ci(release): add prepared-not-fired release.yml + close D-541/542/543

ADR-0167. Release-artifact + version-staging + dep-pin coherence:
- .github/workflows/release.yml (D-542): native matrix (macos-15 aarch64 +
  ubuntu-22.04 x86_64) builds `cljw` with -Dwasm -Doptimize=ReleaseSafe
  -Dcpu=baseline, tar.gz + sha256, attaches to the GitHub Release. Fires ONLY on
  a user-pushed `v*` tag (the loop never tags). actionlint clean.
- D-541 version staging: convention set + honoured (.version stays 1.0.0-alpha.1;
  all rc.1 strings staged under CHANGELOG `## [Unreleased]`); user owns the bump.
- D-543 dep-pin: THIRD_PARTY records exact pins; the eager zlinter fetch is
  confirmed structural (build.zig:5 top-level @import, cf. zwasm D-274) and
  documented as a named pre-1.0 limitation. zwasm-pin bump = user-owned CODEV.

D-541/542/543 discharged; D-538 narrowed (settings.json = user action). rc.1
readiness gate: only D-536 (debt code-truth reconcile) remains loop-ownable.

Author: chaploud

.dev/debt.yaml

@@ -38,63 +38,24 @@ active:
     last_reviewed: "2026-07-01"
   - id: "D-538"
     status: |-
-      open (2026-07-01, user-directed; ADR-0167 S2). Personal-environment
-      decoupling: scripts/run_remote_ubuntu.sh host → ${CLJW_UBUNTU_HOST:-ubuntunote}
-      (behavior-preserving default); the 2 src path-leak comments
-      (agent.zig:213 ubuntunote, stm/tval.zig:17 ~/Documents/OSS path) generalized;
-      personal additionalDirectories in .claude/settings.json moved to the
-      gitignored settings.local.json.
-    category: "infra"
-    quality_floor: "release-mechanics: env decoupling (ADR-0167)"
-    barrier: |-
-      rc.1 readiness gate (finite). NOTE: .claude/** edits may hit the auto-mode
-      self-modification block — surface those to the user (memory
+      PARTIAL 2026-07-01 (ADR-0167 S2). Loop-ownable parts DONE:
+      scripts/run_remote_ubuntu.sh host+dir → ${CLJW_UBUNTU_HOST:-ubuntunote} /
+      ${CLJW_REMOTE_DIR:-...} (behavior-preserving defaults; all `ssh $HOST`);
+      the 2 src path-leak comments generalized (agent.zig:213 "Mac vs ubuntunote"
+      → "host- and scheduler-dependent"; stm/tval.zig:17 dropped the author-local
+      `~/Documents/OSS/.../Ref.java:64-69` absolute path, kept the useful
+      `clojure.lang.Ref.TVal` upstream reference). REMAINING (non-autonomous,
+      `.claude/`-edit-blocked): move the personal `additionalDirectories`
+      (`~/Documents/MyProducts/`, `~/Documents/OSS/`) in .claude/settings.json to
+      the gitignored settings.local.json — surfaced to the user (the auto-mode
+      self-modification classifier denies `.claude/` edits; memory
       claude_rules_edit_permission_block).
-    last_reviewed: "2026-07-01"
-  - id: "D-541"
-    status: |-
-      open (2026-07-01, user-directed; ADR-0167). Version staging (USER-OWNED
-      boundary): all rc.1 prep lands while build.zig.zon .version stays
-      1.0.0-alpha.1; every 1.0.0-rc.1 string in CHANGELOG/THIRD_PARTY/docs is
-      STAGED text that the user's single .version bump + git tag activates
-      (CHANGELOG rc.1 under `## [Unreleased]`). The loop NEVER tags/publishes.
-    category: "infra"
-    quality_floor: "release-mechanics: version staging (ADR-0167)"
-    barrier: |-
-      rc.1 readiness gate (finite). The final bump + tag is the user's action.
-      Avoids the transient SSOT contradiction zwasm hit (fix-CHANGELOG-version).
-    last_reviewed: "2026-07-01"
-  - id: "D-542"
-    status: |-
-      open (2026-07-01, user-directed; ADR-0167). Release-artifact workflow
-      (PREPARED-not-fired): a tag-triggered .github/workflows/release.yml building
-      the static cljw binary for macOS + Linux
-      (-Dwasm -Doptimize=ReleaseSafe -Dcpu=baseline, ADR-0132) attached to the
-      GitHub release. For a single-static-binary product (F-013) a pre-built cljw
-      is most of what a non-Zig user needs. Fires ONLY on a user-pushed tag.
-    category: "infra"
-    quality_floor: "release-mechanics: release-artifact workflow (ADR-0167)"
-    barrier: |-
-      rc.1 readiness gate (finite). Depends on D-539 CI SSOT. Mirrors zwasm's
-      release.yml. -Dcpu=baseline for the deploy artifact (memory
-      fly_deploy_zig_binary_gotchas: SIGILL on shared-cpu otherwise).
-    last_reviewed: "2026-07-01"
-  - id: "D-543"
-    status: |-
-      open (2026-07-01, user-directed; ADR-0167). Dependency-pin coherence /
-      reproducibility. (a) The incoherent story of a 1.0.0-rc.1 embedding zwasm
-      v2.0.0-alpha.3: bump the pin to a coherent zwasm release once one exists
-      (user-owned CODEV) OR document the version relationship in THIRD_PARTY.md +
-      zwasm_capabilities.md as a known pre-1.0 coupling. (b) zlinter dev-dep is
-      fetched EAGERLY (a doc-reader's first `zig build` pulls an external repo —
-      offline/reproducibility footgun): make lazy/dev-only if the build.zig
