instructa · regenrek · Jul 21, 2026 · Jul 21, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -28,13 +28,9 @@ jobs:
       - name: Migration manifest
         run: sh scripts/check-migration-manifest.sh
       - name: Package
-        run: cargo +1.85.0 package --workspace --allow-dirty --no-verify
-      - name: Package content audit
-        run: |
-          package="$(find target/package -maxdepth 1 -name 'model-routing-*.crate' | head -n 1)"
-          test -n "$package"
-          cargo +1.85.0 package --workspace --list --allow-dirty --no-verify > package-files.txt
-          ! grep -E '(^|/)(\.planr|planr\.sqlite|\.env|receipt|secret|credential)' package-files.txt
+        run: cargo +1.85.0 package --package model-routing --allow-dirty --no-verify
+      - name: Assert sole public Cargo inventory
+        run: cargo +1.85.0 run --quiet -p xtask -- release verify --inventory-only
 
   distribution:
     name: npm distribution
@@ -55,3 +51,5 @@ jobs:
         run: cargo +1.85.0 build --bins
       - name: Test npm wrapper
         run: node --test npm/*.test.mjs
+      - name: Audit npm package inventory
+        run: cargo +1.85.0 run --quiet -p xtask -- release verify --inventory-only
diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
@@ -50,47 +50,16 @@ jobs:
           persist-credentials: false
       - name: Install Rust target
         run: rustup target add ${{ matrix.rust_target }}
-      - name: Verify candidate version
-        run: |
-          test "$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n 1)" = "0.2.2"
-          test "$(jq -r .version package.json)" = "0.2.2"
       - name: Build native candidate
-        env:
-          SWITCHLOOM_TARGET: ${{ matrix.target }}
-          SWITCHLOOM_CARGO_TARGET: ${{ matrix.rust_target }}
-        run: scripts/build-release.sh
-      - name: Stage npm native binary
-        run: |
-          mkdir -p "npm/native/${{ matrix.target }}"
-          install -m 755 "target/${{ matrix.rust_target }}/release/model-routing" \
-            "npm/native/${{ matrix.target }}/model-routing"
-      - name: Verify native version on matching runner
-        run: |
-          test "$(./target/${{ matrix.rust_target }}/release/model-routing --version)" = "model-routing 0.2.2"
-      - name: Write native provenance
-        env:
-          TARGET: ${{ matrix.target }}
-          RUST_TARGET: ${{ matrix.rust_target }}
-          RUNNER_NAME: ${{ matrix.runner }}
         run: |
-          mkdir -p "native-provenance/$TARGET"
-          sha="$(shasum -a 256 "npm/native/$TARGET/model-routing" | awk '{print $1}')"
-          version="$(./target/$RUST_TARGET/release/model-routing --version)"
-          git_sha="$(git rev-parse HEAD)"
-          built_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-          jq -n \
-            --arg target "$TARGET" \
-            --arg rust_target "$RUST_TARGET" \
-            --arg runner "$RUNNER_NAME" \
-            --arg path "npm/native/$TARGET/model-routing" \
-            --arg version "$version" \
-            --arg sha256 "$sha" \
-            --arg git_sha "$git_sha" \
-            --arg built_at "$built_at" \
-            '{target:$target,rust_target:$rust_target,runner:$runner,path:$path,version:$version,sha256:$sha256,git_sha:$git_sha,built_at:$built_at}' \
-            > "native-provenance/$TARGET/provenance.json"
-          printf '%s  npm/native/%s/model-routing\n' "$sha" "$TARGET" \
-            > "native-provenance/$TARGET/SHA256SUMS"
+          cargo run --quiet -p xtask -- release package \
+            --target "${{ matrix.target }}" \
+            --cargo-target "${{ matrix.rust_target }}" \
+            --stage-npm \
+            --provenance-dir native-provenance \
+            --runner "${{ matrix.runner }}" \
+            --git-sha "$(git rev-parse HEAD)" \
+            --built-at github-actions-release-candidate
       - name: Upload native candidate
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
@@ -125,22 +94,19 @@ jobs:
           path: rc-artifacts
       - name: Stage native candidates and provenance
         run: |
-          mkdir -p npm/native provenance-parts
+          mkdir -p npm/native
           for target in darwin-arm64 darwin-x86_64 linux-arm64 linux-x86_64; do
             mkdir -p "npm/native/$target"
             install -m 755 "rc-artifacts/switchloom-native-$target/npm/native/$target/model-routing" \
               "npm/native/$target/model-routing"
-            cp "rc-artifacts/switchloom-native-$target/native-provenance/$target/provenance.json" \
-              "provenance-parts/$target.json"
           done
-          git_sha="$(git rev-parse HEAD)"
-          jq -s \
-            --arg package_version "$(jq -r .version package.json)" \
-            --arg git_sha "$git_sha" \
-            '{schema_version:"switchloom.native_provenance.v1",package_version:$package_version,git_sha:$git_sha,generated_by:"github-actions-release-candidate",targets:.}' \
-            provenance-parts/*.json > npm/native/provenance.json
+          cargo run --quiet -p xtask -- release package \
+            --assemble-provenance \
+            --git-sha "$(git rev-parse HEAD)" \
+            --built-at github-actions-release-candidate \
+            --generated-by github-actions-release-candidate
       - name: Validate native provenance and npm package
-        run: bash scripts/npm-pack-check.sh
+        run: cargo run --quiet -p xtask -- release verify --inventory-only --require-provenance
       - name: Upload package provenance
