Enable npm provenance and prepare the OIDC activation release

.github/workflows/npm-release.yml

@@ -84,6 +84,8 @@ jobs:
           name: npm-packages
           path: dist/npm/
       # npm exchanges GitHub's identity for a short-lived publish token.
-      # No NPM_TOKEN or NODE_AUTH_TOKEN. Private source repos cannot attest provenance.
+      # Public source and packages support attestations without an npm token secret.
       - name: Publish verified artifacts in dependency order
+        env:
+          NPM_CONFIG_PROVENANCE: "true"
         run: node tools/npm/publish.mjs

README.md

@@ -85,7 +85,7 @@ with `--allow-host-execution` on a disposable research machine.
 
 ## Development and delivery
 
-The canonical repository is the private [`vibefield/rosetta`](https://github.com/vibefield/rosetta).
+The canonical repository is the public [`vibefield/rosetta`](https://github.com/vibefield/rosetta).
 Use a feature branch and pull request, then squash merge after **CI passed** succeeds.
 CI runs on pull requests and `main`, and can be started manually. It checks workflow
 syntax, the committed ground-truth artifacts, Python tests, Rust formatting, Clippy
@@ -131,8 +131,11 @@ npm trust github @vibefield/rosetta-protocol --repo vibefield/rosetta --file npm
 npm trust github @vibefield/rosetta-room --repo vibefield/rosetta --file npm-release.yml --allow-publish --yes
 ```
 
-Trust setup may require account 2FA. Future releases use GitHub-hosted OIDC without
-an npm token secret. The source repository is private, so npm provenance is disabled.
+Trust setup may require account 2FA. A new trusted publisher must complete its first
+successful publish within two days or it expires; a manual dry run does not activate
+it. See [npm's trusted-publisher requirements](https://docs.npmjs.com/trusted-publishers/#trusted-publisher-configuration-expiry).
+Future releases use GitHub-hosted OIDC without an npm token secret. The public source
+repository supports npm provenance, which the publish job explicitly enables.
 The **npm release** workflow publishes only on `npm-v*` tag pushes; a manual run is
 a complete dry run. It checks main ancestry, stable tag/version agreement, all CI,
 and the exact tarballs before publishing protocol first and room second. Reruns skip
@@ -144,8 +147,8 @@ through **CI passed**. Tag that main
 commit, using its version (for example):
 
 ```sh
-git tag -a npm-v0.1.1 -m 'Rosetta npm 0.1.1'
-git push origin npm-v0.1.1
+git tag -a npm-v0.1.2 -m 'Rosetta npm 0.1.2'
+git push origin npm-v0.1.2
 ```
 
 Use `gh workflow run npm-release.yml --ref main` to verify a release without publishing.
@@ -185,9 +188,9 @@ if a draft needs correction, delete only that unpublished draft before rerunning
 Manual workflow runs never publish, even when dispatched against a tag. No cloud
 account, deployment secrets, or automatic desktop updater is configured here.
 
-Private-repository branch protection requires GitHub Team for the organization.
-On the current Free plan, **CI passed is visible but not enforced**: users with write
-access can still push or merge directly. After upgrading, apply the prepared policy:
+The public repository enforces **CI passed** and pull requests on `main`, including
+for administrators. The policy is recorded in `.github/main-protection.json`; to
+reapply it:
 
 ```sh
 gh api --method PUT repos/vibefield/rosetta/branches/main/protection \

clients/app/package.json

@@ -39,8 +39,8 @@
     "@vibecook/mille-ui": "^0.3.4",
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
-    "@vibefield/rosetta-protocol": "^0.1.0",
-    "@vibefield/rosetta-room": "^0.1.0"
+    "@vibefield/rosetta-protocol": "^0.1.1",
+    "@vibefield/rosetta-room": "^0.1.1"
   },
   "devDependencies": {
     "@types/react": "^19.2.14",

clients/room/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibefield/rosetta-room",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "rosetta's History room as a package: the projects, sessions and worktree columns, the panels and charts, and the transcript, behind injected ports. It dials nothing.",
   "main": "./dist/index.js",
@@ -35,7 +35,7 @@
     "@radix-ui/react-context-menu": "^2.3.7",
     "@radix-ui/react-dialog": "^1.1.23",
     "@radix-ui/react-tooltip": "^1.2.16",
-    "@vibefield/rosetta-protocol": "^0.1.0",
+    "@vibefield/rosetta-protocol": "^0.1.1",
     "@tanstack/react-virtual": "^3.14.10",
     "@vibecook/mille": "^0.3.4",
     "@vibecook/mille-ui": "^0.3.4"

clients/ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibefield/rosetta-protocol",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

tools/npm/publish.mjs

@@ -41,7 +41,7 @@ for (const pkg of packages) {
   }
 }
 for (const pkg of pending) {
-  execFileSync("npm", ["publish", pkg.tarball, "--access=public", "--ignore-scripts", "--workspaces=false", "--provenance=false", registry], { stdio: "inherit" });
+  execFileSync("npm", ["publish", pkg.tarball, "--access=public", "--ignore-scripts", "--workspaces=false", registry], { stdio: "inherit" });
   let verified = false;
   for (let attempt = 0; attempt < 60; attempt++) {
     const integrity = await publishedIntegrity(pkg);