3leaps · 3leapsdave · Sep 1, 2026 · Sep 1, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -54,7 +54,11 @@ jobs:
         run: cargo install cbindgen --version ${{ env.CBINDGEN_VERSION }} --locked
       - name: Install TypeScript tooling
         working-directory: bindings/typescript/sysprims
-        run: npm ci
+        run: |
+          # Use npm install instead of npm ci because release-prep branches
+          # point optionalDependencies at same-version platform packages before
+          # those packages exist in the npm registry.
+          npm install --omit=optional
       - name: Generate current C header
         run: cbindgen --config cbindgen.toml --crate sysprims-ffi --output "${RUNNER_TEMP}/sysprims.h"
       - name: Check capability, export, and documentation drift

diff --git a/.github/workflows/typescript-bindings.yml b/.github/workflows/typescript-bindings.yml
@@ -76,7 +76,11 @@ jobs:
           bun-version: 1.3.3
       - name: Install Node dependencies
         working-directory: bindings/typescript/sysprims
-        run: npm ci
+        run: |
+          # Use npm install instead of npm ci because release-prep branches
+          # point optionalDependencies at same-version platform packages before
+          # those packages exist in the npm registry.
+          npm install --omit=optional
       - name: Build package, native addon, and behavior tests
         working-directory: bindings/typescript/sysprims
         run: npm run clean && npm run build && npm run build:native && npm run build:test
@@ -130,7 +134,11 @@ jobs:
           cache-dependency-path: bindings/typescript/sysprims/package-lock.json
       - name: Install Node dependencies
         working-directory: bindings/typescript/sysprims
-        run: npm ci
+        run: |
+          # Use npm install instead of npm ci because release-prep branches
+          # point optionalDependencies at same-version platform packages before
+          # those packages exist in the npm registry.
+          npm install --omit=optional
       - name: Install musl toolchain
         if: endsWith(matrix.target, '-musl')
         run: sudo apt-get update && sudo apt-get install --yes musl-tools

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.3] - 2026-09-01
+
+### Added
+
+- Cargo publication metadata for the five Rust library crates:
+  `sysprims-core`, `sysprims-signal`, `sysprims-session`, `sysprims-proc`,
+  and `sysprims-timeout`.
+- Crate-local README files for the Rust library crates so crates.io package
+  pages have standalone summaries.
+- `make release-check`, which validates version coherence and constructs the
+  workspace Cargo packages without publishing.
+- Release checklist steps for crates.io publication order and negative
+  controls that keep the CLI, C FFI crate, and TypeScript N-API crate
+  unpublished as Rust crates.
+
+### Changed
+
+- Workspace-internal Cargo dependency pins now carry the release version
+  alongside their local paths, so published library crates resolve correctly.
+- Pull-request TypeScript validation installs dev tooling with
+  `npm install --omit=optional`, allowing release-prep branches to reference
+  same-version platform packages before those packages exist in the npm
+  registry.
+
 ## [0.2.2] - 2026-08-30
 
 ### Added
@@ -740,7 +764,8 @@ TypeScript bindings parity release for proc/ports/signals. Node.js developers no
   - Signal tests now use deterministic patterns: reject pid=0, spawn-and-kill for terminate/forceKill
   - Eliminates flakiness from arbitrary PIDs that may exist on CI runners
 
-[Unreleased]: https://github.com/3leaps/sysprims/compare/v0.2.2...HEAD
+[Unreleased]: https://github.com/3leaps/sysprims/compare/v0.2.3...HEAD
+[0.2.3]: https://github.com/3leaps/sysprims/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/3leaps/sysprims/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/3leaps/sysprims/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/3leaps/sysprims/compare/v0.1.20...v0.2.0

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.2.2"
+version = "0.2.3"
 edition = "2021"
 rust-version = "1.88.0"
 license = "MIT OR Apache-2.0"
@@ -22,11 +22,11 @@ authors = ["3leaps Architecture Council"]
 publish = false
 
