Package distribution blocker: publish and independently verify the canonical JavaScript package

[aruintelligence]

Distribution blocker

ĀML cannot honestly claim mainstream package adoption while the canonical package is only represented by repository metadata and GitHub releases.

The stable package metadata currently identifies aml-core v1.3.0, but repository documentation deliberately tells external React users to clone/vendor the repository until a registry package is independently verified as published.

Definition of done

1. confirm the intended canonical registry package name and ownership;
2. publish through an approved provenance-aware release path;
3. verify the registry artifact can be installed from a clean environment;
4. compare the installed package metadata/content against the intended release/tag;
5. run the public test/reproduction path from the installed artifact where applicable;
6. publish the registry URL and integrity/provenance evidence;
7. only then replace clone/vendor guidance with npm install ... instructions.

Integrity rule

Do not publish merely to obtain a package URL. Package distribution must not bypass the repository's stable/preview release boundary or silently label v1.4 preview architecture as stable v1.3.

If aml-core is unavailable, ambiguous, or controlled by someone else in the target registry, stop and choose a collision-resistant scoped package identity rather than implying ownership.

Why this is blocking

The repository already has browser-native entry points and GitHub Actions, but a clean mainstream JavaScript install path is still a real adoption gap. This issue stays open until an outside developer can install the canonical artifact without cloning this repository and the published artifact has been independently checked.

Created by Daniel Jacob Read IV. Steward: ĀRU Intelligence Inc.™.

[aruintelligence]

Distribution progress — verified 2026-09-08/09

The package-distribution boundary has materially advanced:

• PR Harden npm package release with installable artifact verification #60 merged a protected npm publish workflow and installable-package audit.
• PR Probe live npm identity during package artifact CI #61 merged a live npm identity probe.
• The live npm registry returned 404 for aml-core, reported by CI as unpublished_or_available. This does not reserve the name or prove account ownership, but no repository collision was detected.
• PR Publish audited npm tarballs as downloadable CI artifacts #63 merged downloadable audited npm tarballs as GitHub Actions artifacts.
• I downloaded the actual PR Publish audited npm tarballs as downloadable CI artifacts #63 Actions artifact and independently recomputed its tarball SHA-256.

Verified artifact contents:

• aml-core-1.3.0.tgz
• aml-npm-artifact.json
• aml-core-1.3.0.tgz.sha256

Verified tarball SHA-256:

daa4925dadf2173f23944538b037253d2329723eab26cf8086e663cd1bc666db

The computed hash, manifest hash, and .sha256 sidecar matched exactly. The package audit also clean-installed the tarball into a temporary consumer project, imported aml-core, ran the installed aml CLI against real source, and ran the installed aml-meaning CLI.

Remaining blocker

This issue should remain open. The package has not been published to npm yet. The remaining threshold is intentional registry publication through the protected exact-tag workflow, followed by a clean install from the registry and independent verification of the published artifact/provenance.

Do not replace clone/vendor guidance with npm install aml-core until that final registry verification succeeds.

[aruintelligence]

Status update — package distribution boundary is now technically ready but not yet published.

Completed and merged:

• live npm registry probe confirms aml-core currently returns 404 / unpublished-or-available;
• installable tarball audit proves clean consumer install, package import, aml CLI validation, and aml-meaning execution;
• stable-package rehearsal now checks out immutable v1.3.0, applies only deterministic npm distribution metadata (repository, homepage, bugs), proves no other package metadata changed, packs it, clean-installs it, probes npm identity, and records tarball integrity/shasum;
• protected npm publication workflow is manual-only, rejects identity collisions and republishing, requires NPM_TOKEN + npm whoami, publishes with provenance, and verifies the exact version/repository metadata after publication.

Merged control-plane commits:

• package artifact gate: a20ff918b045cd14f6b8e0cc34fb862f69b6edc7
• live npm identity probe: 75fb054723fc1b965991543dc021638c18b0f62f
• stable-tag publication control plane: 1d40f592b2077917bf6172be1b217ff1b0147188

Remaining blocker: an intentional manual dispatch of Publish AML npm Package with a valid npm publishing credential in the npm-production environment. This issue remains open until the registry confirms aml-core@1.3.0 is publicly installable and the post-publish verification passes.

No package-publication claim should be made before that registry verification succeeds.

[aruintelligence]

Launch state — September 9, 2026

The canonical stable npm publication path is now concrete.

Current protected workflow:

.github/workflows/publish-npm-package.yml

It is manual-only and:

1. reads the canonical stable version/tag from the project contract;
2. requires package version == stable version;
3. requires exact confirmation text PUBLISH STABLE AML;
4. checks out the immutable stable tag rather than publishing preview main as stable;
5. overlays only repository/homepage/bugs distribution metadata;
6. rejects obvious secret/private-key paths;
7. clean-installs and smoke-tests the packed stable artifact;
8. refuses an npm identity collision or an existing same version;
9. requires NPM_TOKEN from the protected npm-production environment and runs npm whoami;
10. publishes with npm publish --access public --provenance --tag latest;
11. verifies the expected version and canonical repository metadata from the live registry after publication.

A repository Actions audit currently returns zero workflow_dispatch runs, so this publisher has never yet been attempted.

Remaining launch action

Confirm/configure the NPM_TOKEN credential in the npm-production environment and manually dispatch Publish AML npm Package with:

PUBLISH STABLE AML

This connector cannot dispatch workflows or inspect GitHub secrets, so I am not claiming publication or credential readiness.

Keep this issue open after a successful publish until the registry artifact is clean-installed and independently verified from outside the canonical repository, as required by the original definition of done.