probe (will close)

.env.example

@@ -43,7 +43,7 @@ APO_PUBLIC_URL=
 # e.g. 262144 pages ~= 1 GiB. Writes fail once the cap is hit.
 #APO_MAX_DB_PAGES=0
 
-# --- Task Run Deliverables / Artifacts (SPEC-140) ---
+# --- Task Run Deliverables / Artifacts ---
 #
 # Deliverable metadata stays in the database; large JSON bodies and file
 # Artifacts go through an ArtifactStore. The default `local` backend writes

.github/workflows/ci.yml

@@ -20,28 +20,39 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - name: Build @apo/sdk
+      - name: Build @apo-ai/sdk
         # The SDK's exports map points external consumers at dist/. Internal dev
         # routes back to src/ via the `development` condition, but the build must
         # still succeed for any external/publish path. This catches build breakage
         # on every PR — previously no CI step built the SDK, which is how the
         # broken `build: tsc` script survived unnoticed.
-        run: pnpm --filter @apo/sdk build
-      - name: Verify SDK dist entry points
-        # Belt-and-suspenders: assert each declared exports target actually
-        # exists on disk after the build.
-        run: |
-          for f in index.js index.d.ts otel/index.js otel/index.d.ts \
-                   agent-task/public.js agent-task/public.d.ts \
-                   agent-task/integrations/ai-sdk.js agent-task/integrations/ai-sdk.d.ts \
-                   agent-task/integrations/openai.js agent-task/integrations/openai.d.ts \
-                   agent-task/integrations/anthropic.js agent-task/integrations/anthropic.d.ts; do
-            test -f "packages/sdk/dist/$f" || { echo "MISSING dist/$f"; exit 1; }
-          done
-          echo "All SDK dist entry points present."
+        run: pnpm --filter @apo-ai/sdk build
+      - name: Clean consumer package gate (SDK)
+        # The single source of truth for the publish boundary: pack the SDK
+        # exactly as a registry release would, install it into a clean
+        # directory, import/compile every entry point, and run publint.
+        run: pnpm --filter @apo-ai/sdk package:check
+      - name: Build @apo-ai/cli
+        run: pnpm --filter @apo-ai/cli build
+      - name: Test @apo-ai/cli
+        # No job ran the CLI's unit suite, so guards on resolution and entry
+        # behaviour could only fail on a user's machine. Same selection the
+        # publish workflow uses (excludes the long connect scene test).
+        run: pnpm --filter @apo-ai/cli test:unit
+      - name: Clean consumer package gate (CLI)
+        run: pnpm --filter @apo-ai/cli package:check
       - run: pnpm lint
       - run: pnpm typecheck
+      - name: Test dashboard
+        run: pnpm --filter dashboard test
+      - name: Build docs + publication gate
+        # Builds the Astro site, publishes versioned schemas, and verifies the
+        # publication invariants (no retired origin, every start.md link
+        # resolves, Copy Prompt uses the live origin, schema $ids map).
+        run: pnpm --filter docs build
       - run: pnpm test:public-ingress
+      - name: Public docs deployment contract
+        run: pnpm test:public-docs
 
   backend:
     name: Typecheck + Test (Backend)

.github/workflows/publish-cli.yml

@@ -0,0 +1,99 @@
+name: Publish CLI
+
+# Releases the @apo-ai/cli npm package. Parallel to publish-sdk.yml but
+# triggered by `cli-v*` tags and using the `npm-cli-release` environment.
+# Authentication is OIDC trusted publishing only — no stored npm token.
+# Requires a separate trusted-publisher registration on the npm side for
+# @apo-ai/cli (per-package, not per-org).
+
+on:
+  push:
+    tags:
+      - "cli-v*"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish @apo-ai/cli
+    runs-on: ubuntu-latest
+    environment: npm-cli-release
+    defaults:
+      run:
+        working-directory: packages/cli
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.3.0
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          registry-url: https://registry.npmjs.org/
+
+      - name: Install npm (trusted-publishing-aware)
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        working-directory: .
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify tag matches package version
+        run: |
+          set -euo pipefail
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          TAG_VERSION="${GITHUB_REF#refs/tags/cli-v}"
+          echo "package version: $PKG_VERSION"
+          echo "tag version:     $TAG_VERSION"
+          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::Tag cli-v$TAG_VERSION does not match packages/cli/package.json version $PKG_VERSION"
+            exit 1
+          fi
+
+      - name: CLI tests
+        run: pnpm --filter @apo-ai/cli test:unit
+
+      - name: CLI typecheck
+        run: pnpm --filter @apo-ai/cli typecheck
+
+      - name: Clean consumer package gate
+        run: pnpm --filter @apo-ai/cli package:check
+
+      - name: Build release tarball
+        working-directory: .
+        run: |
+          set -euo pipefail
+          rm -rf release
+          mkdir -p release
+          pnpm --filter @apo-ai/cli pack --pack-destination ./release
+          TARBALL_PATH="$(realpath release/*.tgz)"
+          echo "TARBALL_PATH=$TARBALL_PATH" >> "$GITHUB_ENV"
+          echo "Packed $TARBALL_PATH"
+
+      - name: Publish to npm (OIDC, no token)
+        env:
+          TARBALL: ${{ env.TARBALL_PATH }}
+        run: |
+          set -euo pipefail
+          npm publish --access public --provenance "$TARBALL"
+
+      - name: Report publication
+        if: success()
+        working-directory: .
+        run: |
+          PKG_VERSION=$(node -p "require('./packages/cli/package.json').version")
+          {
+            echo "## @apo-ai/cli published"
+            echo ""
+            echo "- **Package**: [\`@apo-ai/cli@${PKG_VERSION}\`](https://www.npmjs.com/package/@apo-ai/cli/v/${PKG_VERSION})"
+            echo "- **Tag**: \`$GITHUB_REF_NAME\`"
+            echo "- **Tarball**: \`${TARBALL_PATH}\`"
+            echo "- **Auth**: GitHub OIDC trusted publishing (no npm token secret)"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/publish-sdk.yml

