chore: prepare v0.14.0-beta.1 npm release

README.md

@@ -39,16 +39,21 @@ Requirements:
 - Git 2.39 or newer
 - Codex CLI for managed execution
 
-The current source is published as a GitHub prerelease. The npm registry may lag
-the GitHub candidate; check [Validation Status](docs/validation-status.md) before
-choosing an install source.
+Check the live npm tags, then install the current beta CLI:
 
-Run the current source from a checkout:
+```bash
+npm view @setrathex/codex-engineering-workflow-pack dist-tags --json
+npm install -g @setrathex/codex-engineering-workflow-pack@beta
+cewp init
+cewp doctor
+```
+
+To evaluate the exact GitHub candidate before or without a registry publication,
+run it from a source checkout:
 
 ```bash
 git clone https://github.com/SetraTheXX/Codex-Engineering-Workflow-Pack.git
 cd Codex-Engineering-Workflow-Pack
-node ./bin/cewp.js init
 node ./bin/cewp.js doctor
 ```
 

docs/install.md

@@ -16,38 +16,37 @@ CEWP has three public surfaces:
 
 ## One-Time Repo Install
 
-The npm registry can trail the current GitHub prerelease. Check the published
-registry version before using `npx`:
+Check the live registry tags before using `npx`:
 
 ```bash
-npm view @setrathex/codex-engineering-workflow-pack version
+npm view @setrathex/codex-engineering-workflow-pack dist-tags --json
 ```
 
 Install CEWP skills into the current repo:
 
 ```bash
-npx @setrathex/codex-engineering-workflow-pack init
+npx @setrathex/codex-engineering-workflow-pack@beta init
 ```
 
 Install into a specific repo:
 
 ```bash
-npx @setrathex/codex-engineering-workflow-pack init --mode repo --target "/path/to/repo"
+npx @setrathex/codex-engineering-workflow-pack@beta init --mode repo --target "/path/to/repo"
 ```
 
 After install, verify:
 
 ```bash
-npx @setrathex/codex-engineering-workflow-pack doctor
-npx @setrathex/codex-engineering-workflow-pack list
+npx @setrathex/codex-engineering-workflow-pack@beta doctor
+npx @setrathex/codex-engineering-workflow-pack@beta list
 ```
 
 ## Global Install
 
 Install the CLI globally if you use CEWP across many repos:
 
 ```bash
-npm install -g @setrathex/codex-engineering-workflow-pack
+npm install -g @setrathex/codex-engineering-workflow-pack@beta
 cewp init
 ```
 

docs/release-notes.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+## 0.14.0-beta.1 — 2026-07-27
+
 ### Changed
 
 - Removed the maintainer-only Turkish acceptance guide, pilot-study templates,
@@ -10,6 +12,10 @@
   the supported public documentation surface.
 - Clarified that the current GitHub prerelease leads the npm registry and that the
   Codex plugin is installed from a source checkout rather than a global catalog.
+- Added an npm-first beta installation path, explicit public scoped-package
+  metadata, and matching package/plugin version contracts.
+- Prepared a new patch prerelease so npm and GitHub do not reuse
+  `0.14.0-beta.0` for source that changed after its tag.
 
 ## 0.14.0-beta.0 — 2026-07-27
 

docs/validation-status.md

@@ -6,9 +6,9 @@ the public repository.
 
 ## Current Candidate
 
-- Package: `0.14.0-beta.0`
-- GitHub prerelease: `v0.14.0-beta.0`
-- npm registry: `0.7.0-beta.0` (`0.14.0-beta.0` publication pending)
+- Package: `0.14.0-beta.1`
+- GitHub release target: `v0.14.0-beta.1`
+- npm publication target: `0.14.0-beta.1`
 - Codex plugin distribution: source-checkout marketplace only
 - Managed backend: `codex-exec`
 - Supported Node.js majors: 22, 24, and 26
@@ -17,6 +17,13 @@ the public repository.
 - Independent user validation: not claimed
 - Publication status: GitHub prerelease; not released as `1.0.0`
 
