[HaodiFan]

Summary

What problem does this PR solve?

The release job exposed the public Release before its asset set was proven complete. With immutable Releases enabled, a failed or slow asset upload could leave a locked incomplete Release.

Why does this matter now?

The v0.5.0 run exposed a temporary interval where the Release appeared without the Core archive. The upload later completed and the final v0.5.0 Release is verified and installable, but the workflow ordering remained unsafe for future tags.

What is the intended outcome?

Release only after immutable configuration, the canonical five assets, and all GitHub SHA-256 digests are verified. Publish failure leaves a reusable draft.

What is intentionally out of scope?

No Core Lesson runtime, CoEvolve, contract bundle, canonical Harness Skill, or target-Skill migration behavior changes.

What should reviewers focus on?

The fail-closed workflow order, exact asset set, digest comparison, and v0.5.0 historical wording.

Linked Context

Related #51

Requested during the v0.5.0 release completion audit.

PR Scope

• Docs / README
• Governance / template / script
• Runtime / CLI / tooling

Primary layer:

• Execution Layer
• Governance Layer

Primary artifact kind: Release workflow and v0.5.1 product metadata

One thing this PR does: makes immutable Release publication fail closed.

What this PR does not do: change the v0.5 product composition or target-repository Harness migration rules.

EvoZeus Evidence Proof

• Behavior, Case, or issue addressed: public Release could precede complete asset verification.
• Real environment or session tested: GitHub v0.5.0 Release API and downloaded assets; local macOS worktree.
• Exact steps or command run after this patch: npm test; npm run test:python; claude plugin validate .; python3 scripts/check_pr_ready.py; npm audit --audit-level=high; YAML and diff checks.
• Evidence after change: workflow order is immutable setting check → draft → exact five assets → asset count and per-asset GitHub digest → publish → immutable state assertion.
• Observed result after change: full Node suite passed; Session Signal 261 passed/2 skipped plus 18 subtests; Runtime 94 passed/4 skipped; Plugin validation and audit passed.
• What was not tested: the new workflow has not run against the v0.5.1 tag yet; that occurs only after merge and tag creation.
• Proof limitations or constraints: GitHub Release publication can only be end-to-end proven on a real tag.
• Before evidence, if useful: the final immutable v0.5.0 Release contains all five assets and remains installable; its workflow allowed a temporary incomplete public window.

Verdict / Review Gate

• Fix Environment

Review gates checked:

• Evidence Gate
• Privacy Gate
• Operational Gate
• Negative Gate
• Scope Gate

Tests and Validation

Commands run: npm test, npm run test:python, claude plugin validate ., npm audit --audit-level=high, python3 scripts/check_pr_ready.py, git diff --check, YAML parse.

All executed checks passed after updating the legacy preflight integration assertion for the multiline canonical asset array.

Risk Checklist

Did user-visible behavior change? (Yes)

Did SKILL.md, public instructions, or agent behavior change? (No)

Did privacy, security, network, auth, or tool permission behavior change? (Yes)

Did schema, storage, branch, PR, or governance behavior change? (Yes)

Highest-risk area: Release publication and immutable configuration drift.

How is that risk mitigated? The job stops while the Release is still a draft unless repository immutability, exact asset count, and every digest pass.

AI-Assisted Work

Was this PR written or materially changed by an AI coding agent? (Yes)

Codex implemented and tested the change; an independent subagent audited remote Release evidence and the workflow boundary.

Confirm the author understands the changed behavior:

• Yes

Current Review State

Next action: run required CI, merge, update the single UAT, then create and verify v0.5.1.

Still waiting on author, maintainer, CI, or external proof: required GitHub checks and real-tag Release proof.

Reviewer or bot comments addressed: independent audit blockers were fixed before opening the PR.

Privacy Checklist

• No raw private session logs
• No secrets, tokens, cookies, or credentials
• No customer data
• No private local paths
• Evidence is minimized and redacted

Operational Checklist

• This PR has one primary purpose
• This PR does not mix unrelated refactor, runtime, docs, and community Case work
• Links are relative or public
• python3 scripts/check_pr_ready.py passes
• git diff --check passes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
evozeus-metainflow	Ready	Preview	Aug 4, 2026 9:27am

[github-actions]

EvoZeus Privacy Scan

Mode: dry-run

Findings

• none

Next action

• No simple privacy pattern matched in the PR diff.

[github-actions]

EvoZeus Proof Gate

Mode: dry-run

Proof labels

• proof:needed

Missing or weak fields

• missing code/workflow section: Problem
• missing code/workflow section: Scope
• missing code/workflow section: Real behavior proof
• missing code/workflow section: Tests
• missing code/workflow section: Rollback plan
• missing code/workflow section: Problem
• missing code/workflow section: Scope
• missing code/workflow section: Real behavior proof
• missing code/workflow section: Tests
• missing code/workflow section: Rollback plan
• governance change needs Linked RFC or maintainer discussion

Next action

• Add real behavior proof, not only mocks/lint/CI.

[github-actions]

EvoZeus Queue Guard

Mode: dry-run

Author open PRs: 4

Branch family: codex/bug/20260804-infra-v051-release

Branch family open PRs: 1

Violations

• author has 4 open PRs; limit 3

Next action

• Reduce open PR queue or ask maintainers to override.

[github-actions]

EvoZeus Labeler Report

PR type/risk labels were updated from changed files.

Surfaces

• code
• dependency
• docs
• governance
• workflow

Labels

• risk:dependency
• risk:github-token
• risk:governance
• risk:workflow
• size:M
• type:code
• type:dependency
• type:docs
• type:governance
• type:workflow

Changed lines

• 175

[github-actions]

EvoZeus Dirty PR Check

Mode: dry-run

Surfaces

• code
• dependency
• docs
• governance
• workflow

Reasons

• changes 5 surfaces: code, dependency, docs, governance, workflow
• protected path changed
• governance/workflow change has no RFC or maintainer discussion marker

Next action

• Split the PR, add RFC context, or wait for owner review.