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -25,12 +25,7 @@ jobs:
       - name: Verify release contract
         env:
           TAG: ${{ github.ref_name }}
-        run: |
-          crate_version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n 1)"
-          package_version="$(jq -r .version package.json)"
-          test "v$crate_version" = "$TAG"
-          test "$package_version" = "$crate_version"
-          grep -q "^## \[$crate_version\]" CHANGELOG.md
+        run: cargo run --quiet -p xtask -- release verify --contract-only --expected-tag "$TAG"
       - name: Create draft release
         env:
           GH_TOKEN: ${{ github.token }}
@@ -75,10 +70,10 @@ jobs:
       - name: Install Rust target
         run: rustup target add ${{ matrix.rust_target }}
       - name: Build release archive
-        env:
-          SWITCHLOOM_TARGET: ${{ matrix.target }}
-          SWITCHLOOM_CARGO_TARGET: ${{ matrix.rust_target }}
-        run: scripts/build-release.sh
+        run: |
+          cargo run --quiet -p xtask -- release package \
+            --target "${{ matrix.target }}" \
+            --cargo-target "${{ matrix.rust_target }}"
       - name: Smoke-test native binary
         if: matrix.target != 'darwin-x86_64'
         run: ./target/${{ matrix.rust_target }}/release/model-routing --version
@@ -99,6 +94,10 @@ jobs:
     permissions:
       contents: write
     steps:
+      - name: Checkout
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
       - name: Download release archives
         env:
           GH_TOKEN: ${{ github.token }}
@@ -110,10 +109,7 @@ jobs:
             --pattern 'switchloom-*.tar.gz' \
             --dir assets
       - name: Generate aggregate checksums
-        run: |
-          cd assets
-          sha256sum switchloom-*.tar.gz > SHA256SUMS
-          cat SHA256SUMS
+        run: cargo run --quiet -p xtask -- release package --aggregate-checksums-dir assets
       - name: Publish release
         env:
           GH_TOKEN: ${{ github.token }}
@@ -163,38 +159,18 @@ jobs:
         run: |
           version="${TAG#v}"
           for target in darwin-arm64 darwin-x86_64 linux-arm64 linux-x86_64; do
-            case "$target" in
-              darwin-arm64) rust_target="aarch64-apple-darwin"; runner="macos-14" ;;
-              darwin-x86_64) rust_target="x86_64-apple-darwin"; runner="macos-14" ;;
-              linux-arm64) rust_target="aarch64-unknown-linux-gnu"; runner="ubuntu-24.04-arm" ;;
-              linux-x86_64) rust_target="x86_64-unknown-linux-gnu"; runner="ubuntu-24.04" ;;
-            esac
             mkdir -p "extract/$target" "npm/native/$target"
             tar -xzf "assets/switchloom-$target.tar.gz" -C "extract/$target"
             install -m 755 "extract/$target/model-routing" "npm/native/$target/model-routing"
-            sha="$(shasum -a 256 "npm/native/$target/model-routing" | awk '{print $1}')"
-            version_output="$(if [ "$target" = "linux-x86_64" ]; then "./npm/native/$target/model-routing" --version; else printf 'model-routing %s' "$version"; fi)"
-            jq -n \
-              --arg target "$target" \
-              --arg path "npm/native/$target/model-routing" \
-              --arg version "$version_output" \
-              --arg sha256 "$sha" \
-              --arg rust_target "$rust_target" \
-              --arg runner "$runner" \
-              --arg git_sha "$(git rev-parse HEAD)" \
-              --arg built_at "release-$TAG" \
-              '{target:$target,rust_target:$rust_target,runner:$runner,path:$path,version:$version,sha256:$sha256,git_sha:$git_sha,built_at:$built_at}' \
-              > "assets/$target.native-provenance.json"
           done
-          jq -s \
-            --arg package_version "$version" \
-            --arg git_sha "$(git rev-parse HEAD)" \
-            '{schema_version:"switchloom.native_provenance.v1",package_version:$package_version,git_sha:$git_sha,generated_by:"github-actions-release",targets:.}' \
-            assets/*.native-provenance.json > npm/native/provenance.json
-          node scripts/validate-native-provenance.mjs
+          cargo run --quiet -p xtask -- release package \
+            --assemble-provenance \
+            --git-sha "$(git rev-parse HEAD)" \
+            --built-at "release-$TAG" \
+            --generated-by github-actions-release
           test "$(./npm/native/linux-x86_64/model-routing --version)" = "model-routing $version"
           SWITCHLOOM_NATIVE_BIN="$PWD/npm/native/linux-x86_64/model-routing" node npm/bin/model-routing.js --version
-          bash scripts/npm-pack-check.sh
+          cargo run --quiet -p xtask -- release verify --inventory-only --require-provenance
       - name: Publish npm package
         env:
           TAG: ${{ github.ref_name }}

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 All notable changes to Switchloom are recorded here.
 
+## [0.3.0] - 2026-07-21
+
+- Hard-cut maintainer-only live verification, catalog, registry, probe, and
+  evaluation commands from the public CLI.
+- Kept one owner for each internal operation: release catalog work in `xtask`,
+  and deterministic evaluation plus registry signing in the Rust library.
+- Made `doctor` the actionable public host availability/version check and
+  aligned README, migration, package, and website guidance with the v0.3.0
+  lifecycle.
+
 ## [0.2.2] - 2026-07-21
 
 - Prepared a superseding release candidate for Codex V2 primary routing and

diff --git a/Cargo.lock b/Cargo.lock