+Registry state can change independently of the repository. Query the live
+distribution tags before installation:
+
+```bash
+npm view @setrathex/codex-engineering-workflow-pack dist-tags --json
+```
+
 `cewp compatibility --json` is the canonical machine-readable compatibility
 projection. A release still requires validation of the exact final source,
 matching package and plugin versions, reviewed package contents, and explicit

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@setrathex/codex-engineering-workflow-pack",
-  "version": "0.14.0-beta.0",
+  "version": "0.14.0-beta.1",
   "description": "Long-running Codex goals without blind runs: local-first supervision, verification, recovery, review, and evidence.",
   "license": "MIT",
   "repository": {
@@ -11,6 +11,9 @@
   "bugs": {
     "url": "https://github.com/SetraTheXX/Codex-Engineering-Workflow-Pack/issues"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "bin": {
     "cewp": "bin/cewp.js",
     "cewp-mcp": "bin/cewp-mcp.js",

plugins/cewp/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cewp",
-  "version": "0.14.0-beta.0",
+  "version": "0.14.0-beta.1",
   "description": "Plan, run, recover, and review bounded engineering checkpoints through the local CEWP runtime.",
   "author": {
     "name": "SetraTheXX",

plugins/cewp/README.md

@@ -1,6 +1,6 @@
 # CEWP Codex Plugin
 
-This thin plugin exposes CEWP's Phase 9 supervised workflow through supported Codex discovery and conversation surfaces. The local `cewp` CLI/runtime remains authoritative for run state, scope, policy, budget enforcement, verification, checkpoint snapshots, reviewer PASS, and finalization. A run has one active checkpoint at a time and may continue linearly only after fresh operator approval.
+This thin plugin exposes CEWP's supervised workflow through supported Codex discovery and conversation surfaces. The local `cewp` CLI/runtime remains authoritative for run state, scope, policy, budget enforcement, verification, checkpoint snapshots, reviewer PASS, and finalization. A run has one active checkpoint at a time and may continue linearly only after fresh operator approval.
 
 It ships exactly three entry skills:
 

tests/contracts/pilot-release.js

@@ -13,7 +13,7 @@ function read(relativePath) {
 function runContract() {
   const packageJson = JSON.parse(read("package.json"));
   const plugin = JSON.parse(read("plugins/cewp/.codex-plugin/plugin.json"));
-  const version = packageJson.version.match(/^0\.(\d+)\.0-beta\.0$/);
+  const version = packageJson.version.match(/^0\.(\d+)\.0-beta\.\d+$/);
   assert(version && Number(version[1]) >= 13, "current beta preserves the Phase 13 release surface");
   assert(plugin.version === packageJson.version, "plugin and package versions stay aligned");
 
@@ -30,13 +30,16 @@ function runContract() {
 
   const readme = read("README.md");
   assert(readme.includes("docs/validation-status.md"), "README links the aggregate validation boundary");
+  assert(/npm install -g @setrathex\/codex-engineering-workflow-pack@beta/i.test(readme), "README gives npm visitors a current beta install command");
   assert(!/dogfood|pilot id|run id/i.test(readme), "README omits local acceptance-run details");
 
   const validation = read("docs/validation-status.md");
   assert(/technical acceptance: complete/i.test(validation), "validation status records technical acceptance");
   assert(/independent user validation: not claimed/i.test(validation), "validation status avoids an external-user claim");
-  assert(/GitHub prerelease: `v0\.14\.0-beta\.0`/i.test(validation), "validation status identifies the current GitHub prerelease");
-  assert(/npm registry: `0\.7\.0-beta\.0`.*publication pending/is.test(validation), "validation status discloses that npm trails the current source");
+  assert(/Package: `0\.14\.0-beta\.1`/i.test(validation), "validation status identifies the package prepared for npm");
+  assert(/GitHub release target: `v0\.14\.0-beta\.1`/i.test(validation), "validation status identifies the matching GitHub release target");
+  assert(/npm publication target: `0\.14\.0-beta\.1`/i.test(validation), "validation status identifies the matching npm publication target");
+  assert(/npm view @setrathex\/codex-engineering-workflow-pack dist-tags --json/i.test(validation), "validation status directs readers to live registry truth");
   assert(/local run identifiers.*not part of\s+the public repository/is.test(validation), "validation status excludes local run identities");
   assert(packageJson.files.includes("docs/validation-status.md"), "aggregate validation status is packaged");
 

