alkstore/tasks/release-publish-prep.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
release-publish-prep	Publish prep — package verification, exclusion check, publish records	pending	release-readme release-flake-investigation	moderate	medium	project	implementation	wave-8 publish

Description

The plan's wave-8 "publish prep": everything short of the manual cargo publish itself (CI and publishing are manual per the plan's decided points — self-hosted Gitea, supply-chain posture; the actual publish is the user's action, post-gate).

1. Package metadata audit: the four published crates currently carry only version/edition/license/repository — description is missing on all four (crates.io requires it). Land honest descriptions per crate; decide the remaining optional fields (keywords, categories, homepage/docs — the family's published crates are the precedent to check) and record the decisions.
2. cargo package verification per published crate (alkstore, alkstore-sqlite, alkstore-postgres, alkstore-mem): each packages clean (no warnings that block, .crate contents inspected), builds + tests from the packaged source (cargo package --no-verify off — let it verify, or verify manually per crate and record which).
3. The publish-exclusion verification (parked from wave 7 — tasks/review-wave-7.md item 4(iii)): the mechanism (exclude = ["fuzz"] on the root workspace) landed; this is the verification that no published package leaks the sidecar — inspect each .crate's file list: no fuzz/ paths, no alkstore-fuzz-shared references, no grown corpora/artifacts. Also verify alkstore-contract-suite (publish = false) and the fuzz sidecar are absent from any package.
4. Path-dep + version records: the engines' alkstore = { version = "0.1", path = … } shape is publish-legal (version bound present) — verify each path dep carries its version bound; record the publish order (core first, then engines — ADR-017 §4.1's pairing) and the version decision (0.1.0 as contract v1's initial release, per ADR-017's semver-is-the-contract discipline) in the task Notes as the publish checklist of record.
5. Substrate packaging check (ADR-013/018): alkstore-sqlite's package includes the in-tree substrate — verify PROVENANCE.md and the dual-license notice ride in the .crate, and the package is honest about carrying them.
6. The publish checklist of record: a Notes section listing the exact manual commands in order (per crate: package → publish), including the dry-run evidence, so the user's publish session is mechanical.

Acceptance Criteria

• description landed on all four published crates; optional metadata decisions recorded
• cargo package clean per published crate (verification posture recorded); .crate contents inspected
• Publish-exclusion verification recorded: no fuzz/sidecar/ contract-suite paths in any package's file list
• Path-dep version bounds verified; publish order + version decision recorded
• Substrate PROVENANCE + license notice confirmed in the alkstore-sqlite package
• The manual publish checklist of record written (commands in order, evidence attached)
• Workspace gates + the fuzz corpus-replay gate green at session end

References

• docs/plans/implementation.md §Wave 8, §Decided points (CI/publishing manual)
• tasks/review-wave-7.md (the parked exclusion verification, item 4)
• docs/architecture/decisions/017-contract-versioning.md §4.1 (the version pin + pairing)
• docs/architecture/decisions/013-fold-substrate-into-sqlite.md + docs/architecture/decisions/018-provenance-register-and-cherry-picks.md (the in-tree substrate's packaging posture)
• docs/architecture/decisions/022-contract-suite-layout.md (the suite is not published)

Notes

To be filled by implementation agent

Summary

To be filled on completion