chore(phase-J): j.4 closeout — release records + integrate sync

.github/actions/setup-sc-lint/action.yml

@@ -155,7 +155,7 @@ runs:
       run: |
         set -euo pipefail
         root="${GITHUB_WORKSPACE:-${PWD}}"
-        smoke_json="$(sc-lint --json --root "${root}" lint sc-boundary)"
+        smoke_json="$(sc-lint --json --root "${root}" lint sc-runtime)"
         jq -e '.ok == true and (.error.code // "") != "CLI.CONFIG_ERROR"' \
           <<<"${smoke_json}" >/dev/null || {
           echo "sc-lint setup: root discovery failed or returned CLI.CONFIG_ERROR" >&2
@@ -166,7 +166,7 @@ runs:
       shell: pwsh
       run: |
         $root = if ($env:GITHUB_WORKSPACE) { $env:GITHUB_WORKSPACE } else { (Get-Location).Path }
-        $value = sc-lint --json --root $root lint sc-boundary | ConvertFrom-Json
+        $value = sc-lint --json --root $root lint sc-runtime | ConvertFrom-Json
         if (-not $value.ok -or $value.error.code -eq 'CLI.CONFIG_ERROR') {
           throw "sc-lint root discovery failed: $($value | ConvertTo-Json -Compress)"
         }

.github/scripts/release_artifacts.py

@@ -417,7 +417,11 @@ def cmd_validate_manifest(args: argparse.Namespace) -> int:
 
 def cmd_list_publish_plan(args: argparse.Namespace) -> int:
     manifest = load_manifest(Path(args.manifest))
-    for crate in manifest["crates"]:
+    publishable = sorted(
+        (crate for crate in manifest["crates"] if crate.get("publish", True)),
+        key=lambda crate: crate.get("publish_order", 0),
+    )
+    for crate in publishable:
         print(f"{crate['package']}|{crate['wait_after_publish_seconds']}")
     return 0
 

.github/workflows/release-preflight.yml

@@ -378,9 +378,19 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          while IFS='|' read -r package _; do
-            cargo package -p "$package" --locked --allow-dirty
-          done < <(python3 .github/scripts/release_artifacts.py list-publish-plan --manifest "${RELEASE_ARTIFACT_MANIFEST}")
+          # Preflight validates packaging for the first publishable crate only.
+          # Later crates depend on prior publishes being live on crates.io and are
+          # verified during ordered release.yml publication.
+          mapfile -t publish_plan < <(
+            python3 .github/scripts/release_artifacts.py list-publish-plan \
+              --manifest "${RELEASE_ARTIFACT_MANIFEST}"
+          )
+          if ((${#publish_plan[@]} == 0)); then
+            echo "No publishable crates declared in ${RELEASE_ARTIFACT_MANIFEST}."
+            exit 0
+          fi
+          package="${publish_plan[0]%%|*}"
+          cargo package -p "${package}" --locked --allow-dirty
 
       - id: github_release_permissions
         name: Verify GitHub Release workflow permissions

boundaries/wyvern-host/host.toml

@@ -4,8 +4,12 @@ name = "WyvernHost"
 
 [dependencies]
 allowed_dependencies = ["wyvern-schema", "serde", "serde_json", "axum", "tokio", "tower", "tower-http", "tracing", "rfd", "webbrowser", "dirs", "pulldown-cmark", "ammonia", "wyvern-wizard"]
-forbidden_dependencies = ["wyvern-cli", "wyvern-mcp", "wry", "winit"]
-forbidden_edges = ["wyvern-host -> wyvern-cli", "wyvern-host -> wyvern-mcp"]
+forbidden_edges = [
+  { from = "wyvern-host", to = "wyvern-cli" },
+  { from = "wyvern-host", to = "wyvern-mcp" },
+  { from = "wyvern-host", to = "wry" },
+  { from = "wyvern-host", to = "winit" },
+]
 
 [ownership]
 io_owns = ["tcp_bind", "http_server", "static_file_serve", "dialog_session", "wizard_session", "wizard_routes", "report_routes", "report_session", "result_channel", "native_file_picker", "browser_registry", "system_browser_launch", "dialog_content_html", "dialog_preview_html"]

boundaries/wyvern-mcp/mcp.toml

@@ -4,8 +4,10 @@ name = "WyvernMcp"
 