tests/contracts/release-preparation.js

@@ -8,6 +8,7 @@ const repoRoot = path.resolve(__dirname, "..", "..");
 
 function runContract() {
   const packageJson = JSON.parse(fs.readFileSync(path.join(repoRoot, "package.json"), "utf8"));
+  assert(packageJson.publishConfig && packageJson.publishConfig.access === "public", "scoped npm publication is explicitly public");
   assert(packageJson.scripts["release:plan"] === "node scripts/prepare-release.js --plan --json", "release planning is deterministic and read-only");
   assert(packageJson.scripts["release:prepare"] === "node scripts/prepare-release.js --yes", "artifact preparation requires explicit approval");
   const source = fs.readFileSync(path.join(repoRoot, "scripts", "prepare-release.js"), "utf8");

tests/contracts/stable-core.js

@@ -18,7 +18,7 @@ function runContract() {
   assert(result.status === 0, `compatibility command succeeds: ${result.stderr}`);
   const contract = JSON.parse(result.stdout);
   assert(contract.schemaVersion === "stable-compatibility/v1", "compatibility output has a stable schema");
-  assert(contract.packageVersion === "0.14.0-beta.0", "package is prepared for the Phase 14 stable-core beta");
+  assert(contract.packageVersion === "0.14.0-beta.1", "package is prepared for the current Phase 14 stable-core beta");
   assert(contract.release.status === "phase-13-complete-release-validation-required", "compatibility reports Phase 13 complete without claiming publication");
   assert(contract.release.phase13.validationModel === "maintainer-technical-acceptance", "compatibility names the approved Phase 13 model");
   assert(contract.release.phase13.independentUserValidationRequired === false, "compatibility removes independent-user quotas");

tests/contracts/workflow-release.js

@@ -13,7 +13,7 @@ const plugin = JSON.parse(fs.readFileSync(
 const releaseNotes = fs.readFileSync(path.join(repoRoot, "docs", "release-notes.md"), "utf8");
 
 function runWorkflowReleaseContract() {
-  const version = packageJson.version.match(/^0\.(\d+)\.0-beta\.0$/);
+  const version = packageJson.version.match(/^0\.(\d+)\.0-beta\.\d+$/);
   assert(version && Number.parseInt(version[1], 10) >= 12, "current beta remains at or beyond the Phase 12 package line");
   assert(plugin.version === packageJson.version, "plugin version follows the package version");
 

tests/harness/run-smoke.js

@@ -2572,7 +2572,7 @@ async function main() {
       const pack = run("npm", ["pack", "--dry-run"], { cwd: cewpRoot, timeout: 120000 });
       const packOutput = `${pack.stdout}\n${pack.stderr}`;
       assertExit(pack, 0, "npm pack --dry-run");
-      assert(/^0\.\d+\.0-beta\.0$/.test(packageJson.version), `unexpected beta package version: ${packageJson.version}`);
+      assert(/^0\.\d+\.0-beta\.\d+$/.test(packageJson.version), `unexpected beta package version: ${packageJson.version}`);
       assert(packOutput.includes("docs/adapter-contract.md"), "adapter contract doc should be packed");
       assert(packOutput.includes("docs/supervised-workflow.md"), "supervised workflow doc should be packed");
       assert(packOutput.includes("docs/known-limitations.md"), "known limitations should be packed");