ci: separate fast feedback from full qualification

Scope main pushes from a successful ancestor so canceled runs cannot hide changes. Keep the complete portable suite in fast feedback and move coverage plus Intel macOS to hourly, manual, explicit-full, and release qualification. Let qualification finish independently of superseded feedback.

Bind publication to full qualification at its exact revision and publish the verified tarball after checking workflow identity, version, and SHA-256. Keep trusted cache writers and reject incomplete merged test inventories.

Validation: 151 focused CI tests; typecheck/lint; actionlint 1.7.7; knip; all 1044 files discovered; bounded blob/merge smoke; macOS package verifier with retention and cleanup; npm pack dry run. Native Linux/ARM/Windows and remote workflow execution remain CI verification.

scripts/ci/baseline.mjs

@@ -0,0 +1,76 @@
+import { execFileSync } from "node:child_process";
+import { appendFileSync } from "node:fs";
+
+const repository = process.env.CI_REPOSITORY;
+const branch = process.env.CI_DEFAULT_BRANCH;
+const head = process.env.HEAD_SHA;
+const shaPattern = /^[0-9a-f]{40}$/i;
+
+function ancestor(base) {
+  try {
+    execFileSync("git", ["merge-base", "--is-ancestor", base, head], {
+      stdio: "ignore",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function write(base, reason) {
+  const output = { base, reason };
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(
+      process.env.GITHUB_OUTPUT,
+      `base=${base}\nreason=${reason.replace(/[\r\n]/g, " ")}\n`,
+    );
+  }
+  console.log(JSON.stringify(output));
+}
+
+if (!repository || !branch || !head || !shaPattern.test(head)) {
+  write("", "Repository, default branch, or checked-out head is invalid");
+} else {
+  try {
+    const response = execFileSync(
+      "gh",
+      [
+        "api",
+        "--method",
+        "GET",
+        `repos/${repository}/actions/workflows/ci.yml/runs`,
+        "-f",
+        `branch=${branch}`,
+        "-f",
+        "event=push",
+        "-f",
+        "status=success",
+        "-F",
+        "per_page=100",
+      ],
+      { encoding: "utf8", timeout: 15_000, maxBuffer: 4 * 1024 * 1024 },
+    );
+    const runs = JSON.parse(response).workflow_runs;
+    if (!Array.isArray(runs))
+      throw new Error("GitHub returned no workflow run list");
+    const base = runs.find(
+      (run) =>
+        run?.event === "push" &&
+        run?.conclusion === "success" &&
+        run?.head_branch === branch &&
+        run?.head_repository?.full_name === repository &&
+        typeof run?.head_sha === "string" &&
+        shaPattern.test(run.head_sha) &&
+        run.head_sha.toLowerCase() !== head.toLowerCase() &&
+        ancestor(run.head_sha),
+    )?.head_sha;
+    if (base) write(base, "");
+    else
+      write(
+        "",
+        "No trusted successful CI push baseline is an ancestor of this head",
+      );
+  } catch {
+    write("", "Could not read a successful CI push baseline from GitHub");
+  }
+}