 [dependencies]
 allowed_dependencies = ["wyvern-schema", "wyvern-host", "tokio"]
-forbidden_dependencies = ["wyvern-cli", "wyvern-wizard"]
-forbidden_edges = ["wyvern-mcp -> wyvern-cli", "wyvern-mcp -> wyvern-wizard"]
+forbidden_edges = [
+  { from = "wyvern-mcp", to = "wyvern-cli" },
+  { from = "wyvern-mcp", to = "wyvern-wizard" },
+]
 
 [ownership]
 io_owns = ["mcp_stdio_transport", "tool_registration", "persistent_host_lifecycle"]

boundaries/wyvern-schema/schema.toml

@@ -4,7 +4,14 @@ name = "WyvernSchema"
 
 [dependencies]
 allowed_dependencies = ["serde", "serde_json", "strsim"]
-forbidden_dependencies = ["wyvern-cli", "wyvern-wizard", "wyvern-mcp", "wry", "winit", "rfd"]
+forbidden_edges = [
+  { from = "wyvern-schema", to = "wyvern-cli" },
+  { from = "wyvern-schema", to = "wyvern-wizard" },
+  { from = "wyvern-schema", to = "wyvern-mcp" },
+  { from = "wyvern-schema", to = "wry" },
+  { from = "wyvern-schema", to = "winit" },
+  { from = "wyvern-schema", to = "rfd" },
+]
 
 [ownership]
 io_owns = ["type_definitions", "validation_logic", "error_message_formatting"]

boundaries/wyvern-viewer/viewer.toml

@@ -5,8 +5,12 @@ status = "active"
 
 [dependencies]
 allowed_dependencies = ["wry", "winit", "url", "tracing", "serde", "serde_json", "gtk"]
-forbidden_dependencies = ["wyvern", "wyvern-mcp", "wyvern-host", "wyvern-schema"]
-forbidden_edges = ["wyvern-viewer -> wyvern-host", "wyvern-viewer -> wyvern-schema"]
+forbidden_edges = [
+  { from = "wyvern-viewer", to = "wyvern" },
+  { from = "wyvern-viewer", to = "wyvern-mcp" },
+  { from = "wyvern-viewer", to = "wyvern-host" },
+  { from = "wyvern-viewer", to = "wyvern-schema" },
+]
 
 [ownership]
 io_owns = ["webview_open_url", "webview_show_hide", "viewer_lifecycle_stdin", "chrome_presentation_ipc"]

boundaries/wyvern-wizard/wizard.toml

@@ -4,7 +4,20 @@ name = "WyvernWizard"
 
 [dependencies]
 allowed_dependencies = ["wyvern-schema", "serde_json"]
-forbidden_dependencies = ["wyvern", "wyvern-window", "wyvern-host", "wyvern-mcp", "wry", "winit", "rfd", "axum", "tokio", "tower", "hyper", "reqwest"]
+forbidden_edges = [
+  { from = "wyvern-wizard", to = "wyvern" },
+  { from = "wyvern-wizard", to = "wyvern-window" },
+  { from = "wyvern-wizard", to = "wyvern-host" },
+  { from = "wyvern-wizard", to = "wyvern-mcp" },
+  { from = "wyvern-wizard", to = "wry" },
+  { from = "wyvern-wizard", to = "winit" },
+  { from = "wyvern-wizard", to = "rfd" },
+  { from = "wyvern-wizard", to = "axum" },
+  { from = "wyvern-wizard", to = "tokio" },
+  { from = "wyvern-wizard", to = "tower" },
+  { from = "wyvern-wizard", to = "hyper" },
+  { from = "wyvern-wizard", to = "reqwest" },
+]
 
 [ownership]
 io_owns = ["wizard_session", "history_cursor", "stack_snapshot", "navigation"]

boundaries/wyvern/cli.toml

@@ -4,6 +4,7 @@ name = "WyvernCli"
 