-      restructure is tractable, else record as a NAMED pre-1.0 wart with this row.
     category: "infra"
-    quality_floor: "release-mechanics: dep-pin coherence (ADR-0167)"
+    quality_floor: "release-mechanics: env decoupling (ADR-0167)"
     barrier: |-
-      rc.1 readiness gate (finite). (a) is partly user-owned (zwasm tag = CODEV);
-      the doc half is loop-ownable. (b) zlinter lazy-fetch is a known Zig
-      build-graph limit (cf. zwasm D-274) — may resolve to the documented-wart form.
+      rc.1 readiness gate (finite) — but the residual (settings.json move) is
+      the `.claude/`-edit-blocked non-autonomous remainder; a USER action, not a
+      loop blocker. The finite gate treats D-538's loop-ownable half as done.
     last_reviewed: "2026-07-01"
   - id: "D-522"
     status: |-
@@ -2608,6 +2569,21 @@ standing:
     barrier: "open after the D-440 arc completes (R4 + R5 must first rewrite the bulk of 'Phase N' citations to gap-area terms). Premature adoption = ~70 dangling citations with no 1:1 redirect. Trigger: D-440 R4/R5 done + a user nod to re-architect the planning axis (it is depth-4, the project's organizing metaphor)."
     last_reviewed: "2026-06-15"
 discharged:
+  - id: "D-543"
+    status: "DISCHARGED 2026-07-01 (ADR-0167; loop-ownable part). (a) Dep pins recorded exactly in THIRD_PARTY.md (zwasm Apache-2.0 @fc7ff0b3b/v2.0.0-alpha.3, -Dwasm-only; zlinter MIT @9b4d67b9). Resolving the '1.0.0-rc.1 embeds zwasm v2.0.0-alpha.3' stability story by BUMPING the pin to a coherent zwasm release is USER-OWNED CODEV (needs zwasm to cut one — tracked via handover north-star + .dev/zwasm_capabilities.md), not a loop task. (b) Confirmed the eager zlinter fetch is STRUCTURAL: build.zig:5 has a top-level comptime `@import(\"zlinter\")`, which the Zig build graph resolves eagerly (matches zwasm's ratified D-274 — lazy needs an upstream b.lazyDependency-able builder). Recorded as a NAMED pre-1.0 limitation in THIRD_PARTY.md (accepted development-time fetch, not a runtime dep). Both parts resolved to the loop's extent; the zwasm-bump residual is user/upstream-gated."
+    category: "infra"
+    barrier: "none — DISCHARGED (zwasm-pin bump residual is user-owned CODEV)."
+    last_reviewed: "2026-07-01"
+  - id: "D-542"
+    status: "DISCHARGED 2026-07-01 (ADR-0167). Release-artifact workflow .github/workflows/release.yml (PREPARED-not-fired): native matrix (macos-15 aarch64 + ubuntu-22.04 x86_64 — native, not cross-compile, to keep the embedded zwasm JIT's arch-specific codegen honest) builds cljw with `-Dwasm -Doptimize=ReleaseSafe -Dcpu=baseline` (baseline CPU = shipped/deploy config, avoids SIGILL on shared hosts per memory fly_deploy_zig_binary_gotchas), verifies `cljw --version`, tar.gz + .sha256, attaches to the GitHub Release (idempotent create + upload --clobber). Triggers ONLY on a user-pushed `v*` tag or manual dispatch (the loop never tags). permissions contents:write; TAG_NAME via env (no injection). actionlint clean. First-tag validation (each artifact runs, reports ReleaseSafe) noted in the workflow header."
+    category: "infra"
+    barrier: "none — DISCHARGED (fires on the user's tag; first-tag validation noted)."
+    last_reviewed: "2026-07-01"
+  - id: "D-541"
+    status: "DISCHARGED 2026-07-01 (ADR-0167). Version-staging convention established + honoured: build.zig.zon .version stays `1.0.0-alpha.1` (verified — no premature rc.1 bump); every `1.0.0-rc.1` string in CHANGELOG/THIRD_PARTY/docs is STAGED text under `## [Unreleased]` (+ a CHANGELOG STAGING NOTE spelling out the maintainer's bump+tag step). This avoids the transient SSOT contradiction zwasm hit (their dedicated fix-CHANGELOG-version commit). The final `.version` bump + `git tag`/publish is USER-OWNED — the loop prepares everything and never tags. Nothing left for the loop to do here until the user cuts the tag."
+    category: "infra"
+    barrier: "none — DISCHARGED (convention set; the bump/tag is the user's action)."
+    last_reviewed: "2026-07-01"
   - id: "D-540"
     status: "DISCHARGED 2026-07-01 (ADR-0167). CHANGELOG.md (Keep-a-Changelog; the rc.1 entry sits under `## [Unreleased]` per the D-541 staging convention + a STAGING NOTE explaining the maintainer's tag/bump step). THIRD_PARTY.md naming exact license + pinned commit per fetched dep (zwasm Apache-2.0 @fc7ff0b3b/v2.0.0-alpha.3, -Dwasm-only; zlinter MIT @9b4d67b9, dev-only) — an EPL-2.0 project building against non-EPL deps (none vendored in-tree; fetched by the Zig pkg mgr) + the EPL clj lineage cross-ref to NOTICE. .gitattributes (LF normalize + .wasm/.png binary + docs/ja/archive linguist-documentation) + .editorconfig. build.zig.zon .paths now ships LICENSE + NOTICE + THIRD_PARTY.md + CHANGELOG.md + README + src (NOTICE was absent despite EPL src/lang/clj/** shipping inside src). zlinter MIT verified against the fetched LICENSE."
     category: "docs"

