[kreneskyp]

PLAT-1012. Publishes @agent-ix/quire-cli through agent-ix/nodejs-actions/publish-native-npm@main (with static-musl: "true", nodejs-actions#13) and deletes the bespoke duplicate.

Deleted

• npm/ (launcher bin/quire.js, package.json, README, .gitignore)
• quire-dist: package-npm, verify-published, set-version, verify-release, quire-dist-probe, tests distribution.rs, npm_host.rs, policy.rs (kept: verify-binary, with a small new test); deps serde_json/toml_edit dropped
• Makefile: dist-verify, dist-package, dist-verify-published, set-version
• README "Local publish to npm.ix" section (it depended entirely on the deleted commands)
• Spec: FR-023, FR-024, NFR-008 removed; FR-022 and US-007 rewritten to the user-visible install requirement; ADR-0002 marked superseded by new ADR-0003; FR-025-CON-4/5 and AC-7 and TC-839 no longer mention the launcher; tests.md rows IT-159..165, TC-815..817, 819, 820, 822 removed, TC-818 repurposed to verify-binary

release.yml

npm half replaced by one action step plus a post-publish smoke (install, --version, quire update defers to npm), as in quoin. GitHub Release and binary version assertion unchanged. No behavior added.

Gate

make fmt-check and make lint pass. cargo test --workspace --locked --all-targets --all-features --no-fail-fast: only it_144 fails (python jsonschema missing on this host). make spec: UntrackedSymbols { count: 4 }, identical on origin/main (4 cli_coverage_strict tests).

Not verified (needs a workflow run)

The action step, OIDC publish, the publish: false dry run, the post-publish smoke, and that the existing npm trusted publisher still matches release.yml. Nothing was tagged, published or dispatched.

🤖 Generated with Claude Code

[kreneskyp]

Lead review (diff only): PLAT-1012. release.yml npm half replaced by one agent-ix/nodejs-actions/publish-native-npm@main step (static-musl, self-update-command update, id-token OIDC, NPM_TOKEN bootstrap fallback kept, publish gated by inputs.publish) plus a retrying post-publish smoke modelled on quoin's. Deletes npm/ (launcher), quire-dist package-npm/verify-published/set-version/verify-release and their tests/probe, Makefile dist-package/dist-verify/dist-verify-published/set-version, the local npm.ix README section (its commands are gone), FR-023/FR-024/NFR-008. Spec: FR-022 and US-007 rewritten to keep the user-visible install requirement; ADR-0002 superseded by ADR-0003; FR-025 CON-4/5 and TC-839 now say the repo owns no JS; only packaging-describing rows removed. No new behavior. Gate: fmt-check and lint green; tests green except it_144 (host lacks python jsonschema); make spec: validate passes, assurance-traceability UntrackedSymbols=4 identical on unmodified main. NOT verifiable from here: the action step and a publish:false dry run via workflow_dispatch, that the existing npm Trusted Publisher still matches release.yml, the exact quire update stderr the smoke greps. Run the dry run before the next release. No findings.