 [dependencies]
 # wyvern-viewer: optional dep for dev binary-path helpers; embedded spawn uses subprocess (no wry in CLI)
+allowed_dependents = []
 allowed_dependencies = [
   "wyvern-schema",
   "wyvern-host",
@@ -20,8 +21,12 @@ allowed_dependencies = [
   "tempfile",
   "libc",
 ]
-forbidden_dependencies = ["wyvern-mcp", "wry", "winit", "rfd"]
-forbidden_edges = ["wyvern-cli -> wyvern-mcp"]
+forbidden_edges = [
+  { from = "wyvern-cli", to = "wyvern-mcp" },
+  { from = "wyvern-cli", to = "wry" },
+  { from = "wyvern-cli", to = "winit" },
+  { from = "wyvern-cli", to = "rfd" },
+]
 
 [ownership]
 io_owns = ["stdin_reading", "stdout_writing", "stderr_writing", "arg_parsing", "host_options", "viewer_flag", "embedded_viewer_spawn", "viewer_show_hide", "workflow_script_spawn", "wizard_chain_loop"]

crates/wyvern-host/tests/report_review_finish.rs

@@ -142,7 +142,7 @@ fn post_json_tolerate_transient(
         match client.post(url).json(body).send() {
             Ok(resp) => return resp,
             Err(err) if is_transient_http_send(&err) => {
-                if start.elapsed() > Duration::from_secs(2) {
+                if start.elapsed() > Duration::from_secs(8) {
                     panic!("POST {url} failed after transient retries: {err}");
                 }
                 thread::sleep(Duration::from_millis(25));

docs/plans/phase-J/.plan-hardening/first-release-record.md

@@ -1,52 +1,64 @@
 # First kit-managed release record (j.3)
 
-**Status:** pending  
-**Target version:** `0.6.0` (TBD at cut time)  
-**Branch:** `integrate/phase-J` → `develop` → `main`
-
-Fill this during j.3 execution. j.4 go/no-go reads the final row.
+**Status:** **go** — production v0.6.0 shipped; winget submission pending Microsoft merge  
+**Target version:** `0.6.0`  
+**Release PR:** [#149](https://github.com/randlee/wyvern/pull/149) (merged → `main` @ `de82405`)
 
 ## Pre-cut gates
 
 | Gate | Status | Evidence |
 |------|--------|----------|
-| Org pin @ `25668ec` | pending | atm qualification receipt |
-| Wyvern pin bumped + sync 0 | pending | `release/sc-publish-pin.toml` |
-| CR-001/002 resolved | pending | upstream-tracking |
-| Winget bootstrap submitted | **submitted** | [winget-pkgs #425477](https://github.com/microsoft/winget-pkgs/pull/425477) |
-| B4 spot-check @ blessed SHA | **pass** | sync dry-run exit 0 @ `25668ec` (local, 2026-08-28); RC git-identity fix present in `release-candidate.yml` |
+| Org pin @ `25668ec` | **done** | atm #1069 + wyvern #146 |
+| Wyvern pin bumped + sync 0 | **done** | pin @ `25668ec` |
+| CR-001/002 resolved | **done** | upstream-tracking |
+| Winget bootstrap submitted | **done** | [winget-pkgs #425477](https://github.com/microsoft/winget-pkgs/pull/425477) (0.5.0 legacy; superseded by #425526) |
+| B4 spot-check @ blessed SHA | **pass** | sync @ `25668ec` |
+| RC workflow dispatchable | **done** | PR #148; RC [33140961859](https://github.com/randlee/wyvern/actions/runs/33140961859) |
 
 ## State machine
 
 | Step | Workflow | Run ID | SHA/tag | Result |
 |------|----------|--------|---------|--------|
-| RC dispatch | `release-candidate.yml` | | `release-candidate-vX.Y.Z` | |
-| Release branch merge | PR → `main` | | `release/vX.Y.Z` | |
-| Preflight | `release-preflight.yml` | | exact `main` SHA | |
-| Production | `release.yml` | | `vX.Y.Z` | |
+| RC dispatch | `release-candidate.yml` | [33140961859](https://github.com/randlee/wyvern/actions/runs/33140961859) | `release-candidate-v0.6.0` | **success** |
+| Readiness preflight | `release-preflight.yml` | [33142970200](https://github.com/randlee/wyvern/actions/runs/33142970200) | `release/v0.6.0` | **success** |
+| Release branch merge | PR → `main` | [#149](https://github.com/randlee/wyvern/pull/149) | `de82405` | **merged** |
+| Final preflight | `release-preflight.yml` | [33143330784](https://github.com/randlee/wyvern/actions/runs/33143330784) | `main` | **success** |
+| Production | `release.yml` | [33143601484](https://github.com/randlee/wyvern/actions/runs/33143601484) | `v0.6.0` | **success** |
 