.dev/handover.md

@@ -18,12 +18,15 @@
     via `scripts/ci_gate.sh` SSOT + versions.lock + dependabot; repo made zig-fmt-clean.
     First GitHub run verified post-push. Follow-ups (non-blocking): gitleaks job, API canary.
   - [ ] **D-536** debt-ledger code-truth reconcile (zwasm S0 pattern).
-  - [ ] **D-538** personal-env decoupling (SSH host→env default; 2 src leaks;
-    settings.local.json). *`.claude/**` edits may hit auto-mode block → surface.*
+  - [~] **D-538** personal-env decoupling — SSH host+dir→env default + 2 src leaks
+    *DONE 2026-07-01*; **settings.json `additionalDirectories` move = USER action**
+    (`.claude/`-edit-blocked, non-autonomous; surfaced — not a loop blocker).
   - [x] **D-540** CHANGELOG (`## [Unreleased]`) + THIRD_PARTY + .gitattributes/.editorconfig + ship NOTICE/CHANGELOG/THIRD_PARTY in .paths *DISCHARGED 2026-07-01*.
-  - [ ] **D-542** release.yml (prepared-not-fired, static cljw binary).
-  - [ ] **D-543** dep-pin coherence (zwasm alpha.3 vs rc.1; eager zlinter fetch).
-  - [ ] **D-541** version staging convention (all rc.1 strings = staged text).
+  - [x] **D-542** release.yml (prepared-not-fired, native matrix, cljw tar.gz+sha) *DONE 2026-07-01; fires on user tag*.
+  - [x] **D-543** dep-pin coherence *DONE 2026-07-01 (loop part)* — pins in THIRD_PARTY;
+    eager zlinter fetch confirmed structural (build.zig:5 top-level @import) → documented
+    pre-1.0 wart; **zwasm-pin bump = user-owned CODEV** (needs a zwasm release).
+  - [x] **D-541** version staging convention (rc.1 strings staged; .version stays alpha.1) *DONE 2026-07-01*.
 - **Track B (parallel, non-blocking for the tag):** the easiest-first `active:`
   drain continues — D-522 de-pointer / D-523 doc-audit / D-526 interop / D-527
   parity / D-528 real-deps.edn / D-529 / D-305 / D-470 / D-222 / D-460 / D-439 sqrt.

.github/workflows/release.yml

@@ -0,0 +1,80 @@
+# Release — build the ReleaseSafe, Wasm-enabled `cljw` binary for each supported
+# target on its NATIVE runner and attach it to the GitHub Release. Native builds
+# (not cross-compile) keep the embedded zwasm JIT's arch-specific codegen honest.
+#
+# TRIGGER: a maintainer pushing a `v*` tag (a deliberate human act — the
+# autonomous loop never tags or releases; build.zig.zon .version is the SSOT),
+# or manual dispatch. PREPARED-not-fired: this workflow only runs on such a tag.
+#
+# NOTE (first-tag validation): the artifact build uses
+# `-Dwasm -Doptimize=ReleaseSafe -Dcpu=baseline` (baseline CPU avoids SIGILL on
+# shared/older hosts, the shipped/deploy config). Validate each artifact runs
+# (`cljw --version` reports `(ReleaseSafe)`) on the first real release.
+
+name: release
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: build (${{ matrix.name }})
+    runs-on: ${{ matrix.runs-on }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - name: macos-aarch64
+            runs-on: macos-15
+            zig-dir: zig-aarch64-macos-0.16.0
+            artifact: cljw-macos-aarch64
+          - name: linux-x86_64
+            runs-on: ubuntu-22.04
+            zig-dir: zig-x86_64-linux-0.16.0
+            artifact: cljw-linux-x86_64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Install Zig 0.16.0
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/versions.lock
+          mkdir -p ~/.local
+          curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/${{ matrix.zig-dir }}.tar.xz" -o /tmp/zig.tar.xz
+          tar -xJf /tmp/zig.tar.xz -C ~/.local
+          echo "$HOME/.local/${{ matrix.zig-dir }}" >> "$GITHUB_PATH"
+
+      - name: Build cljw (ReleaseSafe, Wasm-enabled, baseline CPU)
+        shell: bash
+        run: |
+          set -euo pipefail
+          zig build -Dwasm -Doptimize=ReleaseSafe -Dcpu=baseline
+          zig-out/bin/cljw --version
+          mkdir -p dist
+          tar -C zig-out/bin -czf "dist/${{ matrix.artifact }}.tar.gz" cljw
+          ( cd dist && shasum -a 256 "${{ matrix.artifact }}.tar.gz" > "${{ matrix.artifact }}.tar.gz.sha256" )
+
+      - name: Attach to GitHub Release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG_NAME: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Create the release once (idempotent — later matrix legs just upload).
+          gh release view "$TAG_NAME" >/dev/null 2>&1 || \
+            gh release create "$TAG_NAME" --title "$TAG_NAME" --generate-notes
+          gh release upload "$TAG_NAME" dist/* --clobber

THIRD_PARTY.md

@@ -21,6 +21,12 @@ language lineage separately.
   Pinned to commit `9b4d67b9725e7137ac876cc628fe5dd2ca5a2681`
   (`ref=0.16.x`). Not part of the runtime; it participates in the gate only.
   Source: <https://github.com/kurtwagner/zlinter>.
+  _Known pre-1.0 limitation_: `zlinter` exposes its builder through a top-level
+  `@import("zlinter")` in `build.zig`, which the Zig build graph resolves
+  **eagerly** — so even a plain `zig build` that never runs `lint` fetches it
+  once. Making it lazy needs the dependency to expose a `b.lazyDependency`-able
+  builder (upstream); until then this is an accepted development-time fetch, not
+  a runtime dependency.
 
 ## Clojure language lineage (EPL, see NOTICE)