 [workspace.dependencies]
-sysprims-core = { version = "0.2.2", path = "crates/sysprims-core" }
-sysprims-timeout = { version = "0.2.2", path = "crates/sysprims-timeout" }
-sysprims-signal = { version = "0.2.2", path = "crates/sysprims-signal" }
-sysprims-proc = { version = "0.2.2", path = "crates/sysprims-proc" }
-sysprims-session = { version = "0.2.2", path = "crates/sysprims-session" }
+sysprims-core = { version = "0.2.3", path = "crates/sysprims-core" }
+sysprims-timeout = { version = "0.2.3", path = "crates/sysprims-timeout" }
+sysprims-signal = { version = "0.2.3", path = "crates/sysprims-signal" }
+sysprims-proc = { version = "0.2.3", path = "crates/sysprims-proc" }
+sysprims-session = { version = "0.2.3", path = "crates/sysprims-session" }
 
 # Fulmen Ecosystem
 # NOTE: Pinned to ensure stable semantics across bindings and avoid accidental

diff --git a/README.md b/README.md
@@ -75,31 +75,34 @@ degradation is exposed in structured output so automation can detect it.
 
 ## Quick Start
 
-### v0.2.2 Release Coordinates
+### v0.2.3 Release Coordinates
 
-The core release and its language packages share version `0.2.2`, but each
+The core release and its language packages share version `0.2.3`, but each
 ecosystem resolves that version through its own coordinate. Publication
 workflows run from the verified core tag.
 
 | Surface | Pin |
 | --- | --- |
-| Rust workspace | Repository tag `v0.2.2` |
-| Go module | `github.com/3leaps/sysprims/bindings/go/sysprims@v0.2.2` |
-| TypeScript | `npm install @3leaps/sysprims@0.2.2` |
-| PTY adapter | A separate [`sysprims-pty`](https://github.com/3leaps/sysprims-pty) release tag that pins core v0.2.2 |
-
-The canonical `v0.2.2` and path-prefixed
-`bindings/go/sysprims/v0.2.2` tags identify the same core commit.
+| Rust crates | `sysprims-core`, `sysprims-signal`, `sysprims-session`, `sysprims-proc`, and `sysprims-timeout` at `0.2.3` |
+| Rust workspace | Repository tag `v0.2.3` |
+| Go module | `github.com/3leaps/sysprims/bindings/go/sysprims@v0.2.3` |
+| TypeScript | `npm install @3leaps/sysprims@0.2.3` |
+| PTY adapter | A separate [`sysprims-pty`](https://github.com/3leaps/sysprims-pty) release tag that pins core v0.2.3 |
+
+The canonical `v0.2.3` and path-prefixed
+`bindings/go/sysprims/v0.2.3` tags identify the same core commit.
 `sysprims-pty` has an independent version and tag lifecycle; it is not included
-in the core tag.
+in the core tag. Only the five Rust library crates are published to crates.io;
+the CLI, C FFI crate, and TypeScript N-API crate are release-built but not
+published as Rust crates.
 