scripts/ci/plan.mjs

@@ -108,98 +108,123 @@ function classifyPackage(base, head) {
 }
 
 const event = process.env.GITHUB_EVENT_NAME;
-let files = [];
-if (
-  event === "push" ||
+if (!["pull_request", "push", "schedule", "workflow_dispatch"].includes(event))
+  throw new Error(`Unsupported CI event: ${event}`);
+const tier =
   event === "schedule" ||
   event === "workflow_dispatch" ||
   process.env.CI_FULL === "true"
-) {
+    ? "full"
+    : "fast";
+let files = [];
+if (tier === "full") {
   full("Full baseline requested by event or ci:full label");
-} else if (event === "pull_request") {
-  const base = git("merge-base", process.env.BASE_SHA, process.env.HEAD_SHA);
+} else if (event === "pull_request" || event === "push") {
   const head = process.env.HEAD_SHA;
-  // Disable rename detection so both the removed and added paths participate.
-  files = git("diff", "--name-only", "--no-renames", "-z", base, head)
-    .split("\0")
-    .filter(Boolean);
-  for (const file of files) {
-    if (
-      /^(README(?:_[^/]+)?\.md|AGENTS\.md|CONTRIBUTING\.md|CHANGELOG\.md|SECURITY\.md|native\/windows\/README\.md|\.github\/pull_request_template\.md)$/.test(
-        file,
-      ) ||
-      file.startsWith("docs/") ||
-      file.startsWith(".github/ISSUE_TEMPLATE/")
-    ) {
-      selected.docs = true;
-      selected.website ||= matchesAny(file, SCOPES.website);
-      continue;
-    }
-    if (/^(src|tests)\/.*\.(?:test|spec)\.[cm]?[jt]sx?$/.test(file)) {
-      selected.code = true;
-      for (const owner of NATIVE_TEST_OWNERS)
-        selected[owner] ||= matchesAny(file, SCOPES[owner]);
-      continue;
-    }
-    if (matchesAny(file, MANUAL_VERIFIERS)) {
-      selected.code = true;
-      continue;
-    }
-    const owners = Object.entries(SCOPES)
-      .filter(([, patterns]) =>
-        patterns.some((pattern) => matchesGlob(file, pattern)),
-      )
-      .map(([owner]) => owner);
-    for (const owner of owners) selected[owner] = true;
-    if (
-      file.startsWith(".github/workflows/") ||
-      file === ".github/actionlint.yaml"
-    ) {
-      selected.workflows = true;
-      if (GUARDED_WORKFLOWS.has(file)) selected.code = true;
-      if (file !== ".github/workflows/ci.yml") continue;
-    }
-    if (owners.length === 1 && owners[0] === "website") continue;
-    if (/^src\/(contracts|domain)\//.test(file)) selected.docs = true;
-    if (file === "package.json") {
-      classifyPackage(base, head);
-      continue;
-    }
-    selected.code = true;
-    if (matchesAny(file, FIXTURE_SOURCES)) {
-      selected.fixtures = true;
-      selected.readiness = true;
-    }
-    if (matchesAny(file, READINESS_SOURCES)) selected.readiness = true;
-    if (file.startsWith("tests/")) continue;
-    if (
-      /^(src\/process\/|src\/filesystem\/|src\/contracts\/tool|src\/server\/createServer|src\/cli\.ts|scripts\/ci\/)/.test(
-        file,
-      )
-    ) {
-      full(`Shared boundary: ${file}`);
-    } else if (owners.length) {
-      if (file.startsWith("src/") || file.startsWith("bridge/"))
-        selected.runtime = true;
-    } else if (/^(src|bridge)\//.test(file)) {
-      // Unowned runtime sources keep the Linux x64 installed-package baseline;
-      // ci:full, main pushes and manual dispatch retain every native host.
-      selected.runtime = true;
-      reasons.push(`Unowned runtime source: ${file}`);
-    } else if (file.startsWith(".agents/skills/")) {
-      selected.runtime = true;
-      selected.docs = true;
-    } else {
-      full(`Unclassified input: ${file}`);
+  let base;
+  if (event === "pull_request") {
+    base = git("merge-base", process.env.BASE_SHA, head);
+  } else {
+    const candidate = process.env.BASE_SHA;
+    const baselineReason = process.env.BASELINE_REASON;
+    try {
+      if (!candidate || !/^[0-9a-f]{40}$/i.test(candidate))
+        throw new Error(
+          baselineReason || "No valid successful push baseline was found",
+        );
+      execFileSync("git", ["merge-base", "--is-ancestor", candidate, head], {
+        stdio: "ignore",
+      });
+      base = candidate;
+    } catch {
+      full(
+        baselineReason ||
+          "No valid successful push baseline ancestor; selecting all lanes",
+      );
     }
   }
-} else throw new Error(`Unsupported CI event: ${event}`);
+  if (base) {
