prep repo for PyPI deployment

.github/workflows/python-publish.yml

@@ -1,36 +1,62 @@
-# This workflow will upload a Python Package to PyPI when a release is created
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
-
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
+# This workflow uploads the MAIL Python packages to PyPI when a (non-prerelease)
+# GitHub Release is published.
+#
+# MAIL ships as five lockstep distributions built from one uv workspace:
+#   mail-swarms (thin meta) -> mail-swarms-client, mail-swarms-server,
+#                              mail-swarms-daemon, mail-swarms-protocol
+# All five share a single version and are published together.
 
 name: Upload Python Package
 
 on:
   release:
-    types: [published]
+    # `released` fires only when a non-prerelease is published (or a prerelease
+    # is promoted to a full release); prereleases never trigger this workflow.
+    types: [released]
 
 permissions:
   contents: read
 
 jobs:
   release-build:
     runs-on: ubuntu-latest
+    # Defense-in-depth: skip the run for any release still flagged as a prerelease.
+    if: ${{ !github.event.release.prerelease }}
+    env:
+      RELEASE_TAG: ${{ github.event.release.tag_name }}
 
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
         with:
-          python-version: "3.x"
+          python-version: "3.12"
 
-      - name: Build release distributions
+      - name: Verify release tag matches package versions
         run: |
-          # NOTE: put your own distribution build steps here.
-          python -m pip install build
-          python -m build
+          # Normalize "v2.0.1" -> "2.0.1"; every package must match exactly so a
+          # mis-tagged release fails loudly instead of publishing a wrong version.
+          tag="${RELEASE_TAG#v}"
+          echo "Release tag (normalized): $tag"
+          fail=0
+          for f in pyproject.toml \
+                   src/mail/client/pyproject.toml \
+                   src/mail/server/pyproject.toml \
+                   src/mail/daemon/pyproject.toml \
+                   src/mail/protocol/pyproject.toml; do
+            ver="$(sed -nE 's/^version = "([^"]+)"$/\1/p' "$f" | head -1)"
+            if [ "$ver" != "$tag" ]; then
+              echo "::error file=$f::version is '$ver' but release tag is '$tag'"
+              fail=1
+            else
+              echo "ok: $f = $ver"
+            fi
+          done
+          exit "$fail"
+
+      - name: Build all workspace packages
+        run: uv build --all-packages
 
       - name: Upload distributions
         uses: actions/upload-artifact@v4
@@ -46,16 +72,10 @@ jobs:
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
 
-    # Dedicated environments with protections for publishing are strongly recommended.
-    # For more information, see: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules
+    # Dedicated environment with protections for publishing.
     environment:
       name: pypi
-      # OPTIONAL: uncomment and update to include your PyPI project URL in the deployment status:
       url: https://pypi.org/p/mail-swarms
-      #
-      # ALTERNATIVE: if your GitHub Release name is the PyPI project version string
-      # ALTERNATIVE: exactly, uncomment the following line instead:
-      # url: https://pypi.org/project/YOURPROJECT/${{ github.event.release.name }}
 
     steps:
       - name: Retrieve release distributions
@@ -64,7 +84,15 @@ jobs:
           name: release-dists
           path: dist/
 
+      # Publishes every dist in dist/ (all five packages). PyPI matches each file
+      # to its project and verifies this repo/workflow/environment is a trusted
+      # publisher for THAT project, so every project needs a trusted publisher
+      # configured pointing at this workflow + the `pypi` env.
       - name: Publish release distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist/
+          # Idempotent: skip files already on PyPI instead of failing. Lets a
+          # re-run (or a version published out-of-band) succeed rather than erroring
+          # on PyPI's no-reupload rule.
+          skip-existing: true

README.md

@@ -9,10 +9,10 @@ runtime is archived under `src/mail/legacy`.
 
 ## Active v2 Packages
 
-- `src/mail/protocol` - shared protocol types and constants (`mail-protocol`)
-- `src/mail/server` - FastAPI server implementation (`mail-server`)
-- `src/mail/client` - command-line client (`mail-client`)
-- `src/mail/daemon` - daemon implementation (`mail-daemon`)
+- `src/mail/protocol` - shared protocol types and constants (`mail-swarms-protocol`)
+- `src/mail/server` - FastAPI server implementation (`mail-swarms-server`)
+- `src/mail/client` - command-line client (`mail-swarms-client`)
+- `src/mail/daemon` - daemon implementation (`mail-swarms-daemon`)
 
