Roll out signed ghcr OCI publish + wasm.directory to the org's wasm-releasing repos

[avrabe]

Context

relay now publishes its verified flight component to ghcr.io as a cosign-signed OCI artifact on every tagged release (PR #301, release.yml flight-component job) and documents wasm.directory registration (docs/OCI-DISTRIBUTION.md, made concrete in #305). An org-wide survey (read-only, 43 non-archived repos, 2026-07-22) found that relay is the only repo that OCI-pushes a wasm artifact — while six other repos release .wasm as GitHub-release assets but never OCI-push them. This issue tracks rolling the proven pattern out to them.

Step 0 (blocking premise): confirm relay's own ghcr push works end-to-end. A workflow_dispatch validation run against falcon-v1.127.0 is in flight; the push step is continue-on-error, so its real conclusion + whether ghcr.io/pulseengine/falcon-flight materializes must be checked before replicating. Don't replicate an unproven pattern.

Reference pattern (the template)

relay/.github/workflows/release.yml, flight-component job, final step:
cargo install wkg --locked --version 0.15.1 → wkg oci push <ref>:<ver> + :latest → parse digest from push.log → cosign sign --yes <ref>@sha256:<digest>. continue-on-error: true; job needs permissions: packages: write + id-token: write. Full recipe + wasm.directory registry-entry mechanism in docs/OCI-DISTRIBUTION.md.

Candidates — all .wasm release assets verified by direct query

Repo	Bucket	Verified asset	Recommended action
relay	D (ref)	falcon-flight-v*.wasm (+ OCI push, cosign@digest)	make ghcr pkg public + file wasm.directory registry-entry (ns pulseengine)
bazel-file-ops-component	A	file_ops_component.wasm (+_aot+.sha256)	finish the commented-out push in oci-publish.yml + add cosign-by-digest
witness	A/B	witness-reporter-component-v0.39.0-wasm32-wasip2.wasm (+.cert+.sig)	append OCI push+sign after existing wasm build+sign step
sigil	A/B	wsc-component.wasm	add OCI push+sign → ghcr.io/pulseengine/wsc
scry	B	scry-3.2.4-wasm32-wasip2.wasm (+.pem+.sig)	OCI push+sign → ghcr.io/pulseengine/scry (provenance)
wohl	B	wohl-matter-composed.wasm	OCI push+sign → ghcr.io/pulseengine/wohl-matter (provenance)
gale	B	gale-wasm-{msgq,mutex,sem}-v0.4.0.wasm	optional ghcr for 3 core modules; NOT wasm.directory

Bucket legend: A reusable component (prime ghcr + wasm.directory) · B runnable/composed wasm (ghcr provenance, marginal for wasm.directory) · C internal build/test/tooling wasm — do not publish · D already publishes.

Skipped (bucket C, evidence in survey): spar (wasm-bindgen browser build in a tarball), wasm-component-examples (teaching), rules_wasm_component (the ruleset provides wkg oci push), rivet/loom/kiln (cdylib fixtures/intermediates), meld/synth/ordeal/mcp (native-only), plus upstream forks.

Prioritized rollout checklist

• Step 0 — confirm relay's ghcr push works (validation run in flight); make pulseengine/falcon-flight public; file relay's wasm.directory registry-entry.
• 1. bazel-file-ops-component (highest value — real reusable component, pipeline ~80% there). Un-stub the commented publish block in oci-publish.yml; add cosign-by-digest. Decision: WIT namespace is generic bazel: (not pulseengine-owned) → triggers wasm.directory maintainer review; consider re-homing under pulseengine: first.
• 2. witness — ghcr.io/pulseengine/witness-reporter. Gap: currently signs the file as a sigstore blob, not the OCI digest — add cosign sign …@sha256:<digest>.
• 3. sigil — ghcr.io/pulseengine/wsc. Gap: blob covered by SHA256SUMS bundle only; no OCI push/digest sig.
• 4. scry — ghcr.io/pulseengine/scry; wasm.directory optional (analyzer-as-component).
• 5. wohl — ghcr.io/pulseengine/wohl-matter; provenance only.
• 6. gale — optional ghcr for the 3 modules; explicitly do not register on wasm.directory (core modules, not Component-Model components).

Flags / unverified

• A-vs-B for witness/sigil/scry: they're both reusable components and the tools-as-wasm — confirm intended consumption model before deciding wasm.directory eligibility.
• Every new ghcr package defaults private; must be flipped public before wasm.directory can index it.
• example-kvs has a WIT contract but no releases yet — revisit when it starts releasing.

Survey was read-only; no external issues were opened. Each rollout item above is a separate PR on its repo when picked up.

🤖 Generated with Claude Code