Add responsive event counts and nightly delivery

.agents/skills/commit-and-push/references/litefold-calendar.md

@@ -33,10 +33,12 @@ Resolve the current Node and package-manager selection from repository manifests
 dependency state from the lockfile, script composition from `package.json`, and
 hosted behavior from workflows. Do not freeze those values in this skill.
 
-The contributor command index owns local command sequences. Its complete
-repository gate is the gate run by hosted CI, but hosted CI may add platform
-controls such as dependency review and its exact execution environment. Report
-local and hosted results separately.
+The contributor command index owns local command sequences and the local versus
+hosted browser matrix. The shared gate command checks Chromium, Firefox, and
+WebKit locally; hosted CI and publication select Chromium and WebKit. Hosted CI
+also adds controls such as dependency review and its exact execution environment.
+Report local and hosted results separately, and re-read the command index before
+choosing validation.
 
 ## Repository-specific safeguards
 

.agents/skills/release-to-npm/SKILL.md

@@ -5,9 +5,11 @@ description: Coordinate a maintainer-authorized npm release through repository-o
 
 # Release to npm
 
-Coordinate the repository-owned release process without replacing human
-approvals or widening credential boundaries. Read-only planning and verification
-do not authorize a public mutation.
+Coordinate the repository-owned release process within the user's authorized
+scope and the configured hosted controls. Read-only planning and verification
+do not authorize a public mutation. An explicit request to implement and publish
+through named delivery stages does authorize those stages; preserve that scope
+instead of requesting the same permission again.
 
 ## Load repository authority
 
@@ -37,10 +39,13 @@ workflow runs, the repository's private release record, and fresh read-only
 registry responses. A local branch, tag, worktree, artifact directory, cached
 response, or remembered prior run is not publication authority.
 
-Do not infer a version bump, release role, or permission. Confirm the candidate,
-the release operator, any required reviewer for the `npm` environment, and the
-authenticated npm package maintainer as required by the runbook. One person may
-fill multiple roles only when the hosted policy permits it.
+Derive the candidate strategy, environment names, and required roles from the
+current runbook and hosted state. An authorized nightly start uses unattended
+OIDC trusted publication and does not require a manual environment reviewer, npm
+token, or local npm login. Nightly leaves `latest` unchanged and verifies it
+through public registry reads. Stable publication retains its separately
+configured review controls.
+One person may fill multiple roles only when the hosted policy permits it.
 
 For an authorized start or continuation, create or update the private release
 record defined by the runbook. Keep it outside the repository in an approved,
@@ -51,27 +56,32 @@ conversation, command output, or automation.
 Treat unavailable, stale, malformed, conflicting, or ambiguous identity evidence
 as a stop condition.
 
-## Pause at mutation boundaries
+## Respect mutation boundaries
 
 Immediately before every external mutation:
 
 1. State the exact repository, candidate version, source commit, workflow run,
    and current public identity that are known at that phase.
 2. Explain the expected mutation and its irreversible or protected effects.
-3. Obtain explicit authorization for that mutation.
+3. Confirm that the user's existing authorization covers that mutation; ask only
+   when it does not.
 4. Follow only the corresponding canonical runbook section.
 5. Read back the resulting state and update the private record before advancing.
 
-Separate authorization is required for each applicable preparation dispatch,
-pull-request submission, merge, protected publication approval, registry
-metadata change, workflow rerun, deployment action, and recovery mutation. A
-general request to "release" is not standing approval for later irreversible
-steps.
-
-Never publish locally, collect registry credentials, add a long-lived publishing
-token, manufacture a release trigger, push or move a version tag, rewrite a
-shared branch, create public release state from an arbitrary ref, or weaken a
-hosted protection to make progress.
+Identify the authorized preparation, pull-request, merge, publication, registry,
+deployment, and recovery stages explicitly. Do not widen an ordinary Git request
+into a release or a nightly request into a stable release. Required hosted reviews
+still apply even when the user authorizes a complete delivery. A scheduled nightly
+uses its reviewed unattended workflow; do not insert an interactive approval into
+that workflow or bypass the distinct stable publication controls.
+
+Never publish locally, collect credentials in conversation or release notes,
+manufacture a release trigger, push or move a version tag, rewrite a shared branch,
+or create public release state from an arbitrary ref. Changes to hosted controls
+or credential policy require an explicitly authorized, reviewed migration; a
+failed release is not permission to improvise one. Do not introduce an npm token
+or a secondary dist-tag write into the nightly path. The first stable release
+owns the future transition of `latest` to stable.
 
