[Pepps233]

Summary

Release announcement targeted the wrong R2 account and lacked configured credentials.

Use dedicated production and staging environments, reject missing credentials immediately, and make retries preserve the verified immutable release record.

Reasoning

Release CI remains the sole production metadata writer after every public package and tarball passes npm verification.

Separate bucket-scoped credentials avoid giving staging access to production or redirecting the existing model publisher.

The initial command-level regression reproduced missing-credential handling, inconsistent recovery records, and acceptance of conflicting source commits.

Changes

• Point release publication at the verified Cloudflare account through diffex-release-upload; add a manual-only staging verification workflow using diffex-release-staging.
• Preserve conditional pointer updates, read the body and ETag together, reject conflicting immutable records, and reuse original bytes during recovery.
• Bound requests and retries, redact storage diagnostics, and cover the actual publisher command with controlled fixtures.
• Document installed GitHub environment secrets, verified bucket isolation, and staging evidence.

GitHub rejected required reviewers on the current plan.
With explicit owner approval, production permits main or v* tags and staging permits only main, without a required-reviewer gate.
The new manual workflow can run on GitHub after it reaches main; the staging evidence here comes from the real publisher running locally against R2.
No real release or production object was written.

Testing

• node --test scripts/publish-release-announcement.test.mjs: 14 passed.
• npm run check: passed.
• ./test.sh: passed.
• actionlint 1.7.12 on both changed workflows: passed.
• node scripts/verify-release-publication.mjs --staging: missing packages, unavailable tarballs, first and repeated publication, conditional advancement, older announcements, and interrupted recovery passed using controlled npm responses and real R2.
• All staging fixture records and the lock were confirmed absent after cleanup; both release namespaces remained empty.
• Both new keys accessed their own bucket and were denied the opposite release bucket and an unrelated bucket; supplied values were absent from repository changes.