# Releases are built once from a frozen dependency graph

- Status: Accepted
- Date: 2026-08-15

The pnpm 11 lockfile and exact release toolchain versions are committed, CI/release installs use `--frozen-lockfile`, and two isolated `git archive HEAD` source/build/pack rounds must produce the same tarball SHA-256; one compared artifact is forwarded unchanged to release. Compatibility is verified from the packed tarball in isolated consumers, including exact Node 22.19.0 and 24.19.0, Windows and Ubuntu 24.04, the minimum published DSH peer generation, and the committed latest-tested DSH generation within the declared peer range, and the exact parsed DSH package closure recorded by that generation. A scheduled rolling canary resolves the full compatible peer range without changing historical release evidence. The packed delegation test uses the real DSH Agent loop and in-process subagent provider with a scripted credential-free LLM.

A release tag must equal `v<package.json version>` and match a dated CHANGELOG heading. The tag workflow creates one npm tarball, sends that exact artifact through the minimum/latest-tested packed compatibility matrix, records the resolved DSH versions and tarball digest, and publishes only after the reusable quality gates pass. It then derives an SPDX SBOM from the unpacked tarball, a SHA-256 checksum manifest, and GitHub build attestation from that immutable artifact. The workflow creates or updates a draft GitHub Release with the complete evidence set before npm publication, skips an already-published identical npm version during recovery, and makes the GitHub Release public only after npm succeeds. Repository contents are read-only in normal CI; only the tag release job receives `contents: write`, `id-token: write`, and `attestations: write`. npm authentication uses Trusted Publishing exclusively, so the workflow carries no long-lived registry token.