fix(release): enforce supported Cargo and retain publication checks

Use one Cargo publication dry run for all 21 crates before uploading, with an explicit Cargo 1.90+ release-tool requirement and crates.io destination. Update the runbook and test resumability without weakening full artifact verification.

Validation: 5/5 offline tarball fixtures passed; real 21-crate publication dry run passed with no upload; real two-crate unpublished dependency dry run passed; publication order, bash syntax, and git diff --check passed. Runtime root has no npm test/check:web scripts.
Signed-off-by: CodeWhale Bot <bot@codewhale.net>

Author: CodeWhale Bot

docs/RELEASE_RUNBOOK.md

@@ -99,12 +99,21 @@ clippy/test/npm-smoke gates for `fix/*`, `rebrand/*`, `work/v*`, and `main`.
 GitHub Actions keeps the cheap drift/fmt statuses plus macOS and Windows
 coverage, while CNB carries the Linux work.
 
-`publish-crates.sh dry-run` first validates the maintained publication order
-against the locked Cargo workspace graph. It then performs a full
-`cargo publish --dry-run` for crates without unpublished workspace dependencies
-and a packaging preflight for dependent workspace crates. That avoids false
-negatives from crates.io not yet containing the new workspace version while
-still validating package contents before publish.
+`publish-crates.sh` requires Cargo 1.90 or newer for multi-package verification;
+this release-tool requirement is separate from the runtime's Rust 1.88 MSRV.
+Use an up-to-date stable toolchain (`rustup update stable`) for release work.
+
+Both modes validate publication order against the locked workspace graph, then
+run one `cargo publish --dry-run --locked --registry crates-io` covering all
+21 release crates. Cargo resolves unpublished workspace dependencies through a
+temporary local registry, builds every unpacked tarball, and checks publication
+metadata before any upload. Dry-run mode permits source edits and stops there.
+Publish mode requires the approved release checkout and assets, then skips
+versions already on crates.io and uploads the remaining crates in dependency
+order. Resuming still verifies the complete source release; it never weakens
+the artifact gate merely because an earlier crate was already uploaded.
+Registry-side acceptance and credentials are still checked during real upload;
+a successful preflight cannot guarantee that every later upload will succeed.
 
 For npm wrapper verification, build the single runtime and run the
 cross-platform smoke harness. This packs the npm wrapper, installs it into a

scripts/release/publish-crates.sh

@@ -14,6 +14,15 @@ case "${mode}" in
     ;;
 esac
 
+# Multi-package publication verification was stabilized in Cargo 1.90.
+# Release tooling can require a newer Cargo than the runtime's Rust MSRV.
+cargo_version="$(cargo --version)"
+if [[ ! "${cargo_version}" =~ ^cargo[[:space:]]+([0-9]+)\.([0-9]+)\. ]] ||
+   (( BASH_REMATCH[1] < 1 || (BASH_REMATCH[1] == 1 && BASH_REMATCH[2] < 90) )); then
+  echo "Release preflight requires Cargo 1.90 or newer; found ${cargo_version}. Run rustup update stable and use that toolchain." >&2
+  exit 1
+fi
+
 packages=("${release_crates[@]}")
 crates_user_agent="CodeWhale release publish check (https://github.com/Hmbown/CodeWhale)"
 
@@ -42,10 +51,10 @@ if [[ "${mode}" == "publish" ]]; then
   "${script_dir}/verify-release-assets.sh"
 fi
 
