ownership. After an uncertain create without that receipt, root must inspect the remote release and deliberately bind its reviewed ID before retry; matching a tag or name alone never grants authority to edit an unrelated release. A mismatch between configured ID and saved creation ID refuses. Final notes must match the draft body exactly; amendments require a separately reviewed update, not a silent overwrite.

Root-only sequence after final acceptance

Use bundled Python 3.11+ from repository cwd. Each command needs a new simple --attempt name; the exclusive per-action attempt directory preserves events and its final success/failure receipt. These examples have not been run:

python .local/navigation-prerelease-publication-20260911/publish.py inspect --attempt initial
python .local/navigation-prerelease-publication-20260911/push-tag.py --attempt first
python .local/navigation-prerelease-publication-20260911/publish.py create --attempt first
python .local/navigation-prerelease-publication-20260911/publish.py upload --attempt first
python .local/navigation-prerelease-publication-20260911/publish.py publish --attempt first

inspect is read-only and does not require final hashes. It records the reserved release/tag state without calling that acceptance. It does not grant permission to adopt an existing release.

push-tag.py is a distinct normal, nonforce push from the isolated reconstruction repository. It checks the exact source branch/target and release collisions; it creates only the reserved remote tag, never a local tag or unrelated ref. An existing annotated tag is accepted only when its peeled commit is the exact target. A conflicting tag refuses. Creating/checking the tag first avoids repeating the contextual publish failure caused by a missing remote tag. No global Git configuration changes occur.

create requires the tag and published source branch already resolve exactly. It scans authenticated releases, including drafts, for tag collisions and creates a hash-bound draft prerelease only when absent. It never edits a foreign existing release. The bounded scan refuses rather than assuming absence beyond 1,000 releases.

upload accepts only an owned draft and exactly three permitted asset names: ZIP, ZIP.sha256 and VALIDATION.md. All local bytes are hashed first. Existing assets are downloaded and compared byte-for-byte before reuse; unexpected names, duplicate names/IDs, wrong sizes or changed bytes refuse without deletion/replacement. A missing upload is read back immediately, and final API metadata plus all three downloads must match.

publish downloads and verifies all three assets afresh, rechecks source/tag/release ownership and exact notes, and only then changes draft to false. Final API metadata, actual tag target, asset IDs/names/sizes and downloaded hashes are checked again. An uncertain previous publish may be recognized as already public only after all the same checks pass. The tag remains a prerelease, not a stable release claim.

Failures, credentials and limits

No retry is automatic. An upload connection reset may mean the remote upload succeeded; a failed create or publish may also have changed remote state. Preserve the attempt, inspect, and use a new attempt name. Existing matching assets can be reused after fresh downloads. An incomplete final receipt is not a pass. A process kill can leave only the earlier flushed event log, so inspect after interruption as well. There is no release deletion, asset overwrite, force push, rollback, or inferred success.

Credentials are loaded only into process memory from the configured Gitea connection. API requests allow only the exact known origin and reject redirects; Git receives authorization through process-local environment configuration with inherited Git configuration/trace variables removed. Error receipts redact secrets; no credential is written to helper files or Git config. HTTP transport is the existing configured Gitea endpoint; this adapter does not change it.

Compared with the old contextual scripts: dynamic owned release ID replaces hard-coded release3; final note/validation pins are intentionally unbound; exact tag creation is preflighted separately; collision scans include drafts; every attempt has fresh evidence; already-uploaded bytes are checked before reuse; publication repeats downloads before and after visibility change. Runtime/network fault behavior is not claimed by static preparation. Root must obtain independent source review before executing. Source publication already passed elsewhere, but this directory has not published a tag/release or uploaded an asset. Linux/WSL remains paused.