alkblobs/tasks/publish-prep.md

id, name, status, depends_on, scope, risk, impact, level

id	name	status	depends_on	scope	risk	impact	level
publish-prep	Manifest audit and cargo package verification	completed	changelog-and-readme	narrow	low	project	implementation

Description

The publish-prep manifest audit (the operator's "make sure the cargo exclude, and just config in general, makes sense"). Known deltas at decomposition (2026-10-16), found by comparing the family manifests:

• exclude is missing fuzz/ — the sidecar workspace lives in the repo root; cargo package would ship it. The family set (alksocks, the closest single-crate shape): .opencode/, AGENTS.md, docs/reviews/, docs/research/, docs/plans/, tasks/, docs/sdd_process.md, fuzz/. alkblobs has all but fuzz/.
• readme = "README.md" is absent — alkcall/alktty/alksocks all carry it; alkblobs' README lands via changelog-and-readme, then this field wires it.

Then the general config audit:

• cargo package (or cargo package --allow-dirty --no-verify for speed, then the real one): inspect the packaged file list — LICENSE-APACHE/LICENSE-MIT present, README + CHANGELOG included, no .opencode/, tasks/, docs/reviews|research|plans/, fuzz/, or stray junk; size sane.
• cargo publish --dry-run --allow-dirty green (the AGENTS verification block's release gate).
• Dependency bounds: no path dependencies (alkcall is version = "0.9" from the registry — verify the bound matches the published 0.9 line and the APIs used); optional deps' bounds sane; rust-version = "1.88" still honest (check nothing landed needing newer).
• Metadata: description/keywords/categories still accurate for the shipped surface; the [workspace] exclude = ["fuzz"] and the fuzz sidecar's own manifest don't leak into the package.
• The packaged crate builds standalone: cargo package's verification covers this (it builds the packaged copy).

Publishing itself stays manual per the family posture (CI: none, deliberately) — this task preps; the operator publishes.

Acceptance Criteria

• exclude carries the full family set including fuzz/
• readme = "README.md" wired
• cargo package file list audited: licenses + README + CHANGELOG in; internal dirs out; size sane (the list recorded in Notes)
• cargo publish --dry-run --allow-dirty green
• Dependency bounds reviewed: no path deps; alkcall bound matches the published line; rust-version honest
• Metadata (description/keywords/categories) accurate for the shipped surface

References

• /workspace/@alkdev/alksocks/Cargo.toml (the exclude-set precedent)
• /workspace/@alkdev/alkcall/Cargo.toml (the readme-field precedent)
• AGENTS.md (the verification block's cargo publish --dry-run gate; the family CI posture in the plan's decided points)

Notes

• Both known deltas landed in one line each: readme = "README.md" and fuzz/ appended to the exclude list (the family set now matches alksocks' exactly).
• cargo package --allow-dirty --no-verify file list (the audited package, 92 files, 2.4MiB / 597.2KiB compressed): Cargo.toml(-orig) + Cargo.lock + the packed .cargo_vcs_info.json; LICENSE-APACHE and LICENSE-MIT; README.md + CHANGELOG.md; src/ (all 31 modules) and tests/ (conformance incl. its README, git_interop, readme_examples); docs/architecture/ (README, the six topic specs, open-questions, all 17 ADRs) and tests/conformance/README.md. Nothing excluded leaked: no .opencode/, tasks/, AGENTS.md, docs/sdd_process.md, docs/reviews|research|plans/, fuzz/, target/, or .gitignore-adjacent junk. docs/architecture/ ships deliberately (family posture; only reviews/research/plans are excluded).
• cargo publish --dry-run --allow-dirty green — the verify leg built the packaged copy standalone.
• Dependency bounds: alkcall resolves from the registry (lock: 0.9.0, source crates.io) and the upstream manifest sits at 0.9.0 — the version = "0.9" bound matches the published 0.9 line, and the compiled API surface proves itself against registry 0.9.0 every build. One note recorded rather than acted on: alksocks pins "0.9.0" (the deliberate-bump sibling rule) while alkblobs carries "0.9"; the semver-bound form is the pre-existing shape here and resolves identically today. No path deps anywhere. Optional deps (rusqlite 0.40 bundled, tokio-postgres 0.7 / deadpool-postgres 0.14, alkcall 0.9, serde 1 / serde_json 1, getrandom 0.4) bounds sane.
• rust-version honesty: cargo +1.88 check --all-targets --all-features green — with one caveat that is lockfile drift, not crate code: the local Cargo.lock (gitignored) had resolved uuid to 1.28.0, which declares rustc 1.89 (transitive via alkcall). Temporarily pinning uuid to a 1.88-compatible version (1.26.0 works) made the full 1.88 check clean, so nothing alkblobs' code or its direct bounds need newer than 1.88; a real 1.88 consumer's MSRV-aware resolver picks the compatible transitive automatically. Local lock restored to latest uuid afterwards.
• Metadata reviewed in place: the description (content-addressed multi-hash store, pluggable backends, transport- and protocol-agnostic), keywords (blobs, content-addressed, storage, git, gix), and categories (asynchronous, filesystem, database) still describe the shipped surface — the five engines land inside filesystem + database, the async facade inside asynchronous. No change needed.
• Verification block (full): cargo test 209 (default features); cargo test --all-features 328 + the 125-test pg conformance column, both against the live harness; both clippy configurations -D warnings clean; cargo fmt --check clean; the fuzz corpus-replay gate 7/7. One flake note: the first --all-features run had 1 failed / 327 passed (unrelated cadence shape, not reproducible — the immediate re-run and a third run were fully green, matching the recorded load-flake posture in AGENTS.md's run-discipline).

Summary

The wave-12 publish-prep manifest audit landed: readme = "README.md" wired and fuzz/ added to the exclude list (the manifest now matches the family set exactly), the packaged file list audited clean (licenses + README + CHANGELOG in, all internal dirs out, 92 files / 2.4MiB), cargo publish --dry-run --allow-dirty green, dependency bounds reviewed (registry alkcall 0.9.0; no path deps; rust-version 1.88 proven honest against the real 1.88 toolchain), and metadata confirmed accurate for the shipped surface. Publishing itself stays manual per the family posture — the crate is publish-ready.