 ### As a Rust Library
 
 ```toml
 [dependencies]
-sysprims-timeout = { git = "https://github.com/3leaps/sysprims", tag = "v0.2.2" }
-sysprims-signal = { git = "https://github.com/3leaps/sysprims", tag = "v0.2.2" }
-sysprims-proc = { git = "https://github.com/3leaps/sysprims", tag = "v0.2.2" }
+sysprims-timeout = "0.2.3"
+sysprims-signal = "0.2.3"
+sysprims-proc = "0.2.3"
 ```
 
 ```rust
@@ -410,8 +413,8 @@ if (err == SYSPRIMS_OK) {
 
 | Language   | Status           | Package                                                   |
 | ---------- | ---------------- | --------------------------------------------------------- |
-| Go         | Available        | `github.com/3leaps/sysprims/bindings/go/sysprims@v0.2.2` |
-| TypeScript | Available        | `npm install @3leaps/sysprims@0.2.2`                      |
+| Go         | Available        | `github.com/3leaps/sysprims/bindings/go/sysprims@v0.2.3` |
+| TypeScript | Available        | `npm install @3leaps/sysprims@0.2.3`                      |
 | Python     | Planned (v0.2.x) | `pip install sysprims`                                    |
 
 ### As a Go Library

diff --git a/RELEASE_CHECKLIST.md b/RELEASE_CHECKLIST.md
@@ -111,6 +111,11 @@ This document walks maintainers through the build/sign/upload flow for each sysp
     ```bash
     gh workflow run "TypeScript Bindings" --ref main
     ```
+  - Pull-request TypeScript validation uses `npm install --omit=optional` rather than
+    `npm ci` because release-prep branches reference same-version platform packages
+    before the npm publication workflow has created them. Do not switch these PR
+    validation jobs back to `npm ci` unless the release process also changes how
+    platform optional dependencies are staged.
 
 - [ ] Create and push tags (must point to the SAME commit):
 
@@ -136,6 +141,18 @@ Notes:
 - Python (PyPI) and TypeScript (npm) do not use git tags for version resolution in the same way.
 - See `docs/decisions/ADR-0012-language-bindings-distribution.md` and `docs/guides/language-bindings.md` for details.
 
+### Required Post-Tag Execution Order
+
+After both tags are pushed, keep release execution in this order:
+
+1. Verify the tag-triggered release workflow and optional validation workflow.
+2. Publish the five crates.io library crates in dependency order.
+3. Download, checksum, sign, verify, upload, and publish the GitHub release assets.
+4. Run TypeScript N-API prebuilds and npm publication from the verified tag.
+
+If any step fails or produces unexpected artifacts, pause before moving to the
+next step.
+
 ### CI Verification
 
 - [ ] Wait for GitHub Actions release workflow to complete
@@ -169,31 +186,8 @@ Notes:
     - windows-amd64 → `x86_64-pc-windows-gnu` (msys2/MinGW-w64)
     - windows-arm64 → `aarch64-pc-windows-gnullvm` (llvm-mingw), since v0.1.16
 
-  TypeScript bindings (run AFTER signing, from the tag ref):
-  1. Run prebuilds workflow on the tag (builds N-API binaries for all platforms):
-
-     ```bash
-     VERSION=$(cat VERSION)
-     gh workflow run "TypeScript N-API Prebuilds" --ref "v${VERSION}"
-     ```
-
-     Wait for completion. This builds `.node` binaries and stages npm package directories.
-
-  2. Run npm publish workflow on the tag (requires OIDC trusted publishing):
-     ```bash
-     VERSION=$(cat VERSION)
-     gh workflow run "TypeScript npm Publish" --ref "v${VERSION}"
-     ```
-     The workflow validates:
-     - Running from a `v*` tag ref (required for OIDC and environment protection)
-     - Node.js >= 22.14.0 and npm >= 11.5.1 for npm trusted publishing
-     - VERSION file and package.json match the tag
-     - Prebuilds were built from the same commit as the tag
-
-  Note: npm publish uses OIDC trusted publishing (no NPM_TOKEN). The workflow must run
-  from a tag ref to satisfy the `publish-npm` environment protection rules, and the
-  publish job intentionally uses Node.js 24 even though validation/prebuild jobs remain
-  on Node.js 20.
+  Do not run TypeScript prebuild or npm publication workflows yet; they run
+  after crates.io publication and signed GitHub release upload.
 
   Integrity rule: anything we intentionally publish as a release asset must be covered by the signed checksum manifests.
 
@@ -357,6 +351,38 @@ export SYSPRIMS_GPG_HOMEDIR=/path/to/gpg/homedir  # optional
    gh release edit v$(cat VERSION) --draft=false
    ```
 
+### TypeScript bindings publication (after signing/upload)
+
+Run these only after crates.io publication is complete and the signed GitHub
+release assets have been uploaded and published.
+
+1. Run prebuilds workflow on the tag (builds N-API binaries for all platforms):
+
+   ```bash
+   VERSION=$(cat VERSION)
+   gh workflow run "TypeScript N-API Prebuilds" --ref "v${VERSION}"
+   ```
+
+   Wait for completion. This builds `.node` binaries and stages npm package directories.
+
+2. Run npm publish workflow on the tag (requires OIDC trusted publishing):
+
+   ```bash
+   VERSION=$(cat VERSION)
+   gh workflow run "TypeScript npm Publish" --ref "v${VERSION}"
+   ```
+
+   The workflow validates:
+   - Running from a `v*` tag ref (required for OIDC and environment protection)
+   - Node.js >= 22.14.0 and npm >= 11.5.1 for npm trusted publishing
+   - VERSION file and package.json match the tag
+   - Prebuilds were built from the same commit as the tag
+
+Note: npm publish uses OIDC trusted publishing (no NPM_TOKEN). The workflow must
+run from a tag ref to satisfy the `publish-npm` environment protection rules,
+and the publish job intentionally uses Node.js 24 even though
+validation/prebuild jobs remain on Node.js 20.
+
 ## 3. Post-Release Verification
 
 - [ ] Verify release is public: `gh release view v$(cat VERSION)`