Release the AgentRun beta

The destination is Parcha-ai/agentrun. The standalone candidate lives on codex/open-source-beta, with clean DSL-only ancestry. The repository is currently private and also contains harness branches/history. Do not make it public while that private history remains. Preparing or pushing this candidate does not remove those refs or authorize destructive cleanup.

Packages are not published. Code licensing and asset reuse terms remain pending; package manifests deliberately remain UNLICENSED. The native Pi extension remains a design preview; the Pi SDK, CLI and authoring skill are implemented.

Set the release identity

Confirm source rights, the approved license, copyright holder, artwork terms, maintainers and control of the @agentrun npm scope. Add the full approved root LICENSE, required NOTICE, and copies in all three package directories. Their manifests must declare the same approved license as the root workspace. A dependency inventory records metadata; it does not grant redistribution rights.

Repository, issue-tracker and homepage fields now point to the intended destination. Confirm AgentRun.ai control before connecting the website. Set up private vulnerability reporting before the repository becomes public, and replace the pending route in SECURITY.md with the working channel.

A release owner must complete the DSL-only repository/history cleanup explicitly. Retain any private harness work in its private source repository. Merely changing the default branch would still expose other refs and history.

Verify the candidate

Use the Linux release toolchain: Node 22.23.2 and GNU tar. The ordinary package build and examples need Node/npm only.

npm ci --ignore-scripts
npm run check
npm run build:site
npm run check:site
node scripts/check-generated.mjs
npm run verify:packages

The package verifier installs exact tarballs into an empty consumer, checks runtime and TypeScript use, and records their hashes in .release/verification.json. The source export audits its allowlisted files and excludes private plans, local configuration, credentials and hosting-account metadata. Review both artifacts after final changes. Record live adapter evidence separately from offline tests; see configured research.

The advertised Node and TypeScript floors are covered separately by the CI matrix and node scripts/check-typescript-floor.mjs. Generated docs and traces must be committed. Do not weaken a check to publish stale artifacts.

Configure npm publication

Create/control the package scope and configure the release owners. The manual release.yml workflow uses npm trusted publishing on GitHub-hosted runners, npm 11.5.1, OIDC, provenance and the npm-release environment. Configure that environment's allowed tags and maintainer review, plus each package's trusted-publisher association with this repository and workflow. Initial package registration/bootstrap follows npm's current account flow; the workflow does not create accounts or grant ownership.

Ordinary pushes, PRs and tags never publish. The publication job runs only for this repository after it is public. Select an existing reviewed beta tag, for example v0.1.0-beta.1, whose version matches every package. At that exact committed tag:

node scripts/release-preflight.mjs --tag v0.1.0-beta.1

The preflight refuses pending/missing licensing, mismatched metadata, dirty or differently tagged source, unverified archives, or changed package contents. A passing development check is not permission to publish.

Dispatch Publish verified beta with the workflow ref set to that exact tag and the tag input set to the same value. The dispatch ref, GitHub event SHA and checked-out source must match; this binds npm provenance to the released commit. It rebuilds/checks, publishes the exact verified archives in DSL → Jev → Pi order with public access and the beta tag, then verifies registry integrity and a fresh installed consumer. Keep the resulting evidence. If publication stops partway, rerun from the same reviewed tag. The workflow verifies an existing version against the expected archive before skipping it and continuing with missing packages. A byte mismatch stops the release; never replace a published version with different bytes.

Official references: npm trusted publishing, provenance, scoped public packages.

Finish the public handoff

After publication succeeds, update candidate notices and clone/source links to the public default branch. Test exact-version npm installation and examples outside this workspace. Publish the reviewed website only after asset rights and domain setup are complete, then check public access, downloads/checksums, links, keyboard/mobile use and reduced motion.

The beta provides Node/ESM workflow execution, optional adapters and tools for authoring, inspection and evaluation. Model quality, external delivery and durable recovery remain separate contracts. Follow host integration; matching document v: 2 does not imply identical host capabilities.