Promote preserved staging lineage into main without tags

.github/workflows/deploy-docs.yml

@@ -9,7 +9,7 @@ on:
         type: choice
         options:
           - staging
-          - prod
+          - production
       action_kind:
         required: true
         default: deploy_web
@@ -21,16 +21,13 @@ on:
       project_id:
         required: false
         type: string
-      preview_id:
-        required: false
-        type: string
 
 jobs:
   web:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-    environment: ${{ inputs.environment == 'prod' && 'production' || 'staging' }}
+    environment: ${{ inputs.environment }}
     defaults:
       run:
         working-directory: docs
@@ -40,12 +37,14 @@ jobs:
       TREESEED_CLOUDFLARE_ACCOUNT_ID: ${{ vars.TREESEED_CLOUDFLARE_ACCOUNT_ID }}
       TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME || 'treeseed-core-docs' }}
       TREESEED_CONTENT_BUCKET_NAME: ${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
+      TREESEED_TEAM_ID: treeseed
+      TREESEED_R2_ACCESS_KEY_ID: ${{ secrets.TREESEED_R2_ACCESS_KEY_ID }}
+      TREESEED_R2_SECRET_ACCESS_KEY: ${{ secrets.TREESEED_R2_SECRET_ACCESS_KEY }}
       TREESEED_CONTENT_BUCKET_BINDING: ${{ vars.TREESEED_CONTENT_BUCKET_BINDING }}
       TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID || 'core' }}
       TREESEED_WORKFLOW_ACTION: ${{ inputs.action_kind }}
       TREESEED_WORKFLOW_ENVIRONMENT: ${{ inputs.environment }}
       TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID || 'core' }}
-      TREESEED_WORKFLOW_PREVIEW_ID: ${{ inputs.preview_id }}
     steps:
       - uses: actions/checkout@v4
 
@@ -69,5 +68,4 @@ jobs:
           set -euo pipefail
           EXTRA_ARGS=()
           if [[ -n "${TREESEED_WORKFLOW_PROJECT:-}" ]]; then EXTRA_ARGS+=(--project-id "${TREESEED_WORKFLOW_PROJECT}"); fi
-          if [[ -n "${TREESEED_WORKFLOW_PREVIEW_ID:-}" ]]; then EXTRA_ARGS+=(--preview-id "${TREESEED_WORKFLOW_PREVIEW_ID}"); fi
           node ./node_modules/@treeseed/sdk/scripts/tenant-workflow-action.js --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"

.github/workflows/publish.yml

@@ -1,32 +1,43 @@
-name: Publish TreeSeed Core
+name: Promote TreeSeed Core Candidate
 
 on:
   push:
-    tags:
-      - "*.*.*"
-  workflow_dispatch:
+    tags: ["*.*.*"]
 
