Coral

Appearance

How to release and recover Coral ​

Use immutable candidate inputs, publish the package prefix in order, and deploy the exact retained Pages artifact; final execution belongs to Slice 80.

  1. Freeze one candidate version and one full 40-character commit, and run npm run verify on that exact checkout.

    The candidate is clean, every Coral manifest has the same version, and the complete local verification chain passes.

  2. Start the package publication workflow with the exact inputs. Its release-guard.mjs step checks the clean checkout, workflow SHA, requested version, and atomic manifests before release-registry.mjs preflight inspects public registry state.

    Preflight emits a start-index for one valid contiguous published prefix.

  3. Publish from that index in this fixed order: @coral-viz/language, @coral-viz/render, @coral-viz/viz, @coral-viz/mcp-server, then tree-sitter-coral. Finish with release-registry.mjs verify.

    Every package resolves from the registry with the candidate identity, integrity, provenance or approved private-repository digest, runtime import, type, native, and audit checks intact.

  4. If publication stops, rerun the workflow with the same version and commit. Preflight verifies the existing prefix and resumes at its start-index; a gap, mismatched artifact, or different source fails closed.

    Already verified packages are not republished, and recovery continues only from the first missing package.

  5. Start the Pages workflow with the same immutable inputs. It runs the guard, builds before deploy, verifies the combined static output, and uploads the site, ZIP, checksum, and Pages payload as retained 90-day artifacts. The registry job must verify all five packages before the deploy job can write.

    The deployed bytes come from the one verified build for that workflow run.

  6. If Pages deployment fails after upload, rerun only the deploy job while its retained artifact is available. Do not rerun upload merely to recover the deployment.

    Recovery deploys the same already-built Pages payload without creating a duplicate artifact name.

  7. Record the package and Pages results as candidate evidence for Slice 80.

    No 0.2.5 publication, deployment, platform, performance, or release-closure claim is final until Slice 80 verifies it.

Result ​

One source identity has an ordered, resumable package publication and an exact build-before-deploy Pages path with recoverable retained artifacts.