+    // Disable rename detection so both the removed and added paths participate.
+    files = git("diff", "--name-only", "--no-renames", "-z", base, head)
+      .split("\0")
+      .filter(Boolean);
+    for (const file of files) {
+      if (
+        /^(README(?:_[^/]+)?\.md|AGENTS\.md|CONTRIBUTING\.md|CHANGELOG\.md|SECURITY\.md|native\/windows\/README\.md|\.github\/pull_request_template\.md)$/.test(
+          file,
+        ) ||
+        file.startsWith("docs/") ||
+        file.startsWith(".github/ISSUE_TEMPLATE/")
+      ) {
+        selected.docs = true;
+        selected.website ||= matchesAny(file, SCOPES.website);
+        continue;
+      }
+      if (/^(src|tests)\/.*\.(?:test|spec)\.[cm]?[jt]sx?$/.test(file)) {
+        selected.code = true;
+        for (const owner of NATIVE_TEST_OWNERS)
+          selected[owner] ||= matchesAny(file, SCOPES[owner]);
+        continue;
+      }
+      if (matchesAny(file, MANUAL_VERIFIERS)) {
+        selected.code = true;
+        continue;
+      }
+      const owners = Object.entries(SCOPES)
+        .filter(([, patterns]) =>
+          patterns.some((pattern) => matchesGlob(file, pattern)),
+        )
+        .map(([owner]) => owner);
+      for (const owner of owners) selected[owner] = true;
+      if (
+        file.startsWith(".github/workflows/") ||
+        file === ".github/actionlint.yaml"
+      ) {
+        selected.workflows = true;
+        if (GUARDED_WORKFLOWS.has(file)) selected.code = true;
+        if (file !== ".github/workflows/ci.yml") continue;
+      }
+      if (owners.length === 1 && owners[0] === "website") continue;
+      if (/^src\/(contracts|domain)\//.test(file)) selected.docs = true;
+      if (file === "package.json") {
+        classifyPackage(base, head);
+        continue;
+      }
+      selected.code = true;
+      if (matchesAny(file, FIXTURE_SOURCES)) {
+        selected.fixtures = true;
+        selected.readiness = true;
+      }
+      if (matchesAny(file, READINESS_SOURCES)) selected.readiness = true;
+      if (file.startsWith("tests/")) continue;
+      if (
+        /^(src\/process\/|src\/filesystem\/|src\/contracts\/tool|src\/server\/createServer|src\/cli\.ts|scripts\/ci\/)/.test(
+          file,
+        )
+      ) {
+        full(`Shared boundary: ${file}`);
+      } else if (owners.length) {
+        if (file.startsWith("src/") || file.startsWith("bridge/"))
+          selected.runtime = true;
+      } else if (/^(src|bridge)\//.test(file)) {
+        // Unowned runtime sources keep the Linux x64 installed-package baseline;
+        // full qualification retains every native host.
+        selected.runtime = true;
+        reasons.push(`Unowned runtime source: ${file}`);
+      } else if (file.startsWith(".agents/skills/")) {
+        selected.runtime = true;
+        selected.docs = true;
+      } else {
+        full(`Unclassified input: ${file}`);
+      }
+    }
+  }
+}
 selected.runtime ||= selected.package;
 const linux = { os: "ubuntu-latest", platform: "linux", architecture: "x64" };
-// macOS x64 is the slowest package host. Pull requests run it only with ci:full;
-// main pushes, schedules and manual dispatch always include it.
+// macOS x64 is the slowest package host. Fast qualification omits it.
 const intel =
-  event !== "pull_request" || process.env.CI_FULL === "true"
+  tier === "full"
     ? [{ os: "macos-15-intel", platform: "darwin", architecture: "x64" }]
     : [];
 const matrix = {
@@ -212,17 +237,17 @@ const matrix = {
       ]
     : [linux],
 };
-const plan = { ...selected, matrix, files, reasons };
+const plan = { ...selected, tier, matrix, files, reasons };
 if (process.env.GITHUB_OUTPUT)
   appendFileSync(
     process.env.GITHUB_OUTPUT,
-    Object.entries({ ...selected, matrix: JSON.stringify(matrix) })
+    Object.entries({ ...selected, tier, matrix: JSON.stringify(matrix) })
       .map(([key, value]) => `${key}=${value}\n`)
       .join(""),
   );
 if (process.env.GITHUB_STEP_SUMMARY)
   appendFileSync(
     process.env.GITHUB_STEP_SUMMARY,
-    `### Selected CI lanes\n\n${flags.filter((flag) => selected[flag]).join(", ") || "Formatting only"}\n\n${reasons.join("\n\n")}\n`,
+    `### Selected CI lanes (${tier})\n\n${flags.filter((flag) => selected[flag]).join(", ") || "Formatting only"}\n\n${reasons.join("\n\n")}\n`,
   );
 console.log(JSON.stringify(plan));

