---
id: release-publish-prep
name: Publish prep — package verification, exclusion check, publish records
status: pending
depends_on: [release-readme, release-flake-investigation]
scope: moderate
risk: medium
impact: project
level: implementation
tags: [wave-8, publish]
---

## Description

The plan's wave-8 "publish prep": everything short of the manual
`cargo publish` itself (CI and publishing are manual per the plan's
decided points — self-hosted Gitea, supply-chain posture; the actual
publish is the user's action, post-gate).

1. **Package metadata audit**: the four published crates currently
   carry only version/edition/license/repository — `description` is
   missing on all four (crates.io requires it). Land honest
   descriptions per crate; decide the remaining optional fields
   (`keywords`, `categories`, `homepage`/`docs` — the family's
   published crates are the precedent to check) and record the
   decisions.
2. **`cargo package` verification per published crate** (`alkstore`,
   `alkstore-sqlite`, `alkstore-postgres`, `alkstore-mem`): each
   packages clean (no warnings that block, `.crate` contents
   inspected), builds + tests from the packaged source
   (`cargo package --no-verify` off — let it verify, or verify
   manually per crate and record which).
3. **The publish-exclusion verification** (parked from wave 7 —
   `tasks/review-wave-7.md` item 4(iii)): the mechanism
   (`exclude = ["fuzz"]` on the root workspace) landed; this is the
   verification that **no published package leaks the sidecar** —
   inspect each `.crate`'s file list: no `fuzz/` paths, no
   `alkstore-fuzz-shared` references, no grown corpora/artifacts.
   Also verify `alkstore-contract-suite` (`publish = false`) and the
   fuzz sidecar are absent from any package.
4. **Path-dep + version records**: the engines' `alkstore = { version
   = "0.1", path = … }` shape is publish-legal (version bound present)
   — verify each path dep carries its version bound; record the
   publish order (core first, then engines — ADR-017 §4.1's pairing)
   and the version decision (0.1.0 as contract v1's initial release,
   per ADR-017's semver-is-the-contract discipline) in the task Notes
   as the publish checklist of record.
5. **Substrate packaging check** (ADR-013/018): `alkstore-sqlite`'s
   package includes the in-tree substrate — verify `PROVENANCE.md` and
   the dual-license notice ride in the `.crate`, and the package is
   honest about carrying them.
6. **The publish checklist of record**: a Notes section listing the
   exact manual commands in order (per crate: package → publish),
   including the dry-run evidence, so the user's publish session is
   mechanical.

## Acceptance Criteria

- [ ] `description` landed on all four published crates; optional
      metadata decisions recorded
- [ ] `cargo package` clean per published crate (verification posture
      recorded); `.crate` contents inspected
- [ ] Publish-exclusion verification recorded: no fuzz/sidecar/
      contract-suite paths in any package's file list
- [ ] Path-dep version bounds verified; publish order + version
      decision recorded
- [ ] Substrate PROVENANCE + license notice confirmed in the
      `alkstore-sqlite` package
- [ ] The manual publish checklist of record written (commands in
      order, evidence attached)
- [ ] Workspace gates + the fuzz corpus-replay gate green at session
      end

## References

- docs/plans/implementation.md §Wave 8, §Decided points (CI/publishing
  manual)
- tasks/review-wave-7.md (the parked exclusion verification, item 4)
- docs/architecture/decisions/017-contract-versioning.md §4.1 (the
  version pin + pairing)
- docs/architecture/decisions/013-fold-substrate-into-sqlite.md +
  docs/architecture/decisions/018-provenance-register-and-cherry-picks.md
  (the in-tree substrate's packaging posture)
- docs/architecture/decisions/022-contract-suite-layout.md (the suite
  is not published)

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion