ci(release): propose betas from master; stable only by manual dispatch

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [master, feature/holographic-memory, codex/tracedecay-total-redesign-plan-reopened]
+    branches: [master, feature/holographic-memory]
   pull_request:
     branches: ['**']
 
@@ -310,7 +310,7 @@ jobs:
       # standard methods the client declared, and the upstream `initialize`
       # response is the only authority for those. Without the component the
       # runner still has rustup's `rust-analyzer` proxy on PATH, so the daemon
-      # routes the language and only the spawn fails — the test would then
+      # routes the language and only the spawn fails. The test would then
       # measure a missing component instead of the negotiation contract. This
       # action exports `RUSTUP_TOOLCHAIN`, so the component has to be installed
       # here rather than through `rust-toolchain.toml`, which it overrides.
@@ -366,8 +366,8 @@ jobs:
       # then nextest under the `ci` policy and the perf cargo profile with
       # `--no-tests=fail`. One target directory for the group, so a later
       # partition's shared units are fingerprint hits. Every partition runs
-      # even after an earlier one fails — as nextest's `ci` policy runs every
-      # test — and the step fails if any did. Every nextest run rewrites the
+      # even after an earlier one fails, as nextest's `ci` policy runs every
+      # test, and the step fails if any did. Every nextest run rewrites the
       # `ci` profile's junit.xml, so each partition's report is moved under
       # its own name before the next runs. The per-partition wall times this
       # prints are the measurements the manifest's macOS budgets wait for.
@@ -463,9 +463,9 @@ jobs:
   # shape) keeps the whole 55 min compile plus an archive round trip on the
   # path and then the dashboard rebuild and parity on the same job: ~88 min,
   # or ~70 with both moved elsewhere. The partitions pay for the shorter path
-  # with duplicated compile — each root partition rebuilds the library chain
+  # with duplicated compile. Each root partition rebuilds the library chain
   # beneath the root crate, about 200 core-minutes per run across the seven
-  # jobs — which is free on hosted runners where only wall time and the
+  # jobs, which is free on hosted runners where only wall time and the
   # 20-job concurrency cap count. A cold dependency cache adds ~6 min to every
   # job alike (the dependencies compile at opt-level 0 in ~17 core-minutes).
   # The floor no partitioning reaches is the root chain itself: library
@@ -511,7 +511,7 @@ jobs:
       # standard methods the client declared, and the upstream `initialize`
       # response is the only authority for those. Without the component the
       # runner still has rustup's `rust-analyzer` proxy on PATH, so the daemon
-      # routes the language and only the spawn fails — the test would then
+      # routes the language and only the spawn fails. The test would then
       # measure a missing component instead of the negotiation contract. This
       # action exports `RUSTUP_TOOLCHAIN`, so the component has to be installed
       # here rather than through `rust-toolchain.toml`, which it overrides.
@@ -545,7 +545,7 @@ jobs:
       # the CLI and the evaluator), so its save covers the other root
       # partitions exactly. The three lower partitions unify dependency
       # features differently and each recompile ~30 small dependency units
-      # (syn, serde_json, futures, chrono, ...) against it every run — a few
+      # (syn, serde_json, futures, chrono, ...) against it every run. A few
       # minutes inside jobs that are far from the critical path, cheaper than
       # three more cache entries. Restored before the first `cargo metadata`
       # below so the registry index comes from the cache too.
@@ -616,21 +616,21 @@ jobs:
   # hotpath/, and the `#[ignore]`d test in the crate's library test target
   # (`controlled_workloads::tests::hotpath_off_vs_on_durable_results_are_
   # identical`) spawns them from there; `--run-ignored only` with
-  # `--no-tests=fail` is the only way it runs, and nothing else — no
-  # partition, artifact upload or junit merge — consumes the executables.
+  # `--no-tests=fail` is the only way it runs, and nothing else. No
+  # partition, artifact upload or junit merge consumes the executables.
   #
   # Its own job rather than a tail on the `root-lib` partition, where it ran
   # after the root library's tests: the feature-on build recompiles every
   # workspace crate beneath the evaluator (all 21 depend on `hotpath`, so
   # the feature flip changes each one's metadata hash) plus the example,
   # ~10 min on top of the ~26 min root chain, which made that job the lane's
   # critical path. Here the graph beneath the evaluator compiles from the
-  # checkout in both modes — a serial chain domain → contracts →
+  # checkout in both modes. A serial chain domain → contracts →
   # rusqlite-runtime → runtime-core → code-index → sessions → query →
   # search-eval → example of ~9 min per mode with four compile slots (cargo
   # `--timings`, -j4 on EPYC 7742 cores; the same pair of builds took 19.5
   # min on a hosted runner in run 34138693824, when the single-job lane
-  # still built them as their own resolution) — then the library test target
+  # still built them as their own resolution). Then the library test target
   # (24 s against the feature-off graph) and the test itself (under 1 s).
   # With setup, ~24 min hosted: beside the partitions and no longer than the
   # slowest of them (25.9 and 27.4 min in run 34296614024), so the `Test
@@ -1058,7 +1058,7 @@ jobs:
   # builds, a graph the perf-profile test lanes share nothing with, so there
   # is no compiled tree to reuse and nothing to gain from waiting for one.
   # As the last steps of the Linux test job they ran only after a green
-  # suite — never once on this branch — and would have held the Linux shards
+  # suite, never once on this branch, and would have held the Linux shards
   # back by their own duration. Here the verdict lands independently at
   # about clippy's cost: the cold `cargo clippy --workspace --all-targets`
   # took 13.7 min (run 34231734416), the second check re-resolves only the
@@ -1095,8 +1095,8 @@ jobs:
       - uses: actions/checkout@v7
       # Judge formatting with the toolchain `rust-toolchain.toml` pins, not
       # whatever `stable` is on the runner. rustfmt's output changes between
-      # releases — 1.98.1 breaks a `.unwrap_or_else(|err| { ... })` chain that
-      # 1.97.1 keeps inline — so a `stable` rustfmt rejects a tree the pinned
+      # releases. 1.98.1 breaks a `.unwrap_or_else(|err| { ... })` chain that
+      # 1.97.1 keeps inline, so a `stable` rustfmt rejects a tree the pinned
       # rustfmt developers run formats exactly, and every contributor sees a
       # red lane they cannot reproduce. `dtolnay/rust-toolchain@stable` also
       # exports `RUSTUP_TOOLCHAIN`, which overrides the toolchain file rather
@@ -1153,7 +1153,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 30
     env:
-      # Stock (upstream) Hermes pin — the generated plugin must keep working
+      # Stock (upstream) Hermes pin. The generated plugin must keep working
       # against this exact upstream commit. Bump deliberately after rerunning
       # scripts/hermes_stock_integration.sh against the new ref locally.
       HERMES_UPSTREAM_REPO: https://github.com/NousResearch/hermes-agent.git
@@ -1207,7 +1207,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 30
     env:
-      # Stock host pins — the installed bundle must keep working against these
+      # Stock host pins. The installed bundle must keep working against these
       # exact host releases. Bump deliberately after rerunning
       # scripts/claude_stock_integration.sh and
       # scripts/opencode_stock_integration.sh against the new versions locally.