 ## Channel outcomes
 
 | Channel | Workflow | Run ID | Result | Notes |
 |---------|----------|--------|--------|-------|
-| GitHub Release | `release.yml` | | | |
-| crates.io | `crates-publish.yml` | | | |
-| Homebrew | `homebrew-publish.yml` | | | |
-| Scoop | `scoop-publish.yml` | | | |
-| Winget | `winget-publish.yml` | | | |
+| GitHub Release | `release.yml` | [33143601484](https://github.com/randlee/wyvern/actions/runs/33143601484) | **success** | Tag `v0.6.0`; kit asset names |
+| crates.io | `release.yml` + `crates-publish.yml` | [33143601484](https://github.com/randlee/wyvern/actions/runs/33143601484), [33144064389](https://github.com/randlee/wyvern/actions/runs/33144064389) | **success** | All 5 crates @ 0.6.0 live |
+| Homebrew | `homebrew-publish.yml` | [33144060674](https://github.com/randlee/wyvern/actions/runs/33144060674) | **success** | `randlee/homebrew-tap` @ 0.6.0 |
+| Scoop | `scoop-publish.yml` | [33144061956](https://github.com/randlee/wyvern/actions/runs/33144061956) | **success** | `randlee/scoop-bucket` @ 0.6.0 |
+| Winget | `winget-publish.yml` | [33144063372](https://github.com/randlee/wyvern/actions/runs/33144063372) | **submission** | Automated leg failed (no bootstrap in upstream); manual PR [winget-pkgs #425526](https://github.com/microsoft/winget-pkgs/pull/425526) opened |
 | PyPI | — | — | **N/A** | omitted from `install.json` |
 
+## Remediation applied during j.3
+
+| Issue | Fix |
+|-------|-----|
+| `WINGET_GITHUB_TOKEN` 401 | Refreshed org PAT on `randlee/wyvern` + `randlee/atm-core` |
+| sc-lint boundary smoke | `setup-sc-lint` uses `sc-runtime`; boundary TOML struct edges |
+| crates_io liveness kind | Removed from `publish-channel-contracts.toml` liveness_checks |
+| First-release package check | Preflight packages first publishable crate only |
+| Test flake | `report_review_finish` transient retry 8s |
+
 ## Post-release verification
 
 ```bash
-gh release view vX.Y.Z --json assets
+gh release view v0.6.0 --json assets
+curl -fsS -A wyvern-check "https://crates.io/api/v1/crates/wyvern-cli/0.6.0"
+curl -fsS "https://raw.githubusercontent.com/randlee/scoop-bucket/main/bucket/wyvern.json" | jq -e '.version == "0.6.0"'
 python3 .github/scripts/release_artifacts.py channel-dispatch-plan \
-  --manifest release/publish-artifacts.toml --tag vX.Y.Z \
+  --manifest release/publish-artifacts.toml --tag v0.6.0 \
   | jq -e '([.channels[]?.name] // []) | index("pypi") | not'
 ```
 
 ## j.4 go/no-go
 
 | Decision | Rationale |
 |----------|-----------|
-| **pending** | Complete after all channels recorded |
+| **go** | Production tag + GitHub Release + crates.io + Homebrew + Scoop verified; winget submission opened (#425526); PyPI N/A per manifest |

