release: canary publish channel — mandatory authenticated pre-publish gate with post-canary live production CI, + publish-readiness automation

[rickylabs]

Owner-ratified 2026-07-17 (after the v0.0.1-beta.10 partial publish, second occurrence of the dry-run-blind registry rejection class — see #810 lineage, denoland/deno#35546).

1. Canary channel (the structural fix)

The only honest test of registry acceptance is an authenticated publish. Establish a canary channel as a MANDATORY gate before every stable-channel publish:

• deno task release:canary + dedicated CI (.github/workflows/release-canary.yml): cut a -canary.N prerelease of the upcoming version (real @netscript scope, so the cross-package dependency graph is exercised unmodified; canary versions are never marked Latest and may be yanked after validation), publish the full workspace via the same OIDC path as production.
• Post-canary live production CI: on canary-publish success, automatically run the artifact-pinned e2e-cli-prod suite against the canary version (the existing workflow_dispatch published-version path) — install from JSR, scaffold, full runtime validation. Green pair (canary publish + canary prod E2E) is the precondition for cutting the stable version.
• Documented in the netscript-release skill as a mandatory step: no release:publish without a green canary pair for the same content.

2. Publish-readiness automation (.llm/tools/release/ as the official home)

Extend the existing release toolbelt with publish-readiness.ts, run inside the canary workflow and as a standalone task:

• new-package detection (workspace members absent from JSR) → provisioning dry-check + first-publish checklist (README production standard scoped to publishable packages, tagline byte-cap, license/exports/config validation, docs-site coverage pointer);
• root/workspace config validation (publish set completeness, lockstep versions, residue);
• import-attribute preflight (from fix(mcp): registry-safe README embedding — JSR rejects text-import attributes #810, with its deno publish rejects ("import attribute type of text is unsupported") even though it is runtime-stable and --dry-run accepts it denoland/deno#35546 sunset criterion);
• one composed verdict, per-check evidence output (same Gate-log discipline as the doc-audit profile).

Promoted as the official/mandatory publish workflow; ad-hoc publishing documented as prohibited.

Acceptance

• release:canary cuts + publishes a -canary.N version end-to-end via CI (OIDC), never marked Latest.
• Canary-prod E2E auto-triggers on canary publish success, pinned to the exact canary version.
• release:publish path documents (and where practical, checks) the green-canary-pair precondition.
• publish-readiness.ts catches: a seeded new package with no README sections, a seeded versionless specifier, a seeded import attribute — each proven-to-fail.
• netscript-release skill updated (source + mirror) with the canary-first flow.

Refs #810, #143, #139. Would have caught: alpha.5 half-publish, beta.10 partial publish.

Acceptance evidence (2026-07-17, PR #812 @ 64184de): IMPL-EVAL cycle 2 PASS (Fable 5 medium, .llm/runs/beta10-cli--orchestrator/slices/811-canary/evaluate.md): all three seeded violations proven-to-fail LIVE against deno task publish:readiness (text-import attribute w/ denoland/deno#35546 sunset + generated-constant guidance, versionless specifier, README standard), clean tree back to 8/8 PASS; unit test exercises the real preflight subprocess; release suite 61/61; canary workflow + canary-prod E2E pinning and skill (source+mirror) canary-first flow verified on the merged head.