.github/workflows/release-please.yml

@@ -1,9 +1,37 @@
+# Release channels.
+#
+# Every push to master proposes the next beta prerelease: release-please
+# (release-please-config.json, versioning "prerelease") opens or updates a
+# "chore(release): release X.Y.Z-beta.N" PR. Merging it tags the merge commit
+# and publishes a GitHub *prerelease*, which release-beta.yml turns into
+# attested `tracedecay-beta-<tag>-<platform>` assets, the names the CLI beta
+# upgrade channel resolves.
+#
+# A stable release never happens on its own. Dispatch this workflow with
+# channel=stable and the exact version to ship; release-please then opens a
+# "chore(release): release X.Y.Z" PR from release-please-config-stable.json,
+# and merging that publishes a full release for release.yml.
+#
+# Recover assets for an existing tag:
+#   gh workflow run release-beta.yml --ref vX.Y.Z-beta.N -f release_tag=vX.Y.Z-beta.N
+#   gh workflow run release.yml      --ref vX.Y.Z        -f release_tag=vX.Y.Z
+
 name: Release Please
 
 on:
   push:
     branches: [master]
   workflow_dispatch:
+    inputs:
+      channel:
+        description: "beta proposes the next prerelease; stable opens a release PR for the exact version below"
+        type: choice
+        options: [beta, stable]
+        default: beta
+      version:
+        description: "Stable version to ship, e.g. 0.1.0 (required when channel=stable)"
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -22,12 +50,40 @@ jobs:
       issues: write
       pull-requests: write
     steps:
+      - name: Resolve the release channel
+        id: channel
+        env:
+          CHANNEL: ${{ inputs.channel || 'beta' }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          case "$CHANNEL" in
+            beta)
+              [[ -z "$VERSION" ]] ||
+                { echo "channel=beta does not take a version; release-please derives the next prerelease" >&2; exit 1; }
+              echo "config=release-please-config.json" >>"$GITHUB_OUTPUT"
+              echo "release_as=" >>"$GITHUB_OUTPUT"
+              ;;
+            stable)
+              [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] ||
+                { echo "channel=stable requires an exact X.Y.Z version, got '${VERSION}'" >&2; exit 1; }
+              echo "config=release-please-config-stable.json" >>"$GITHUB_OUTPUT"
+              echo "release_as=$VERSION" >>"$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "unknown channel: $CHANNEL" >&2
+              exit 1
+              ;;
+          esac
+
       - name: Open release PR or create GitHub release
         id: release
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
           token: ${{ secrets.RELEASE_PLZ_TOKEN }}
           target-branch: master
+          config-file: ${{ steps.channel.outputs.config }}
+          manifest-file: .release-please-manifest.json
+          release-as: ${{ steps.channel.outputs.release_as }}
 
       - name: Checkout release PR
         if: steps.release.outputs.prs_created == 'true'
@@ -36,11 +92,22 @@ jobs:
           ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
           token: ${{ secrets.RELEASE_PLZ_TOKEN }}
 
+      # The release PR is opened as a draft and stays one until it carries a
+      # lockfile matching the bumped Cargo.toml, the same invariant the later
+      # locked release build enforces.
       - name: Update release PR lockfile
         if: steps.release.outputs.prs_created == 'true'
         env:
+          GH_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
           RELEASE_PR_JSON: ${{ steps.release.outputs.pr }}
-        run: scripts/update-release-pr-lockfile.sh
+        run: |
+          RELEASE_PR_NUMBER=$(
+            jq --exit-status --raw-output \
+              '.number | select(type == "number")' \
+              <<<"$RELEASE_PR_JSON"
+          )
+          scripts/update-release-pr-lockfile.sh
+          gh pr ready "$RELEASE_PR_NUMBER" --repo "$GITHUB_REPOSITORY"
 
       - name: Checkout master
         if: always()

.github/workflows/release-pr-distribution-acceptance.yml

@@ -12,9 +12,7 @@ name: Release PR distribution acceptance
 
 on:
   pull_request:
-    branches:
-      - master
-      - codex/tracedecay-total-redesign-plan-reopened
+    branches: [master]
 
 permissions:
   contents: read

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.0.74"
+  ".": "0.1.0-beta.40"
 }