[JacobStephens2]

Summary

thirdshift can now be published to crates.io, and every release tag publishes it.

 [package]
+license = "MIT"
 repository = "https://github.com/JacobStephens2/thirdshift"
+include = ["/src", "/skills", "/README.md", "/LICENSE"]

The new dist publish job runs after host. host only runs once the Rocky and WSL smoke jobs have passed:

 plan → build-local-artifacts → custom-release-smoke (rocky, wsl)
   → host (GitHub Release)
+    → custom-publish-crates
+        check           crates.io has $VERSION? 200 → skip, 404 → publish, other → fail
+        publish-crates  OIDC → crates-io-auth-action → cargo publish --locked
   → announce → custom-release-notes

release.yml was regenerated with dist generate from publish-jobs = ["./publish-crates"] in dist-workspace.toml.

Setup needed on crates.io after 0.1.0 is published by hand: add a trusted publisher for JacobStephens2/thirdshift with workflow release.yml, not publish-crates.yml. crates.io matches the OIDC workflow_ref claim, which is the workflow that started the run, not the reusable one it calls.

Evidence

• Before: cargo test --test packaging fails:
  .agents/skills/ask-matt/PHASE-BOUNDARIES.md is in the package
  After: both packaging tests pass:

  package_leaves_out_the_repository_tooling               no .agents/.grok/.claude/docs/tests paths
  package_carries_the_factory_skills_with_their_license_and_credits
                                                          skills/LICENSE, skills/pr/CREDITS.md, src, README, LICENSE
  

• cargo package packs 36 files and builds the verify step from them.
• dist generate --check is clean. The only CARGO_REGISTRY_TOKEN in the repository is the short-lived output of crates-io-auth-action, and no secret is referenced.
• The full suite is green apart from ci::waits_for_github_to_work_out_whether_the_pr_is_mergeable, which failed intermittently (1 of 3 runs) under load. This branch changes no src code, so it's a pre-existing timing flake.

Merge Danger

Door: two-way. Publishing to crates.io itself is one-way, since versions can only be yanked, but merging this doesn't publish anything. That only happens on the next release tag, and only after the trusted publisher is set up.

Blast Radius: releases

If the crates.io publish fails, the GitHub Release is already out, but dist skips announce and the release notes. That is dist's standard gating. Prerelease tags are not published to crates.io (dist's default).

Unaddressed findings

Standards

• The packaging test lists the excluded directories that the include list already leaves out (duplication): skipped. The issue's acceptance criteria name exactly these paths, so the test pins them explicitly.

Spec

• tests/packaging.rs was not asked for (scope creep): kept. It checks two acceptance criteria automatically and takes about 0.1s.
• announce now waits on the publish job: skipped. This is dist-generated behaviour, and release.yml must not be hand-edited.
• Prereleases skip crates.io, which isn't literally "every release": skipped. This is dist's default, and publishing release candidates to crates.io isn't wanted.
• cargo package warns that it is ignoring test targets: skipped. This is cosmetic, and autotests = false would turn off the repository's own tests.
• The publish job's checkout relies on the repository being public: skipped. dist grants the job only id-token/packages, and the workflow comment records the assumption.
• The smoke gate regex doesn't match publish-crates.yml: skipped. The publish job never runs on pull requests, so running the smoke jobs on them would test nothing new.

Closes #35

🤖 Generated with Claude Code