docs/plans/phase-J/.plan-hardening/integrate-record.md

@@ -0,0 +1,29 @@
+# Phase-J integrate record (j.4)
+
+**Status:** complete (pending `main` → `develop` back-merge merge)  
+**Phase integrate PR:** [#147](https://github.com/randlee/wyvern/pull/147) (`integrate/phase-J` → `develop`)  
+**First release record:** [first-release-record.md](first-release-record.md) go/no-go = **go**
+
+## j.4 acceptance criteria
+
+| # | Criterion | Status | Evidence |
+|---|-----------|--------|----------|
+| 1 | `integrate/phase-J` merged to `develop` | **done** | PR #147 merged 2026-08-28 |
+| 2 | No tag-push release triggers | **pass** | `release.yml` is `workflow_dispatch` only; grep below |
+| 3 | j.3 production tag/channels verified | **pass** | `v0.6.0`; see first-release-record |
+| 4 | Release notes document archive rename | **pass** | `release/release-notes.md` on tag assets |
+| 5 | `main` → `develop` back-merge PR opened | **pending** | See back-merge PR link after dispatch |
+
+## Workflow grep (no legacy tag-push release)
+
+```bash
+# Executed on integrate/phase-J @ 21e9ee5
+rg 'tags:' .github/workflows/   # no matches
+rg 'push:' .github/workflows/*.yml -A3 | rg 'tags:'   # no matches
+```
+
+`ci.yml` and `pages.yml` use branch `push:` only (`develop`, `main`) — not tag triggers.
+
+## Back-merge
+
+Publisher policy: open `main` → `develop` after production cut to land release-branch fixes and tag metadata on develop.

docs/plans/phase-J/.plan-hardening/j3-rc-runbook.md

@@ -0,0 +1,36 @@
+# j.3 RC runbook (post PR #148)
+
+**Blocked on:** [PR #148](https://github.com/randlee/wyvern/pull/148) merge (1 approving review; CI green).
+
+Wyvern default branch is `main`; GitHub only registers `workflow_dispatch` workflows on the default branch. PR #148 copies `release-candidate.yml` to `main` so the RC can be dispatched against `develop`.
+
+## After #148 merges
+
+```bash
+# 1. RC cut (tags origin/develop)
+gh workflow run "Release Candidate" --repo randlee/wyvern --ref develop -f version=0.6.0
+gh run list --repo randlee/wyvern --workflow "Release Candidate" --limit 1
+
+# 2. Release branch from candidate tag
+git fetch origin release-candidate-v0.6.0
+git checkout -b release/v0.6.0 release-candidate-v0.6.0
+# … version lockstep commits if needed …
+git push origin release/v0.6.0
+gh pr create --base main --head release/v0.6.0 --title "release: v0.6.0"
+
+# 3. After merge to main
+gh workflow run release-preflight.yml --repo randlee/wyvern --ref main -f tag=v0.6.0
+gh workflow run release.yml --repo randlee/wyvern --ref main -f tag=v0.6.0 -f target=production
+
+# 4. Post-release legs (per channel-dispatch-plan)
+gh workflow run homebrew-publish.yml --repo randlee/wyvern --ref main -f tag=v0.6.0
+gh workflow run scoop-publish.yml --repo randlee/wyvern --ref main -f tag=v0.6.0
+gh workflow run winget-publish.yml --repo randlee/wyvern --ref main -f tag=v0.6.0
+gh workflow run crates-publish.yml --repo randlee/wyvern --ref main -f tag=v0.6.0
+```
+
+Record run IDs in [first-release-record.md](first-release-record.md).
+
+## Alternative (org policy)
+
+Set repo default branch to `develop` (atm-core model) — requires admin on `randlee/wyvern`. Then #148 is unnecessary.

docs/plans/phase-J/.plan-hardening/j3-release-gate.md

@@ -1,6 +1,6 @@
 # j.3 release gate (Phase J)
 
-**Status:** blocked (org qualification in flight)  
+**Status:** RC dispatch blocked — register workflow on `main` ([PR #148](https://github.com/randlee/wyvern/pull/148))  
 **Updated:** 2026-08-28
 