 ## Follow the selected phase
 

.agents/skills/release-to-npm/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "Release to npm"
-  short_description: "Coordinate protected npm releases"
-  default_prompt: "Use $release-to-npm to classify the requested release phase, load the repository runbook, and pause before every external mutation."
+  short_description: "Coordinate and verify npm release stages"
+  default_prompt: "Use $release-to-npm to load the current release runbook, complete the authorized release stages, and verify exact public package and site identities."

.agents/skills/release-to-npm/references/litefold-calendar.md

@@ -17,12 +17,11 @@ Stop before a hosted mutation when any normalized identity differs.
 | Need | Read |
 | --- | --- |
 | Supported release policy and invariants | [Release policy](../../../../docs/releasing.md) |
-| Normal operator procedure and private release record | [Alpha release operations](../../../../docs/release-operations.md) |
+| Normal operator procedure and private release record | [Nightly release operations](../../../../docs/release-operations.md) |
 | Hosted controls, unsupported transitions, exceptional actions, and recovery | [Release administration](../../../../docs/release-administration.md) |
 | Artifact, installed-package, registry, signature, and provenance evidence | [Package verification](../../../../docs/package-verification.md) |
 | Release-linked example deployment and rollback | [Static example deployment](../../../../docs/example-deployment.md) |
-| Executable preparation state machine | [Prepare alpha release workflow](../../../../.github/workflows/prepare-alpha.yml) |
-| Executable publication state machine | [Publish alpha release workflow](../../../../.github/workflows/publish-alpha.yml) |
+| Executable nightly snapshot and publication state machine | [Publish nightly workflow](../../../../.github/workflows/publish-nightly.yml) |
 
 Read the current phase in its canonical owner immediately before acting. The
 documents and workflows override remembered behavior and this routing file.
@@ -39,3 +38,11 @@ Use only the supported transition described by current release administration.
 If a requested state has no reviewed procedure, stop and require a separately
 designed and approved one. Describe recovery by the observed state and required
 identity evidence, without relying on release chronology.
+
+Nightly publication snapshots reviewed `main` without a daily metadata commit.
+Its workflow owns generated versions, exact artifact retention, OIDC publication
+under `nightly`, and repeat-run recovery. It uses no npm token and verifies that
+`latest` remains unchanged. Preserve historical alpha state. Stable
+publication is a separate procedure and must not be inferred from a nightly
+request. The [delivery checklist](../../../../docs/change-delivery.md) connects
+ordinary source changes with final package and Pages verification.

.github/workflows/ci.yml

@@ -50,13 +50,13 @@ jobs:
         run: npm ci --ignore-scripts
 
       - name: Install pinned Playwright browsers
-        run: npx playwright install --with-deps chromium firefox webkit
+        run: npx playwright install --with-deps chromium webkit
 
-      - name: Run the complete local quality gate
+      - name: Run the CI quality gate
         run: npm run check
 
-      - name: Upload browser diagnostics on failure
-        if: failure()
+      - name: Upload browser results and failure diagnostics
+        if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: browser-diagnostics-${{ github.run_id }}

.github/workflows/deploy-examples.yml

@@ -4,7 +4,7 @@ on:
   workflow_run:
     workflows:
       - CI
-      - Publish npm alpha
+      - Publish npm nightly
     types:
       - completed
     branches:
@@ -29,7 +29,7 @@ jobs:
       ${{
         github.event_name == 'workflow_run' &&
         github.event.workflow_run.conclusion == 'success' &&
-        github.event.workflow_run.event == 'push' &&
+        (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule' || github.event.workflow_run.event == 'workflow_dispatch') &&
         github.event.workflow_run.head_branch == 'main' &&
         github.event.workflow_run.head_repository.full_name == github.repository
       }}
@@ -38,6 +38,7 @@ jobs:
 
     permissions:
       contents: read
+      actions: read
 
     outputs:
       channel: ${{ steps.identity.outputs.channel }}
@@ -62,6 +63,8 @@ jobs:
           LFC_UPSTREAM_WORKFLOW: ${{ github.event.workflow_run.name }}
           LFC_UPSTREAM_WORKFLOW_PATH: ${{ github.event.workflow_run.path }}
           LFC_WORKFLOW_RUN_SHA: ${{ github.event.workflow_run.head_sha }}
+          LFC_UPSTREAM_RUN_ID: ${{ github.event.workflow_run.id }}
+          LFC_UPSTREAM_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
         run: |
           set -euo pipefail
 
