fix(release): publish Nexus independently

.github/workflows/pages.yml

@@ -20,12 +20,16 @@ jobs:
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.3.14
+      - name: Install inert verifier dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
       - name: Download the exact low-privilege build
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: marketplace-release-${{ github.sha }}
           path: dist
       - name: Reverify and stage strict catalogs
+        env:
+          CONVAX_MARKETPLACE_CHANGED: dist/release-plan.json
         run: |
           bun tooling/verify-marketplace-output.mjs dist/catalog
           bun tooling/verify-product-lock-input.mjs dist/product-lock-input.json

.github/workflows/release-on-main.yml

@@ -34,12 +34,17 @@ jobs:
         env:
           BASE_SHA: ${{ github.event.before }}
         run: |
-          bun tooling/marketplace-release.mjs \
-            --base "$BASE_SHA" \
-            --head "$GITHUB_SHA" \
-            --output dist/release-plan.json
-          echo "count=$(jq length dist/release-plan.json)" >> "$GITHUB_OUTPUT"
+          set -euo pipefail
+          mkdir -p dist/production
+          export PATH="$PWD/node_modules/.bin:$PATH"
+          convax-marketplace changed . --base "$BASE_SHA" > dist/release-plan.json
+          count="$(jq length dist/release-plan.json)"
+          echo "count=$count" >> "$GITHUB_OUTPUT"
           echo "CONVAX_MARKETPLACE_CHANGED=dist/release-plan.json" >> "$GITHUB_ENV"
+          if [ "$count" != "0" ]; then
+            git show "$BASE_SHA:marketplace.json" > dist/production/trusted-marketplace.json
+            echo "CONVAX_MARKETPLACE_TRUSTED_DESCRIPTOR=dist/production/trusted-marketplace.json" >> "$GITHUB_ENV"
+          fi
       - name: Fetch the current production sequence input
         if: steps.plan.outputs.count != '0'
         run: bun tooling/fetch-marketplace-previous.mjs

docs/packaging.md

@@ -173,9 +173,16 @@ disable a compromised version for new installs, publish a reviewed higher packag
 version with `yanked: true`. Existing immutable assets remain available for
 inventory, recovery, and audit.
 
-The serialized workflow fetches and strictly validates the current production v2
-Registry as an explicit sequence input. The one-time bootstrap accepts strict v1
-only after an exact v2 HTTP 404 and inherits only its sequence high-water mark.
+The serialized workflow takes one bounded snapshot of the production descriptor,
+Registry v2, Showcase v2, Registry v1, and Showcase v1 endpoints. A steady-state
+release requires all five endpoints to return strict matching documents. The one-time
+legacy bootstrap requires the exact `404/404/404/200/200` state and binds the current
+descriptor to the previous protected `main` revision. It losslessly lifts the v1
+Plugin and Skill entries and proves the v1 projection round-trips before replacing
+only explicitly selected identities. Unselected production entries remain
+byte-for-byte canonical metadata; source-only or source-ahead packages wait for
+their own versioned publication. Every other status matrix fails closed, including
+an all-404 response from an already deployed Official Marketplace.
 Every other network or validation failure stops publication. The Kit then writes
 one grouped directory per immutable package Release plus one content-addressed
 Registry metadata Release. A changed Storyboard source also publishes the matching

package.json

@@ -7,7 +7,8 @@
     "acorn": "8.17.0"
   },
   "devDependencies": {
-    "@convax/marketplace-kit": "0.1.0"
+    "@convax/marketplace": "0.1.1",
+    "@convax/marketplace-kit": "0.1.1"
   },
   "packageManager": "bun@1.3.14",
   "workspaces": [

packages/plugins/nexus-service/convax-package.json

@@ -4,7 +4,7 @@
   "id": "nexus-service",
   "name": "Nexus · OpenRouter",
   "description": "Connects Convax to the Convax Workspace in Nexus for OpenRouter chat and live image-model generation through short-lived Data Tokens.",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "license": "MIT",
   "compatibility": {
     "pluginSchema": "convax.plugin/7",

packages/plugins/nexus-service/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microvoid/convax-plugin-nexus-service",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "private": true,
   "type": "module",
   "dependencies": {

packages/plugins/nexus-service/package/manifest.json

@@ -3,7 +3,7 @@
   "id": "nexus-service",
   "name": "Nexus · OpenRouter",
   "description": "Connects Convax to the Convax Workspace in Nexus for OpenRouter chat and live image-model generation through short-lived Data Tokens.",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "contributes": {
     "generation": {
       "models": [