 ## Repository Layout
 
@@ -21,10 +21,10 @@ mail/
 ├── docs/                 # v2 repository-level docs
 ├── spec/                 # protocol specification and schemas
 ├── src/mail/
-│   ├── protocol/         # mail-protocol package
-│   ├── server/           # mail-server package
-│   ├── client/           # mail-client package
-│   ├── daemon/           # mail-daemon package
+│   ├── protocol/         # mail-swarms-protocol package
+│   ├── server/           # mail-swarms-server package
+│   ├── client/           # mail-swarms-client package
+│   ├── daemon/           # mail-swarms-daemon package
 │   └── legacy/           # archived MAIL v1 runtime, docs, config, and UI
 ├── tests/                # active MAIL v2 test suite
 ├── scripts/              # repository maintenance scripts

THIRD_PARTY_NOTICES.md

@@ -5247,42 +5247,14 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## `mail-client==2.0.0`
-CLI client for interacting with MAIL servers
-### License field:
-(license metadata not found)
-### Warning:
-No license metadata discovered; manual review needed.
-
-## `mail-daemon==2.0.0`
-Daemon implementation for the Multi-Agent Interface Layer (MAIL)
-### License field:
-(license metadata not found)
-### Warning:
-No license metadata discovered; manual review needed.
-
-## `mail-protocol==2.0.0`
-Types and constants for the Multi-Agent Interface Layer (MAIL) protocol
-### License field:
-(license metadata not found)
-### Warning:
-No license metadata discovered; manual review needed.
-
-## `mail-server==2.0.0`
-FastAPI server for the Multi-Agent Interface Layer (MAIL)
-### License field:
-(license metadata not found)
-### Warning:
-No license metadata discovered; manual review needed.
-
-## `mail-swarms==2.0.0`
+## `mail-swarms==2.0.1`
 Multi-Agent Interface Layer v2 workspace meta-package
 ### License field:
 Apache-2.0
 ### Classifiers:
 License :: OSI Approved :: Apache Software License
 
-### License Text (`mail_swarms-2.0.0.dist-info/licenses/LICENSE`)
+### License Text (`mail_swarms-2.0.1.dist-info/licenses/LICENSE`)
 
 ```text
 Apache License
@@ -5488,7 +5460,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 ```
 
-### License Text (`mail_swarms-2.0.0.dist-info/licenses/NOTICE`)
+### License Text (`mail_swarms-2.0.1.dist-info/licenses/NOTICE`)
 
 ```text
 MAIL Project
@@ -5502,6 +5474,34 @@ Third-party notices and attributions may be included by their respective
 projects and licenses in their source files or package metadata.
 ```
 
+## `mail-swarms-client==2.0.1`
+CLI client for interacting with MAIL servers
+### License field:
+(license metadata not found)
+### Warning:
+No license metadata discovered; manual review needed.
+
+## `mail-swarms-daemon==2.0.1`
+Daemon implementation for the Multi-Agent Interface Layer (MAIL)
+### License field:
+(license metadata not found)
+### Warning:
+No license metadata discovered; manual review needed.
+
+## `mail-swarms-protocol==2.0.1`
+Types and constants for the Multi-Agent Interface Layer (MAIL) protocol
+### License field:
+(license metadata not found)
+### Warning:
+No license metadata discovered; manual review needed.
+
+## `mail-swarms-server==2.0.1`
+FastAPI server for the Multi-Agent Interface Layer (MAIL)
+### License field:
+(license metadata not found)
+### Warning:
+No license metadata discovered; manual review needed.
+
 ## `markdown-it-py==4.0.0`
 Python port of markdown-it. Markdown parsing, done right!
 ### License field:
@@ -9720,6 +9720,85 @@ Copyright 2014 Ian Cordasco, Cory Benfield
    limitations under the License.
 ```
 
+## `respx==0.23.1`
+A utility for mocking out the Python HTTPX and HTTP Core libraries.
+### License field:
+BSD-3-Clause
+### Classifiers:
+License :: OSI Approved :: BSD License
+### Home page:
+https://lundberg.github.io/respx/
+### Author:
+Jonas Lundberg
+
+### License Text (`LICENSE.md`)
+
+```text
+BSD 3-Clause License
+
+Copyright (c) 2019, 5 Monkeys Agency AB
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```
+
+### License Text (`respx-0.23.1.dist-info/LICENSE.md`)
+
+```text
+BSD 3-Clause License
+
+Copyright (c) 2019, 5 Monkeys Agency AB
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```
+
 ## `rfc3339-validator==0.1.4`
 A pure python RFC3339 validator
 ### License field:

docs/testing-plan.md

@@ -2,8 +2,9 @@
 
 **Status:** In effect — Phases 0–5 landed
 **Date:** 2026-06-12
-**Scope:** The v2 packages (`mail-protocol`, `mail-server`, `mail-daemon`,
-`mail-client`) and the repository-level `tests/` suite. The legacy suite under
+**Scope:** The v2 packages (`mail-swarms-protocol`, `mail-swarms-server`,
+`mail-swarms-daemon`, `mail-swarms-client`) and the repository-level `tests/`
+suite. The legacy suite under
 `src/mail/legacy/tests/` is out of scope and remains frozen.
 
 ---