[dskvr]

What changes

release.yml now runs on every push to main. Its first job runs scripts/check-unpublished.mjs, which asks npm and JSR for each public package's version; the validate, npm and JSR jobs run only when a registry is missing one. Merging the Version Packages PR is what makes a version missing, so merging it is the release. A v* tag or a manual run still publishes without asking.

• A registry that cannot be asked fails the first job; an outage never reads as "nothing to publish".
• A last job asks the registries again after both publishers succeed and fails if a version is still missing.
• The npm job writes .npmrc itself: a token line when NPM_TOKEN is set, none otherwise so npm uses trusted publishing. setup-node's registry-url wrote a token line even with the secret absent, after which npm never tried OIDC.
• pnpm check:unpublished is the local answer to "what would a release publish now". Today it lists all 8 versions (4 npm, 4 JSR).
• D-034, AGENTS.md and the publish how-to are updated, including the order of steps for the first npm publish.

What happens on merge

The first push to main after this merges will see 8 unpublished versions and run the release:

• JSR publishes all four packages through OIDC; the packages exist in the kernl scope and are linked to this repository.
• npm fails unless NPM_TOKEN is set, because trusted publishing cannot carry a package's first version. Set the secret before merging (gh secret set NPM_TOKEN) or after, and the next push to main (or gh workflow run release.yml --ref main) finishes the job. Then configure the trusted publisher on each package and delete the secret.

Verified

• scripts/check-unpublished.test.mjs covers the lookups, the missing-version rows and the GITHUB_OUTPUT verdict.
• pnpm check green (slop 100).
• The script run against the live registries lists the 8 pending versions.

🤖 Generated with Claude Code