 jobs:
-  publish:
-    if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    environment: production
+  promote:
+    runs-on: ubuntu-24.04
+    permissions: { actions: read, contents: write, id-token: write }
+    environment: ${{ contains(github.ref_name, '-') && 'staging' || 'production' }}
     steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          registry-url: https://registry.npmjs.org
-      - run: npm run release:setup
-      - run: bash -lc 'npm run verify:local'
-      - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - name: Create GitHub release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release create "${GITHUB_REF_NAME}" --generate-notes --verify-tag
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with: { fetch-depth: 0, submodules: recursive }
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with: { node-version: 24, registry-url: https://registry.npmjs.org }
+      - name: Download exact protected candidate
+        env: { GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" }
+        run: |
+          if [[ "$GITHUB_REF_NAME" == *-* ]]; then candidate_branch=staging; else candidate_branch=main; fi
+          test "$(git rev-parse HEAD)" = "$(git rev-parse "origin/${candidate_branch}")"
+          run_id="$(gh run list --workflow verify.yml --branch "$candidate_branch" --commit "$GITHUB_SHA" --status success --limit 1 --json databaseId --jq '.[0].databaseId')"
+          test -n "$run_id"
+          gh run download "$run_id" --name "core-candidate-${GITHUB_SHA}" --dir candidate
+      - run: npm ci --ignore-scripts --no-audit --no-fund
+      - run: npm run release:check-tag
+      - run: npm run release:custody -- verify candidate/release-evidence-v1.json
+      - id: before
+        run: echo "latest=$(npm view @treeseed/core dist-tags.latest)" >> "$GITHUB_OUTPUT"
+      - name: Publish accepted tarball directly
+        run: npm run release:publish -- "$(find candidate -maxdepth 1 -name '*.tgz' -print -quit)"
+        env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" }
+      - name: Verify immutable npm read-back
+        env: { EXPECTED_LATEST: "${{ steps.before.outputs.latest }}" }
+        run: |
+          export EXPECTED_SHA256="$(node -e "const e=require('./candidate/release-evidence-v1.json'); process.stdout.write(e.artifacts.find(x=>x.kind==='npm-package').digest.slice(7))")"
+          node --import tsx ./scripts/packages/verify-published-package.ts
+      - name: Publish unchanged custody assets
+        env: { GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" }
+        run: |
+          flags=()
+          if [[ "$GITHUB_REF_NAME" == *-rc.* ]]; then flags+=(--prerelease); fi
+          gh release create "$GITHUB_REF_NAME" candidate/*.tgz candidate/sbom.cdx.json candidate/release-evidence-v1.json --generate-notes --verify-tag "${flags[@]}"

.github/workflows/verify.yml

@@ -2,7 +2,10 @@ name: Verify
 
 on:
   push:
+    branches: [staging, main]
+    paths-ignore: ["docs/src/content/**"]
   pull_request:
+    # Required verification must also run for ancestry-only reconciliation PRs.
   workflow_dispatch:
 
 jobs:
@@ -37,8 +40,25 @@ jobs:
       - name: Pack verified artifact
         run: mkdir -p artifacts && npm pack --json --ignore-scripts --pack-destination artifacts
 
+      - name: Seal protected staging candidate
+        if: github.ref == 'refs/heads/staging'
+        run: |
+          npm sbom --sbom-format cyclonedx > artifacts/sbom.cdx.json
+          artifact="$(find artifacts -maxdepth 1 -name '*.tgz' -print -quit)"
+          npm run release:custody -- seal artifacts/release-evidence-v1.json "$artifact"
+          npm run release:custody -- verify artifacts/release-evidence-v1.json
+
       - uses: actions/upload-artifact@v4
         with:
           name: core-${{ github.sha }}
           path: artifacts/*.tgz
           if-no-files-found: error
+
+      - name: Upload sealed staging custody
+        if: github.ref == 'refs/heads/staging'
+        uses: actions/upload-artifact@v4
+        with:
+          name: core-candidate-${{ github.sha }}
+          path: artifacts/
+          if-no-files-found: error
+          retention-days: 30

