registry clean-room acceptance is failing

[github-actions]

Clean-room acceptance against the public registries failed.

REGISTRY CLEAN-ROOM FAILED: 5 check(s)
  - @wave-av/cli@1.0.8 npm-provenance-attested
  - @wave-av/cli@1.0.8 bin-version-matches-package
  - @wave-av/cli@1.0.8 declared-dep-ranges-pinned
  - wave-sdk@2.0.0 py-import-module
  - wave-sdk@2.0.0 py-no-stdlib-shadow

Run: https://github.com/wave-av/sdks/actions/runs/33957230252
Event: schedule

The published artifacts do not satisfy ART-001 / SUPPLY-001 / VER-001. A green source branch does not certify these — the registry is what customers install.

[yakimoto]

Itemised, with buckets and per-artifact ownership, so this issue does not have to carry the whole backlog:

• @wave-av/cli@1.0.8 fails 3 registry clean-room checks (no provenance, version lie, floating first-party range) — needs a republish #85 — @wave-av/cli@1.0.8: npm-provenance-attested, bin-version-matches-package, declared-dep-ranges-pinned. All three root causes already fixed on wave-av/cli main; blocked on an operator-gated republish.
• wave-sdk@2.0.0 on PyPI is unimportable (top-level wave shadows the stdlib) — fixed in wave-av/sdk-python source, needs a publish #86 — wave-sdk@2.0.0 (PyPI): py-import-module, py-no-stdlib-shadow. Fixed on wave-av/sdk-python main as 2.1.0; blocked on a publish. PyPI refuses re-upload, so 2.0.0 can never be repaired in place.
• Arm cleanroom as a required status check — it fails honestly now but still cannot block a merge, and nothing tracks the arming step #87 — cleanroom is still not a REQUIRED status check on main, and the GA-READINESS.md "Arming window" ledger it keys on is stale.

This run answers a question that was open since #79

#79 merged 2026-09-04T18:25:54Z on a cleanroom check that reported SUCCESS while its own log ended REGISTRY CLEAN-ROOM FAILED: 8 check(s) (run 33825962290, evidence artifact retained). Those 8 defects went onto main. Status today, from this run — a schedule trigger against main itself at revision 6fe7c01, not a PR merge ref:

#	Artifact	Check	On main today
1	@wave-av/cli@1.0.8	npm-provenance-attested	still failing
2	@wave-av/cli@1.0.8	bin-version-matches-package	still failing
3	@wave-av/cli@1.0.8	declared-dep-ranges-pinned	still failing
4	@wave-av/mcp-server	mcp-serverinfo-version-matches-package	cleared — 0.2.1 reports 0.2.1
5	wave-sdk@2.0.0	py-import-module	still failing
6	wave-sdk@2.0.0	py-no-stdlib-shadow	still failing
7	wave-av-sdk	py-import-module	cleared — 3.0.0 published 2026-09-05T03:17:38Z
8	wave-av-sdk	py-no-stdlib-shadow	cleared

3 of 8 cleared, 5 outstanding, and every one of the 5 is a genuine defect in a published artifact — bucket (a), the gate being right. None is a gate defect and none was introduced by a recent PR: the identical failing set reproduces on origin/main in a clean worktree, on this scheduled run, and on unrelated Renovate branches (33933317710, 33933289317).

This issue can close when #85 and #86 are published and a run here is green. #87 tracks arming the check so a future red can actually block.

[github-actions]

Clean-room acceptance against the public registries failed.

REGISTRY CLEAN-ROOM FAILED: 2 check(s)
  - wave-av-sdk@2.0.0 py-import-module
  - wave-av-sdk@2.0.0 py-no-stdlib-shadow

Run: https://github.com/wave-av/sdks/actions/runs/34104995449
Event: schedule

The published artifacts do not satisfy ART-001 / SUPPLY-001 / VER-001. A green source branch does not certify these — the registry is what customers install.

[github-actions]

Clean-room acceptance against the public registries failed.

REGISTRY CLEAN-ROOM FAILED: 5 check(s)
  - @wave-av/sdk@2.1.3 sbom-presence
  - @wave-av/cli@1.0.10 sbom-presence
  - @wave-av/mcp-server@0.3.0 sbom-presence
  - @wave-av/adk@1.0.15 sbom-presence
  - wave-sdk@2.2.0 sbom-presence

Run: https://github.com/wave-av/sdks/actions/runs/34256343373
Event: workflow_dispatch

The published artifacts do not satisfy ART-001 / SUPPLY-001 / VER-001. A green source branch does not certify these — the registry is what customers install.

[github-actions]

Clean-room acceptance against the public registries failed.

REGISTRY CLEAN-ROOM FAILED: 4 check(s)
  - @wave-av/sdk@2.1.3 sbom-presence
  - @wave-av/cli@1.0.10 sbom-presence
  - @wave-av/mcp-server@0.3.0 sbom-presence
  - @wave-av/adk@1.0.15 sbom-presence

Run: https://github.com/wave-av/sdks/actions/runs/34258507516
Event: workflow_dispatch

The published artifacts do not satisfy ART-001 / SUPPLY-001 / VER-001. A green source branch does not certify these — the registry is what customers install.

[github-actions]

Clean-room acceptance against the public registries failed.

REGISTRY CLEAN-ROOM FAILED: 1 check(s)
  - @wave-av/adk@1.0.15 sbom-presence

Run: https://github.com/wave-av/sdks/actions/runs/34260607209
Event: workflow_dispatch

The published artifacts do not satisfy ART-001 / SUPPLY-001 / VER-001. A green source branch does not certify these — the registry is what customers install.