@@ -77,16 +80,18 @@ jobs:
             "${upstream_workflow_path}" == ".github/workflows/ci.yml" &&
             "${LFC_UPSTREAM_EVENT}" == "push" ]]; then
             channel="main"
-          elif [[ "${LFC_UPSTREAM_WORKFLOW}" == "Publish npm alpha" &&
-            "${upstream_workflow_path}" == ".github/workflows/publish-alpha.yml" &&
-            "${LFC_UPSTREAM_EVENT}" == "push" ]]; then
-            parent_version="$(git show HEAD^1:package.json | jq --exit-status --raw-output '.version')"
-            if [[ "${version}" == "${parent_version}" ]]; then
-              eligible=false
-              channel=""
-            else
-              channel="release"
-            fi
+          elif [[ "${LFC_UPSTREAM_WORKFLOW}" == "Publish npm nightly" &&
+            "${upstream_workflow_path}" == ".github/workflows/publish-nightly.yml" &&
+            ( "${LFC_UPSTREAM_EVENT}" == "schedule" || "${LFC_UPSTREAM_EVENT}" == "workflow_dispatch" ) ]]; then
+            channel="release"
+            base_version="${version}"
+            created_at="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${LFC_UPSTREAM_RUN_ID}" --jq '.created_at')"
+            printf 'LFC_BROWSER_TARGET_DATE=%s\n' "${created_at:0:10}" >> "${GITHUB_ENV}"
+            stamp="$(date -u --date="${created_at}" +%Y%m%d%H%M%S)"
+            version="${base_version%-nightly.0}-nightly.${stamp}.${LFC_UPSTREAM_RUN_ID}"
+            run_jobs="$(gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/runs/${LFC_UPSTREAM_RUN_ID}/attempts/${LFC_UPSTREAM_RUN_ATTEMPT}/jobs?per_page=100" --jq '.jobs[] | select(.name == "Publish the verified GitHub prerelease") | .conclusion')"
+            if [[ "${run_jobs}" == "skipped" ]]; then eligible=false; channel="";
+            elif [[ "${run_jobs}" != "success" ]]; then echo 'Publisher finalization is unproven.' >&2; exit 1; fi
           else
             echo "Unexpected upstream workflow identity: ${LFC_UPSTREAM_WORKFLOW} (${LFC_UPSTREAM_WORKFLOW_PATH})" >&2
             exit 1
@@ -95,8 +100,8 @@ jobs:
           if [[ "${eligible}" == "true" && "${channel}" == "release" ]]; then
             release_ref="v${version}"
             channel="release"
-            if [[ ! "${version}" =~ ^0\.[0-9]+\.[0-9]+-alpha\.[0-9]+$ ]]; then
-              echo "A changed release version must be an exact supported alpha." >&2
+            if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-nightly\.[0-9]{14}\.[0-9]+$ ]]; then
+              echo "A changed release version must be an exact generated nightly." >&2
               exit 1
             fi
             test "$(git rev-parse --verify "${release_ref}^{commit}")" = "${source_commit}"
@@ -105,6 +110,18 @@ jobs:
               .draft == false and .prerelease == true and .immutable == true and
               .tag_name == $tag and .target_commitish == $commit
             ' <<< "${release}" > /dev/null
+            gh release download "${release_ref}" --repo "${GITHUB_REPOSITORY}" --pattern package-verification.json --dir "${RUNNER_TEMP}/nightly-receipt"
+            receipt="${RUNNER_TEMP}/nightly-receipt/package-verification.json"
+            expected_digest="$(jq -er '.assets[] | select(.name == "package-verification.json") | .digest | sub("^sha256:"; "")' <<< "${release}")"
+            test "$(sha256sum "${receipt}" | cut -d ' ' -f 1)" = "${expected_digest}"
+            jq --exit-status --arg sha "${source_commit}" --arg version "${version}" --arg base "${base_version}" --arg run "${LFC_UPSTREAM_RUN_ID}" '
+              .schemaVersion == 2 and .name == "@tryagaindev/litefold-calendar" and
+              .sourceCommit == $sha and .version == $version and .sourceVersion == $base and
+              .sourceTreeDirty == false and .manifestTransform == "version-only" and
+              .nightly.runId == $run and .nightly.sourceCommit == $sha and .nightly.version == $version and
+              .nightly.workflow == ".github/workflows/publish-nightly.yml"
+            ' "${receipt}" > /dev/null
+            printf 'LFC_NIGHTLY_RECEIPT=%s\n' "${receipt}" >> "${GITHUB_ENV}"
           fi
 
           printf 'eligible=%s\n' "${eligible}" >> "${GITHUB_OUTPUT}"