[systemfsoftware-maker]

Summary

Release on main has been red since #247: the derive phase refuses with tag-integrity-mismatch for @systemfsoftware/stryker-js-cli-contract@0.4.0. #247 added three devDependencies (released-stryker-js-cli-contract, released-stryker-js-plugin-interface, yaml) to the published package.json after the v0.4.0 tag, and recorded that with a none intent. The packed tarball no longer matches the integrity the tag records, and with no release intent the planner compares it against the tag and refuses. That also blocks publishing the ignorer minor that #259 merged.

This PR replaces the none intent with a patch intent, so cli-contract releases 0.4.1. The integrity check is untouched: no allowlist, no skip, no re-recorded tag, no workflow edit.

Drift sweep (every publishable package)

Each package tarball from nix build .#workspace-tarballs (the input the derive phase uses), hashed the way the release tool does (sha512 over the .tgz bytes), compared with the integrity in its last tag's annotation. 16 packages: 12 match their tag, 4 drift:

Package	Last tag	Recorded integrity	Current integrity	Files that differ	Release intent
@systemfsoftware/stryker-js	@systemfsoftware/stryker-js@v18.1.0	sha512-1jS8pzkgkhUXVvK8N4QKDEXyZhlEEnPuYXFRAJ7f38rToHq2k8fu0OZsccLSOM8lbVofpReM86RwidNVtrYWSw==	sha512-9BSv++UsO7REpCZEEaDFJaIFBoJ2GhC/nwLLPlx6LlRNserAF8H2shRqWa5gHzcoVreAalfCrMt7Wd56f0wpgg==	README.md, dist/RunEnvironment.service-DGLf1gEn.d.mts, dist/RunEnvironment.service-DKUihCVC.d.mts, dist/index.d.mts …	major (checker-grouped-cell, engine-keyed-verdict-reuse), already on main
@systemfsoftware/stryker-js-cli-contract	@systemfsoftware/stryker-js-cli-contract@v0.4.0	sha512-Al6/xLfkql9rhXDAPkleSD69Q+iqRxyK2+ZlYPmJo21JI8hFApX3abL4h6w1fFhZ+vNF8/9dZbDr1MIQRzjn+w==	sha512-UNI0x1c4CiZifcNf5Fo9iJN55Xm7uGSjAV1Dc1v5IuEY7m+aRrICdZxmEGJktjCQSybLBLS+SkBMnnK2yUSX0g==	package.json	patch, added here (replaces #247's none)
@systemfsoftware/stryker-js-typescript-checker	@systemfsoftware/stryker-js-typescript-checker@v8.3.1	sha512-SM3mFEyj3q3/3CgJs+1WXLBpBtfVKmN4ADLNxVIER57AbIdMAbBr/bU0kVhvJmUcxMEqQYy+8fiA/tgmgOsWdA==	sha512-U0MEDT4OSh5RBHeqcXYokWitRPk9zxUKB2/zJoxvh96bZABxfxZ4zh0OSZX9XBvOZBWQQMK6giglFttUrlQUsQ==	dist/main.mjs, dist/runtime.mjs	patch ×3 (exports-*, extends-legacy-candidate-order), already on main
@systemfsoftware/stryker-ignorer-effect-schema-declarations	@systemfsoftware/stryker-ignorer-effect-schema-declarations@v0.2.1	sha512-5NIzS3PK361vXAevHLPcKrkwze597VbLsrC0utH/6VdWD9Y1/m53z9dpwp1hSe9ZRIJ3HKW7/PKTSXzemn7q3Q==	sha512-cU3elqaIUVBeZNIBUjJ4ZLGUoQX2oy9+3/lPBbBqgz/jHoUh8nOuoN0Z2VQyA0EDWUqu4LoP5VbXq966bdHefw==	README.md, dist/index.d.ts, dist/index.mjs	minor (schema-ignorer-recursion-budget, #259), already on main

The other three drifted packages already have a pending intent of patch or higher on main, so this PR adds no second changeset for them. One would only put a duplicate line in their CHANGELOGs.

How I proved the derive phase passes

I ran the release tool's own plan command locally with the same release-tools build CI uses (pnpm-release-management@b9b4a1d) and the same tarballs:

• on origin/main d2f018db4 it exits 1 with refused: tag-integrity-mismatch, package: @systemfsoftware/stryker-js-cli-contract@0.4.0, recorded: sha512-Al6/…, current: sha512-UNI0…, the same refusal as Release run 38015192958;
• on this head it exits 0 with plan-release: pending_intents=8 this_cycle=0 deferred=0 -> phase=version.

How an agent consumes this

• Signal. A Release plan · derive phase failure reading refused: tag-integrity-mismatch, package: <pkg>@<version>, …, file: <path> means <pkg>'s packed content changed since its tag and no pending changeset releases it.
• Next action. Add a changeset for <pkg> (patch when nothing a consumer imports or runs changes). Never re-record the tag or skip the check.
• Sweep. To find every drifted package at once, hash each tarball from nix build .#workspace-tarballs and compare it with the integrity field in the annotation of <pkg>@v<version> (git cat-file -p <tag>).
• Step summary not added here. The refusal is produced by apps/github-release-management/src/render.ts in systemfsoftware/pnpm-release-management, which this repo uses through the reusable release.yml. A $GITHUB_STEP_SUMMARY block naming the package, its tag and "add a changeset for " has to land in that repo. Doing it from here would mean editing .github/workflows/, which this change must not touch.

Review

Report-only ce-code-review (lite, mode:agent, base origin/main) on 3e64d9c8a: no findings. For the supervisor it recorded the two judgement points above: no duplicate changesets for the three packages that already have intents, and the step summary belongs upstream.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[ryanleecode]

Verified: CI green on 3e64d9c, diff read, no open threads.