Release Tree Ring 0.14.0 harness activation

.github/workflows/release.yml

@@ -11,6 +11,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   package-linux:
     name: Package ubuntu-latest
@@ -28,13 +31,15 @@ jobs:
       - name: Build package on Debian Bookworm
         env:
           RUST_BOOKWORM_IMAGE: docker.io/library/rust:1.89-bookworm@sha256:c9ac3fa8945b61dede1e4500d25028aa8fd8a8fe46365fcf9c0422f8d999b9b0
+          TREE_RING_RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || '' }}
         run: |
           docker run --rm \
             --platform linux/amd64 \
             --user "$(id -u):$(id -g)" \
             -e HOME=/tmp \
             -e CARGO_HOME=/tmp/cargo \
             -e RUSTUP_HOME=/usr/local/rustup \
+            -e TREE_RING_RELEASE_TAG \
             -v "$GITHUB_WORKSPACE:/workspace" \
             -w /workspace/source \
             "$RUST_BOOKWORM_IMAGE" \
@@ -84,12 +89,81 @@ jobs:
 
       - name: Build package
         working-directory: source
+        env:
+          TREE_RING_RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || '' }}
         run: sh ../scripts/package-release.sh
 
+      - name: Smoke-test package
+        working-directory: source
+        run: |
+          macos_binary=$(find dist -path '*-darwin-arm64/tree-ring' -type f -print)
+          test -n "$macos_binary"
+          test "$(printf '%s\n' "$macos_binary" | wc -l)" -eq 1
+          test "$(uname -m)" = "arm64"
+          version=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n 1)
+          test "$("$macos_binary" --version)" = "tree-ring $version"
+
       - name: Upload artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: tree-ring-memory-macos-latest
           path: |
             source/dist/*.tar.gz
             source/dist/*.sha256
+
+  publish-release:
+    name: Publish GitHub release assets
+    needs: [package-linux, package-macos]
+    if: github.event_name == 'push' && github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download release assets
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          pattern: tree-ring-memory-*
+          merge-multiple: true
+          path: release-assets
+
+      - name: Verify release assets
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          version=${RELEASE_TAG#v}
+          test -n "$version"
+          test "$RELEASE_TAG" = "v$version"
+          for platform in darwin-arm64 linux-x86_64; do
+            archive="release-assets/tree-ring-memory-$version-$platform.tar.gz"
+            checksum="$archive.sha256"
+            test -f "$archive"
+            test -f "$checksum"
+            expected=$(awk '{print $1}' "$checksum")
+            actual=$(shasum -a 256 "$archive" | awk '{print $1}')
+            test "$actual" = "$expected"
+            for packaged_path in \
+              "tree-ring-memory-$version-$platform/" \
+              "tree-ring-memory-$version-$platform/tree-ring" \
+              "tree-ring-memory-$version-$platform/README.md" \
+              "tree-ring-memory-$version-$platform/LICENSE" \
+              "tree-ring-memory-$version-$platform/install.sh"; do
+              tar -tzf "$archive" | grep -F -x "$packaged_path" > /dev/null
+            done
+            entry_count=$(tar -tzf "$archive" | wc -l | tr -d '[:space:]')
+            test "$entry_count" = "5"
+          done
+
+      - name: Publish release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" release-assets/*.tar.gz release-assets/*.sha256 \
+              --clobber \
+              --repo "$GITHUB_REPOSITORY"
+          else
+            gh release create "$RELEASE_TAG" release-assets/*.tar.gz release-assets/*.sha256 \
+              --generate-notes \
+              --repo "$GITHUB_REPOSITORY"
+          fi

.superpowers/sdd/2026-08-13-tree-ring-harness-activation-core-implementation-plan/task-3-4-integration-report.md

