[afflom]

What

The v0.4.0 rehearsal (release.yml dispatched on release/v0.4 at 71c6bd8db, run 40219629854) ended as a startup_failure with no job started. GitHub validates a reusable workflow at startup against the permissions and secrets its caller passes, before any job condition is read. crate.yml's upload job declares permissions: id-token: write and reads secrets.CARGO_REGISTRY_TOKEN; the crate job of release.yml granted neither, so every release run (rehearsal or tag) failed before its first job. crate.yml has never been dispatched on its own, so nothing had exercised the call.

Change

Nine lines in .github/workflows/release.yml, on the crate job: permissions: contents: read, id-token: write and secrets: inherit, with the reason recorded as a comment. The upload job of crate.yml still runs only on a dispatch of crate.yml (github.event_name == 'workflow_dispatch'), so a release run grants the token capability and uses it for nothing.

Evidence

A rehearsal of release.yml dispatched on this branch is the test: it must get past startup and run identity, crate readiness, the gate, the five binaries and the two images (the publish job stays skipped on an untagged run). Its run is linked in the comments once it has an id. No register row changes (RP-18's statement already describes this behaviour; the workflow did not deliver it).

Milestone

v0.4.0 (the tag commit's workflow must start). Opened under the #15 moratorium as a release blocker.

---

Generated by Claude Code

[afflom]

Maintainer: the first rehearsal on this branch (run 40220072633) got past startup, which proves the release.yml fix, and then failed in crate readiness: cargo 1.97.1's publish --dry-run leaves the archive under <target-dir>/package/tmp-crate/, where crate.yml read <target-dir>/package/<crate>. Reproduced locally with the pinned toolchain, and the archive's bytes equal cargo package's (cmp), which is the property the step asserts. Second commit 1d6acf575: the step locates the archive by name under package/ and refuses if none is there, so the check does not depend on the path one cargo release used. A second rehearsal is running on this head; the gate restarted on it. Tag follows the merge.

---

Generated by Claude Code

[afflom]

Maintainer: the gate on 1d6acf575 went red in conformance_rp_18, which reads the two workflows as text and asserted the old cmp/metadata/identity lines of crate.yml. Third commit b4779b3ef, two parts: (1) the publish job of release.yml read the dry-run archive at the same stale path as crate readiness did, and it runs only on a tag, so no rehearsal could reach it; it now locates the archive by name, with the dry-run command line itself unchanged (RP-18 plants that line); (2) the RP-18 oracle and its three plants assert the lines the workflows now carry ("$dry_crate"). conformance_rp_18 passes on this tree. The third rehearsal (run 40221304393, head 1d6acf575, which carries the crate.yml change) is past crate readiness with eight of nine jobs green and the release gate running; the publish job is exercised only by the tag itself. The gate restarted on b4779b3ef; I merge on green and tag.

---

Generated by Claude Code