[wheakerd]

Scope

Make the Release pipeline prove its post-publication steps before its first irreversible one, and stop repository tests from needing an edit on every release. The pipeline published 0.21.0 and then stopped in Advance marketplace catalogs because the handoff pull request #208 failed unit-and-integration-tests; nothing had run that test on the advanced catalogs before the immutable Release existed. Publish release now waits for every GitHub Actions check on the release commit, not only the three required ones and Verify signed main history, and rehearses the catalog handoff in a disposable worktree of that commit, running scripts/check-publication.py and the unit tests on the advanced catalogs, before it dispatches the protected tag controller. When the tag already exists from an earlier attempt, the rehearsal runs before the publisher instead. Release candidate rehearses the same handoff on the pull-request head, and Advance marketplace catalogs merges only after every check on the handoff commit has finished without failing.

Repository tests no longer pin the totals that grow with every release. tests/test_validator_isolation.py builds its expected aggregate summary from the production owners (required public files, Markdown files, release-fact surfaces, installed-runtime inputs, skill rows, route fixtures) and keeps fixture totals literal; tests/test_documentation.py recomputes the Markdown and generated-region totals; tests/test_context_budget.py checks the current routing-context record against the threshold assessment of the measured bytes instead of pinning one release's outcome; and agent-plugin-architect's description is pinned by its route-boundary sentences instead of verbatim.

Affected files and surfaces

• Shared files: None
• Codex-specific files: None
• Claude Code-specific files: None
• Documentation or validation files: .github/workflows/release-pipeline.yml (Node.js setup in the candidate and publish jobs); axiom_validation/release_pipeline.py (settled-check wait, handoff rehearsal, workflow contract); axiom_validation/repository_policy.py (description anchors); tests/test_release_pipeline.py, tests/test_validator_isolation.py, tests/test_documentation.py, tests/test_context_budget.py, tests/test_action_graph.py (30 pins); docs/maintainers/release-documentation.md, docs/repository-governance.md, docs/maintainers/validation.md; CHANGELOG.md (repository policy revision 113); evidence/repository-policy-revisions-v1.json, evidence/runtime-identity.json, evidence/release-status.json, docs/runtime-identity.md (revision 113)

Routing and authorization impact

• Route-selection impact: None.
• Action-authorization impact: None. The pipeline gains no permission; the two jobs only add the pinned Node.js setup action, and the publish job mutates nothing new.
• New or changed stop conditions: Publish release stops before any mutation when a check on the release commit has failed or the rehearsed catalog handoff fails a repository check; Release candidate fails on the pull request for the same rehearsal failure; Advance marketplace catalogs waits for every check on the handoff commit before merging.

Documentation

docs/maintainers/release-documentation.md (Release Pipeline), docs/repository-governance.md (Release Pipeline), and docs/maintainers/validation.md (Required Checks, Validation Tooling) describe the new gates and the test policy. Installation and hook commands are unchanged.

Validation

Command	Result
python3 -B scripts/check-publication.py	Passed on this exact tree: 153 required files, 168 Markdown files, 96 offline route contract fixtures, 30 immutable external action and image pins
python3 -B -m unittest discover -s tests -p 'test_*.py'	OK in a disposable clone of this tree: 312 tests, 1 skipped (Windows-only)
git diff --check	Passed
Additional targeted checks	rehearse_catalog_handoff ran with its real commands on a committed copy of this tree and passed, leaving the checkout and worktree list clean; the ASCII scan of the changed Markdown, JSON, and YAML files passed; release-lifecycle.md in the private maintenance workspace was updated separately to describe the new wait and rehearsal.

Identity: repository-policy-only change; plugin version 0.22.1 and runtime contract digest sha256:34958160debfb8b9b8f2db6be6bd0b2392b580293c03ef3f11279cbd11e608c1 unchanged; repository policy revision 113.

Cross-platform parity

• Shared skill changes were reviewed against Codex and Claude Code, or this change does not affect shared skills.
• Manifest, marketplace, and hook differences remain intentional and documented.
• Optional host-native validation results include the host/tool version, or are marked unavailable.

Unrelated work

• I reviewed the final diff and did not reset, hide, stage, or rewrite unrelated work.
• I did not add generated caches, disposable validation copies, local maintenance notes, or tool output.
• I called out every affected file and any routing, authorization, documentation, or parity impact above.