release: promote stage to main for v0.0.16 (production Track B layout fix)

.github/workflows/build-binaries.yml

@@ -265,18 +265,30 @@ jobs:
           go version
           git --version
 
+      - name: Align the production checkout with the accepted stage revision
+        if: env.ROLE_MODEL_BUILD_CHANNEL == 'production'
+        shell: bash
+        env:
+          ACCEPTED_STAGE_SHA: ${{ steps.stage_candidate.outputs.stage_sha }}
+        run: |
+          # The stable gate proves the tagged tree and the accepted candidate tree are the same
+          # tree, so the production package may be assembled from either checkout - and it must be
+          # assembled from the candidate's own layout. The private distribution embeds the relative
+          # path of the public sources it was built against, and assembling it from
+          # .cache/paired-public made the production pair differ from the tested candidate by that
+          # label alone (measured while releasing v0.0.16: "../paired-public/packages/..." against
+          # the candidate's "../../packages/...").
+          if [[ ! "$ACCEPTED_STAGE_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Accepted stage revision is not an exact commit."
+            exit 1
+          fi
+          candidate_tag="stage-rc-${ACCEPTED_STAGE_SHA:0:12}"
+          git fetch --no-tags origin "refs/tags/${candidate_tag}:refs/tags/${candidate_tag}"
+          git checkout --detach "$ACCEPTED_STAGE_SHA"
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      # Production Track B is deliberately built against the immutable public
-      # Stage checkout, not the main checkout.  Install its workspace links
-      # separately so esbuild can resolve the public runtime packages without
-      # changing the Stage-source provenance binding.
-      - name: Install exact accepted stage public dependencies
-        if: env.ROLE_MODEL_BUILD_CHANNEL == 'production'
-        working-directory: .cache/paired-public
-        run: corepack pnpm install --frozen-lockfile
-
       - name: Build UI
         run: pnpm --filter @role-model-router/runtime-ui run build
 
@@ -287,7 +299,6 @@ jobs:
       # can be assembled.
       - name: Build public runtime adapter dependencies
         if: env.ROLE_MODEL_BUILD_CHANNEL == 'stage' || env.ROLE_MODEL_BUILD_CHANNEL == 'production'
-        working-directory: ${{ env.ROLE_MODEL_BUILD_CHANNEL == 'production' && '.cache/paired-public' || '.' }}
         run: corepack pnpm --filter @role-model-router/profile-aggregator... build
 
       - name: Validate exact private release revision
@@ -337,7 +348,7 @@ jobs:
         if: env.ROLE_MODEL_BUILD_CHANNEL == 'stage' || env.ROLE_MODEL_BUILD_CHANNEL == 'production'
         working-directory: .cache/paired-private
         env:
-          ROLE_MODEL_PUBLIC_WORKTREE: ${{ env.ROLE_MODEL_BUILD_CHANNEL == 'production' && format('{0}/.cache/paired-public', github.workspace) || github.workspace }}
+          ROLE_MODEL_PUBLIC_WORKTREE: ${{ github.workspace }}
           NODE_OPTIONS: --conditions=runtime
         run: |
           corepack pnpm install --frozen-lockfile

scripts/build-binaries-workflow.test.mjs

@@ -95,22 +95,25 @@ test("production rebuilds Track B against the accepted stage public commit", ()
   assert.match(workflow, /Checkout exact accepted stage public revision/);
   assert.match(workflow, /ref:\s*\$\{\{ steps\.stage_candidate\.outputs\.stage_sha \}\}/);
   assert.match(workflow, /path:\s*\.cache\/paired-public/);
-  assert.match(
-    workflow,
-    /ROLE_MODEL_PUBLIC_WORKTREE:[\s\S]*?ROLE_MODEL_BUILD_CHANNEL == 'production'[\s\S]*?\.cache\/paired-public/,
-  );
+  /**
+   * Measured while releasing v0.0.16: assembling Track B from a second checkout at
+   * `.cache/paired-public` made the private bundle embed "../paired-public/packages/..." where the
+   * tested candidate embedded "../../packages/...", so the production pair check rejected a package
+   * whose only real difference was that build-layout label. Production now runs from the accepted
+   * candidate's own checkout (the gate already proves the tagged tree is that same tree), and the
+   * private distribution is built against the workspace.
+   */
+  assert.match(workflow, /Align the production checkout with the accepted stage revision/);
+  assert.match(workflow, /git checkout --detach "\$ACCEPTED_STAGE_SHA"/);
+  assert.match(workflow, /ROLE_MODEL_PUBLIC_WORKTREE:\s*\$\{\{ github\.workspace \}\}/);
 });
 
-test("production installs dependencies in the accepted stage checkout before Track B bundling", () => {
-  assert.match(workflow, /Install exact accepted stage public dependencies/);
-  assert.match(
-    workflow,
-    /Install exact accepted stage public dependencies[\s\S]*?working-directory:\s*\.cache\/paired-public[\s\S]*?corepack pnpm install --frozen-lockfile/,
-  );
+test("production installs the accepted stage checkout before Track B bundling", () => {
   assert.match(
     workflow,
-    /Install exact accepted stage public dependencies[\s\S]*?if: env\.ROLE_MODEL_BUILD_CHANNEL == 'production'/,
+    /Align the production checkout with the accepted stage revision[\s\S]*?Install dependencies[\s\S]*?pnpm install --frozen-lockfile/,
   );
+  assert.doesNotMatch(workflow, /Install exact accepted stage public dependencies/);
 });
 
 test("paired Track B packaging builds public runtime dependencies before bundling source imports", () => {

scripts/run88-stage-release-workflow.test.mjs

@@ -50,6 +50,14 @@ test("production packaging rebuilds and verifies the complete tested stage pair"
   );
   assert.match(binaries, /ROLE_MODEL_TRACK_B_DISTRIBUTION_ROOT:[\s\S]*?production/);
   assert.match(binaries, /Verify complete production pair matches the tested stage candidate/);
+  /**
+   * Measured while releasing v0.0.16: the production job assembled Track B from .cache/paired-public,
+   * so the bundle embedded "../paired-public/packages/..." where the candidate embedded
+   * "../../packages/...". The pair check then rejected a package whose only real difference was that
+   * build-layout label, so the production checkout must be the accepted candidate's own layout.
+   */
+  assert.match(binaries, /Align the production checkout with the accepted stage revision/);
+  assert.match(binaries, /ROLE_MODEL_PUBLIC_WORKTREE: \$\{\{ github\.workspace \}\}/);
   assert.match(binaries, /validateRun88ProductionPromotion|--verify-production-manifest/);
   assert.doesNotMatch(binaries, /Verify production core matches the tested stage candidate/);
 });