@@ -0,0 +1,90 @@
+# Task 3 and Task 4 Activation Integration Report
+
+## Status
+
+Provisional integration complete on `codex/harness-activation-launcher`. Task 3 head
+`6517cc51941694d417ff73fa5a0aaa08be3c6bc3` was merged into Task 4 head
+`091e6c3`. This includes Task 3's prerequisite root/publication safety commit
+`aad19d7` through ancestry. The integration is pending CodeRabbit quota and does
+not claim review approval.
+
+Task 5 was not implemented.
+
+## Conflict Resolution
+
+The histories diverged at reviewed Task 3 base `3c2d15c`. The merge produced one
+content-conflicted file, `crates/tree-ring-memory-cli/src/activation/bridge.rs`,
+with seven localized conflict regions:
+
+1. Imports retain Task 3's root identity and fault-injection support together
+   with Task 4's descriptor-based directory enumeration support.
+2. `ProjectFs` retains Task 3's final-component no-follow root descriptor,
+   device/inode binding, and root revalidation. The same pinned root descriptor
+   supplies Task 4's activation `flock`; root identity is checked before and
+   after lock acquisition so a replaced root cannot silently split writers.
+3. `ResolvedTarget` retains Task 3's snapshot reads and create-only hard-link
+   publication. Task 4 receipt creation is exposed only as the narrow
+   `ProjectFs::create_receipt_file` API; there is no generic replacement API.
+4. Task 4 receipt traversal retains descriptor-relative, component-by-component
+   `O_NOFOLLOW` directory enumeration beneath the pinned root.
+5. Receipt pruning/invalidation retains a distinct descriptor-relative unlink
+   path, limited to validated six-component
+   `.tree-ring/activation/receipts/<harness>/<worker>/<receipt>.json` targets.
+   This does not enable bridge or manifest removal, and Task 3 deactivation
+   remains creation-only/review-only for existing entries.
+6. Non-Unix implementations retain fail-closed stubs for the combined pinned
+   filesystem surface.
+7. Deactivation and Agent Zero tests retain Task 4 adapter-version/bridge-
+   fingerprint bookkeeping while preserving Task 3's no-replace review gate.
+
+The small companion change in `activation/manifest.rs` routes receipt creation
+and deletion through the narrowed receipt-only `ProjectFs` helpers. Receipt
+storage continues to share the activation root lock; persisted manifest,
+registry version/fingerprint, store, and root revalidation remain in Task 4's
+final commit phase.
+
+## Preserved Contracts
+
+- Bridge and activation-manifest lifecycle is creation-only. Existing final
+  entries are never replaced or removed; contested or changed entries return
+  `needs-user-review` and are preserved.
+- All mutation/traversal remains rooted in retained no-follow descriptors. Root
+  identity is rechecked, create publication is no-replace, and publication or
+  durability uncertainty leaves disk material intact.
+- Receipt creation is create-only. Receipt deletion is separate and applies
+  only to validated regular receipt files during pruning/invalidation.
+- Preflight retains bounded scoped recall, exact harness/event mapping,
+  current persisted-contract and registry revalidation under the shared lock,
+  stale-receipt invalidation, non-UTF-8 project fail-closed behavior, and the
+  path-free hook-facing storage diagnostic.
+- Agent Zero remains binding-only. Missing/external plugin state is not
+  installed, rewritten, or removed by core; existing owned binding material is
+  preserved when a manifest replacement would be required.
+
+## Focused Verification
+
+- `cargo test -p tree-ring-memory-cli activation::bridge --lib`
+  - Passed: 31 tests, 0 failed.
+- `cargo test -p tree-ring-memory-cli activation::preflight --lib`
+  - Passed: 21 tests, 0 failed.
+- `cargo test -p tree-ring-memory-cli activation::manifest --lib`
+  - Passed: 14 tests, 0 failed.
+- `cargo test -p tree-ring-memory-cli activation::adapters --lib`
+  - Passed: 12 tests, 0 failed.
+- `cargo test -p tree-ring-memory-sqlite database_path --lib`
+  - Passed: 2 tests, 0 failed.
+- `cargo clippy -p tree-ring-memory-sqlite -p tree-ring-memory-cli --lib -- -D warnings`
+  - Passed with no warnings.
+- `cargo fmt --all -- --check`
+  - Passed.
+- `git diff --check` and `git diff --cached --check`
+  - Passed.
+
+Per direction, no full workspace suite was run.
+
+## Review Boundary
+
+This is an isolated integration result and local focused verification only.
+CodeRabbit review was not available within quota, so this report does not claim
+independent review approval. No lifecycle CLI routing, certification, fixtures,
+plugin/documentation work, or Task 5 behavior was added.

Cargo.toml

@@ -7,7 +7,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.13.0"
+version = "0.14.0"
 edition = "2021"
 license = "MIT"
 authors = ["TerminallyLazy"]