AGENTS.md

@@ -0,0 +1,31 @@
+# Core workspace guidance
+
+## CRITICAL: complete automated test coverage
+
+Every behavior, contract, state transition, failure path, and edge case must have automated unit, integration, and scene/guarantee-based acceptance coverage. This is mandatory for all projects, especially the capacity-provider and agent system. A behavior without all three layers is an unresolved delivery gap, not completed work.
+
+- Unit tests must prove exact outputs, validation, invariants, and boundary conditions. Cover valid and invalid inputs, missing/empty/malformed values, authorization denial, stale or moved refs, and every named prohibited field.
+- Integration tests must exercise the real owning components and their public boundaries: handlers, provider/kernel execution, APIs, persistence, tools, and downstream consumers. Mocks, string assertions, compilation, or call-order checks alone are not integration proof.
+- Coded scenes and guarantees must prove production-shaped end-to-end outcomes: exact governed artifacts and read-back, independent verification, actual usage, exactly-once settlement, and durable teardown. Use the project's existing native acceptance harness and respect package ownership; do not put TreeSeed-specific policy into product-neutral packages.
+- Cover duplicate and concurrent execution, idempotency, partial failure, interruption, retry, resume, cancellation, expiry, provider/tool/subprocess errors, unsafe commands, and cleanup without residue. Preserve failed observations; do not fabricate dispositions, usage, citations, receipts, or passing replays.
+- For every defect, first add a focused regression that reproduces the failure, then add or strengthen the corresponding integration and scene/guarantee cases. Fix the earliest owning contract. Retain previously covered behavior and all historical failed evidence.
+- Never weaken assertions, remove negative cases, narrow acceptance criteria, disable type checks, extend deadlines, increase allowances, or relabel failures as passes to get green results. An unexpected agent timeout is a fatal architecture defect: agents must check authoritative remaining time frequently, reserve verification/closeout time, and produce authorized continuation proposals for unfinished work before the original deadline.
+- Delivery requires passing evidence at all three layers on the exact candidate. Missing environments, credentials, skipped tests, or blocked layers remain explicitly unproven. Component passes, suite totals, line coverage, and process completion never substitute for full semantic acceptance.
+- Before EVERY acceptance run (scene or guarantee), run ALL automated unit and integration tests for every participating project on the exact candidate. Focused regressions are additional checks, not substitutes for the complete suites. Failed, skipped, missing, empty, or inconclusive prerequisite coverage blocks acceptance; never launch a live campaign first and discover prerequisite failures afterward. Run the complete suites once per participating project per acceptance invocation, before any scene begins; do not reuse a previous invocation's passing receipt or omit tests to save time. Preserve exact command, candidate, run, and result evidence in the existing Issue and Actions artifacts.
+- Keep the behavior-to-unit/integration/scene mapping and exact command, commit, run, and artifact evidence in the existing Issue body and Actions artifacts. Reproduce failures with cheap focused tests before another expensive activation or full campaign; batch known fixes, inspect failed jobs, and reuse only unchanged immutable evidence. No duplicate campaigns or new coverage side channels.
+
+## Agent configuration and handler ownership
+
+When this project defines or consumes agents, agent identity, task instructions, prompts, capabilities, permissions, parameters, and activity profiles must be governed YAML configuration. Adding or renaming an agent using existing handlers must not require provider, guest, kernel, or scheduler code changes. Do not hardcode named-role configuration in shared runtime code; shared rules must apply to any configured agent.
+
+Task-specific executable code belongs in the configured handler. Reuse existing class-based handlers and exact profile bindings; new coded functionality may require a pinned handler, but not a parallel dispatch path or duplicated policy. Test arbitrary YAML-defined agents, renamed identities, handler selection, changed prompts/parameters, denied permissions, and unknown/duplicate handlers through unit, real integration, and coded acceptance cases.
+
+Preserve the independent Core package build and exact-ref TreeDX custody.
+
+## Branch and deployment boundary
+
+`main` is the only production branch and maps only to the `production` deployment environment. `staging` is the only development-integration branch and maps only to the `staging` deployment environment. Short-lived pull-request branches may validate without deploying, but they must never define another deployment environment. Do not create or use `development`, `preview`, `stable`, or any other GitHub deployment environment; preview deployments are prohibited. Release tags may promote an exact reviewed `staging` commit to `production` without creating another branch or environment. Artifact channel names must never become GitHub deployment environments.
+
+## Project library
+
+Use `trsd library show core` and `status` before querying `treeseed-ai/core-library`. Read root-level paths at an exact commit. Author only through governed library workspaces and reviews. Never recreate `src/content` or edit `.treeseed/data` directly.

README.md

@@ -69,7 +69,7 @@ Core should stay reusable as a web runtime package and should not duplicate admi
 
 - `src/`: package source
 - `scripts/`: build, release, and verification scripts
-- `test/`: package tests
+- `tests/`: package tests organized by unit, integration, contract, fixtures, and support responsibilities
 - `.fixtures/treeseed-fixtures/`: shared integrated fixture
 - `.github/workflows/`: package CI and publish workflows
 - `templates/github/deploy-web.workflow.yml`: downstream tenant web deploy workflow template