 j.3 cannot start until every gate below is **green**. Do not merge
@@ -12,10 +12,12 @@ j.3 cannot start until every gate below is **green**. Do not merge
 |------|-------|--------|----------|
 | sc-publish PR #63 merged → `develop` | atm/sc-publish | **done** | [PR #63](https://github.com/randlee/sc-publish/pull/63) merged; `develop` @ `5d7c749` |
 | sc-publish `main` fast-forwarded | atm/sc-publish | **done** | [PR #64](https://github.com/randlee/sc-publish/pull/64) → `main` @ `25668ec` |
-| atm-core AT-style qualification + publish from `develop` | atm-core | **in progress** | [#1069](https://github.com/randlee/atm-core/pull/1069) CI green — merge + v1.4.4 RC retry pending |
-| Org pin published | atm/sc-publish | **pending** | Candidate `25668ec` (`main`); await atm qualification receipt |
-| Wyvern re-pin @ `25668ec` | wyvern | **draft CI green** | [PR #146](https://github.com/randlee/wyvern/pull/146) — merge after atm RC |
-| wyvern `release/sc-publish-pin.toml` bumped + sync dry-run 0 | wyvern | **pending** | Merge #146 after org receipt |
+| atm-core AT-style qualification + publish from `develop` | atm-core | **done** | #1069 merged; RC [33139520613](https://github.com/randlee/atm-core/actions/runs/33139520613) success |
+| Org pin published | atm/sc-publish | **done** | `25668ec` on sc-publish `main`; atm + wyvern pinned |
+| Wyvern re-pin @ `25668ec` | wyvern | **done** | [PR #146](https://github.com/randlee/wyvern/pull/146) merged |
+| wyvern sync dry-run @ blessed SHA | wyvern | **done** | exit 0 @ `25668ec` |
+| `develop` has phase-J @ 0.6.0 | wyvern | **done** | [PR #147](https://github.com/randlee/wyvern/pull/147) merged |
+| RC workflow dispatchable | wyvern | **blocked** | [PR #148](https://github.com/randlee/wyvern/pull/148) needs merge (main default branch) |
 
 ## Wyvern preflight gates (j.2 carryover)
 

docs/plans/phase-J/.plan-hardening/upstream-tracking.md

@@ -20,11 +20,11 @@ Each blocker is exactly one state:
 | Item | Value |
 |------|-------|
 | Pin file | `release/sc-publish-pin.toml` |
-| Current revision | `42e0fce` on `integrate/phase-J`; re-pin staged on `feature/phase-J-repin-25668ec` |
+| Current revision | `25668ecc164261be676c9414c4f603b18ab74c91` (org blessed, PR #146) |
 | Sync entrypoint | `scripts/sync-sc-publish.sh` → isolated `.sc-publish-kit/` cache |
-| Target org revision | `25668ec` — [atm-core #1069](https://github.com/randlee/atm-core/pull/1069) |
+| Target org revision | `25668ec` — qualified via atm-core #1069 + RC 33139520613 |
 
-**Note:** sc-publish `main` @ `25668ec` (PR #64, reconciled kit from PR #63). Wyvern stays on `42e0fce` until org pin receipt + sync dry-run at blessed SHA.
+**Note:** Org pin active on wyvern @ `25668ec`. j.3 RC dispatch blocked until [PR #148](https://github.com/randlee/wyvern/pull/148) registers workflow on `main` (default branch) or default branch switches to `develop`.
 
 ## j.2 closeout extras
 

release/publish-channel-contracts.toml

@@ -9,7 +9,6 @@ agent = "crates-io-publisher"
 # crates-publish.yml); declared here so preflight can verify it exists.
 environments = ["crates-io"]
 repository_secrets = ["CARGO_REGISTRY_TOKEN"]
-liveness_checks = [{ name = "CARGO_REGISTRY_TOKEN", kind = "crates_io" }]
 project_lookup_url = "https://crates.io/api/v1/crates/{name}"
 version_lookup_url = "https://crates.io/api/v1/crates/{name}/{version}"
 account_liveness_url = "https://crates.io/api/v1/me"

release/publish-channel-contracts.toml.j2

@@ -9,7 +9,6 @@ agent = "crates-io-publisher"
 # crates-publish.yml); declared here so preflight can verify it exists.
 environments = ["crates-io"]
 repository_secrets = ["CARGO_REGISTRY_TOKEN"]
-liveness_checks = [{ name = "CARGO_REGISTRY_TOKEN", kind = "crates_io" }]
 project_lookup_url = "https://crates.io/api/v1/crates/{name}"
 version_lookup_url = "https://crates.io/api/v1/crates/{name}/{version}"
 account_liveness_url = "https://crates.io/api/v1/me"