@@ -0,0 +1,115 @@
+name: Publish SDK
+
+# Releases the @apo-ai/sdk npm package. Decoupled from the Docker release
+# workflow (.github/workflows/release.yml, triggered by `v*` tags): SDK
+# versions follow their own cadence under `sdk-v*` tags.
+#
+# Authentication is OIDC trusted publishing only — no long-lived npm
+# credential is stored as a GitHub secret. The trusted publisher
+# (repo `samikuikka/apo`, workflow `publish-sdk.yml`, environment
+# `npm-sdk-release`) must be configured once on the npm side by a
+# maintainer with publishing rights to the `apo` scope.
+
+on:
+  push:
+    tags:
+      - "sdk-v*"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish @apo-ai/sdk
+    runs-on: ubuntu-latest
+    environment: npm-sdk-release
+    defaults:
+      run:
+        working-directory: packages/sdk
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.3.0
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          registry-url: https://registry.npmjs.org/
+
+      - name: Install npm (trusted-publishing-aware)
+        # npm >=11.5.1 understands the OIDC exchange used by trusted publishing.
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        working-directory: .
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify tag matches package version
+        # The Git tag must be exactly `sdk-v<packages/sdk/package.json version>`.
+        # Any mismatch is a hard stop — we never publish a tarball whose
+        # reported version disagrees with the immutable tag.
+        run: |
+          set -euo pipefail
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          TAG_VERSION="${GITHUB_REF#refs/tags/sdk-v}"
+          echo "package version: $PKG_VERSION"
+          echo "tag version:     $TAG_VERSION"
+          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::Tag sdk-v$TAG_VERSION does not match packages/sdk/package.json version $PKG_VERSION"
+            exit 1
+          fi
+
+      - name: SDK tests
+        run: pnpm --filter @apo-ai/sdk test
+
+      - name: SDK typecheck
+        run: pnpm --filter @apo-ai/sdk typecheck
+
+      - name: Clean consumer package gate
+        run: pnpm --filter @apo-ai/sdk package:check
+
+      - name: Build release tarball
+        # `pnpm pack` is the only correct artifact source — it applies the
+        # publishConfig rewrite (strips `development` conditions, locks the
+        # six dist-only exports). We pack into a fresh dir to guarantee no
+        # stale local tarball is reused. Do NOT capture pnpm's stdout into
+        # $GITHUB_ENV — it carries ANSI color codes that the file command
+        # rejects. Resolve the tarball path from disk instead.
+        working-directory: .
+        run: |
+          set -euo pipefail
+          rm -rf release
+          mkdir -p release
+          pnpm --filter @apo-ai/sdk pack --pack-destination ./release
+          TARBALL_PATH="$(realpath release/*.tgz)"
+          echo "TARBALL_PATH=$TARBALL_PATH" >> "$GITHUB_ENV"
+          echo "Packed $TARBALL_PATH"
+
+      - name: Publish to npm (OIDC, no token)
+        # Trusted publishing exchanges the GitHub OIDC JWT for short-lived
+        # npm credentials. There is no NODE_AUTH_TOKEN and no NPM_TOKEN.
+        env:
+          TARBALL: ${{ env.TARBALL_PATH }}
+        run: |
+          set -euo pipefail
+          npm publish --access public --provenance "$TARBALL"
+
+      - name: Report publication
+        if: success()
+        working-directory: .
+        run: |
+          PKG_VERSION=$(node -p "require('./packages/sdk/package.json').version")
+          {
+            echo "## @apo-ai/sdk published"
+            echo ""
+            echo "- **Package**: [\`@apo-ai/sdk@${PKG_VERSION}\`](https://www.npmjs.com/package/@apo-ai/sdk/v/${PKG_VERSION})"
+            echo "- **Tag**: \`$GITHUB_REF_NAME\`"
+            echo "- **Tarball**: \`${TARBALL_PATH}\`"
+            echo "- **Auth**: GitHub OIDC trusted publishing (no \`NPM_TOKEN\` secret)"
+          } >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -79,6 +79,7 @@ CLAUDE.md
 /.codex/
 /.opencode/
 /.ncode/
+/.zcode/
 /.agent-state/
 /.personal/
 /wayfinder/