-# Package the complete release together. Cargo resolves unpublished workspace
-# dependencies through a temporary local registry, then builds each unpacked
-# tarball. A file inventory alone cannot detect missing embedded assets.
-package_args=(--locked)
+# Verify the complete release together, including Cargo's publication checks.
+# Unpublished dependencies resolve through a temporary local registry, and
+# each unpacked tarball builds before the first real upload is attempted.
+package_args=(--dry-run --locked --registry crates-io)
 if [[ "${mode}" == "dry-run" ]]; then
   package_args+=(--allow-dirty)
 fi
@@ -54,7 +63,7 @@ for package in "${packages[@]}"; do
 done
 
 echo "Verifying all ${#packages[@]} release package tarballs before any upload..."
-cargo package "${package_args[@]}"
+cargo publish "${package_args[@]}"
 if [[ "${mode}" == "dry-run" ]]; then
   echo "Release package verification OK; no crates uploaded."
   exit 0
@@ -88,7 +97,7 @@ for package in "${packages[@]}"; do
   if crate_version_exists "${package}" "${workspace_version}"; then
     echo "Skipping ${package} ${workspace_version}; already published."
   else
-    cargo publish --locked -p "${package}"
+    cargo publish --locked --registry crates-io -p "${package}"
     wait_for_crate_version "${package}" "${workspace_version}"
   fi
   echo "::endgroup::"

scripts/release/publish-crates.test.py

@@ -14,6 +14,8 @@
 
 class PublishPreflightTests(unittest.TestCase):
     def setUp(self):
+        real_cargo = shutil.which("cargo")
+        self.assertIsNotNone(real_cargo, "Cargo 1.90+ must be installed to run release preflight tests")
         self.temporary = tempfile.TemporaryDirectory()
         self.addCleanup(self.temporary.cleanup)
         self.root = Path(self.temporary.name)
@@ -58,6 +60,8 @@ def setUp(self):
         cargo = bin_dir / "cargo"
         cargo.write_text(
             '#!/usr/bin/env bash\nset -euo pipefail\n'
+            'if [[ "${1:-}" == --version && -n "${TEST_CARGO_VERSION:-}" ]]; then\n'
+            '  echo "$TEST_CARGO_VERSION"; exit 0\nfi\n'
             # Cargo publish --dry-run still contacts the registry. Keep its real
             # tarball build for the old-script regression check, fully offline.
             'if [[ "${1:-}" == publish ]]; then\n'
@@ -74,7 +78,7 @@ def setUp(self):
         curl.chmod(0o755)
         self.env = {
             **os.environ,
-            "TEST_REAL_CARGO": shutil.which("cargo"),
+            "TEST_REAL_CARGO": real_cargo,
             "TEST_UPLOADS": str(self.uploads),
             "PATH": str(bin_dir) + os.pathsep + os.environ["PATH"],
             "CARGO_NET_OFFLINE": "true",
@@ -99,6 +103,29 @@ def assert_missing_asset_blocks(self, mode):
         self.assertFalse(self.uploads.exists(), "upload reached before all packages passed")
         self.assertIn("payload.txt", output)
 
+    def test_old_cargo_fails_before_packaging_or_upload(self):
+        for version in ("cargo 1.88.0 (fixture)", "cargo 1.89.0 (fixture)", "unknown"):
+            with self.subTest(version=version):
+                self.env["TEST_CARGO_VERSION"] = version
+                output = self.run_command(
+                    ["bash", str(self.scripts / "publish-crates.sh"), "publish"], success=False
+                )
+                self.assertIn("requires Cargo 1.90 or newer", output)
+                self.assertFalse(self.uploads.exists())
+                self.assertFalse((self.root / "target/package").exists())
+
+    def test_resume_verifies_tarballs_and_skips_existing_versions(self):
+        manifest = self.root / "app/Cargo.toml"
+        manifest.write_text(manifest.read_text().replace('exclude = ["src/payload.txt"]\n', ""))
+        (self.root / "bin/curl").write_text("#!/bin/sh\nexit 0\n")
+        output = self.run_command(
+            ["bash", str(self.scripts / "publish-crates.sh"), "publish"], success=True
+        )
+        self.assertIn("Skipping codewhale-preflight-base", output)
+        self.assertIn("Skipping codewhale-preflight-app", output)
+        self.assertTrue((self.root / "target/package/codewhale-preflight-app-0.0.0.crate").exists())
+        self.assertFalse(self.uploads.exists())
+
     def test_dry_run_builds_dependent_tarball(self):
         self.assert_missing_asset_blocks("dry-run")