plan: execute 2026-05-31-publish trusted-publishing release prep

[MMerryweather]

Plan Completion

• Completed plan: .agents/plans/2026-05-31-publish.md
• Current location in workspace: .agents/plans/done/2026-05-31-publish.md
• Note: .agents/ is gitignored in this repo, so plan-file move is reflected in workspace state but not tracked in git history.

Why This Plan Next

• It was the only active plan under .agents/plans (excluding .agents/plans/done) and unblocked first trusted-publishing release readiness for v1.0.0.

Implementation Summary

• Hardened publish workflow with:
  • pypi GitHub environment gate on publish job
  • release tag/version guard (v<pyproject version>) before build
• Updated release process docs to match trusted-publishing/OIDC flow.
• Ran full local release gate and refreshed release evidence.
• Restored missing benchmark fixture set needed for deterministic gate runs.
• Added benchmark manifest SHA256 integrity test.

Commit / Phase Summary

1. 6b0b2e6 — WP1-WP3: publish workflow hardening + release docs alignment.
2. 3c67ca7 — WP4-WP6: release-gate evidence refresh + benchmark fixture restore.
3. 86118db — review remediation: benchmark fixture integrity test.

Local Validation Commands And Results

• python -m pip install --upgrade pip — PASS
• python -m pip install -e ".[dev,examples,sklearn]" — PASS
• ruff check . — PASS
• mypy src tests — PASS
• pytest -m "not external_data" -v — PASS (823 passed, 3 deselected, 2 xfailed)
• python -m build — PASS
• twine check dist/* — PASS
• pytest tests/test_semver_contract.py -v — PASS
• pytest tests/test_public_api_docs_contract.py -v — PASS
• pytest tests/test_sklearn_adapter.py -v — PASS
• python examples/08_sklearn_adapter.py — PASS
• pytest -q tests/test_release_gate_benchmark_harness.py — PASS

CI Check Status

• Required checks: pending on this PR at creation time.
• Merge gate: wait for .github/workflows/ci.yml required checks to turn green.

Independent Review Lanes (gpt-5.3-codex medium)

• Lane A (019e7d11-2aa8-7811-a97e-8e495942597b): clean (no actionable findings).
• Lane B (019e7d12-1fae-7163-b73e-06c579c15e04): clean (no actionable findings).
• Lane C (019e7d12-1f81-73f0-94c3-b7da99b707e6): clean (no actionable findings).

Known Risks

• Workflow behavior is fully confirmed only after real GitHub Release execution and pypi environment approval.
• Benchmark fixture integrity is hash-verified; semantic provenance remains process-governed.

Retrospective

• Initial review rejection: benchmark fixture additions lacked explicit integrity coverage and were flagged as scope-risk.
• Mitigation: added manifest-to-file SHA256 enforcement test; reran fresh independent review lanes.
• Protocol outcome: review evidence is reset after fix batches; no stale lane reuse.

Next-Run Protocol Updates

• Keep constrained sequential mode when quota/thread visibility is unavailable.
• Force a “scope rationale + validation” patch immediately when review flags non-code asset additions.
• Always reset all review lanes after any fix batch; prior outputs are stale.

Reusable Rules Applied / Added

• Enforced: native multi_agent_v1 delegation only; no CLI-wrapper fallback.
• Enforced: sequential lane execution under unknown capacity.
• Added this run: explicit fixture-integrity test requirement when adding benchmark assets in release-path work.