scripts/ci/test-report.mjs

@@ -1,3 +1,4 @@
+import { execFileSync } from "node:child_process";
 import { appendFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 
@@ -42,6 +43,26 @@ const passed =
   process.env.MERGE_RESULT === "success" &&
   report.success &&
   report.numFailedTests === 0;
+// Successful shards and merged reports must account for the complete portable
+// inventory. Coverage thresholds alone cannot prove that every file ran.
+if (passed && process.env.CI_VERIFY_TEST_INVENTORY === "true") {
+  const expected = execFileSync(
+    "git",
+    ["ls-files", "-z", "--", "src", "tests"],
+    { encoding: "utf8", maxBuffer: 8 * 1024 * 1024 },
+  )
+    .split("\0")
+    .filter((path) => path.endsWith(".test.ts"));
+  const actual = files.map(({ name }) => name);
+  const expectedSet = new Set(expected);
+  const actualSet = new Set(actual);
+  const missing = expected.filter((path) => !actualSet.has(path));
+  const unexpected = actual.filter((path) => !expectedSet.has(path));
+  if (missing.length || unexpected.length || actualSet.size !== actual.length)
+    throw new Error(
+      `Incomplete portable test inventory: ${JSON.stringify({ missing, unexpected, duplicateFiles: actual.length - actualSet.size })}`,
+    );
+}
 const summary = [
   complete ? "## Merged test diagnostics" : "## Partial test diagnostics",
   "",

scripts/ci/verified-package.mjs

@@ -0,0 +1,235 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { execFile } from "node:child_process";
+import { copyFile, readFile, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+
+const MANIFEST_NAME = "manifest.json";
+const TARBALL_NAME = "package.tgz";
+const MANIFEST_KEYS = [
+  "schemaVersion",
+  "sourceSha",
+  "runId",
+  "runAttempt",
+  "platform",
+  "architecture",
+  "packageVersion",
+  "nodeVersion",
+  "sha256",
+].sort();
+const execFileAsync = promisify(execFile);
+
+/** Normalize workflow identity and host facts into the manifest-owned fields. */
+export function createVerifiedPackageMetadata({
+  sourceSha,
+  runId,
+  runAttempt,
+  platform,
+  architecture,
+  packageVersion,
+  nodeVersion,
+}) {
+  if (!/^[a-f0-9]{40}$/u.test(sourceSha))
+    throw new Error("Source SHA must be a full commit SHA");
+  return {
+    sourceSha,
+    runId: parsePositiveInteger(runId, "GITHUB_RUN_ID"),
+    runAttempt: parsePositiveInteger(runAttempt, "GITHUB_RUN_ATTEMPT"),
+    platform,
+    architecture,
+    packageVersion,
+    nodeVersion,
+  };
+}
+
+/** Build the single supported manifest representation for a verified tarball. */
+function createVerifiedPackageManifest(metadata) {
+  const manifest = { schemaVersion: 1, ...metadata };
+  validateManifestShape(manifest);
+  return manifest;
+}
+
+/** Write a manifest after the caller has completed qualification and cleanup. */
+export async function writeVerifiedPackageManifest(directory, metadata) {
+  const manifest = createVerifiedPackageManifest(metadata);
+  await writeFile(
+    join(directory, MANIFEST_NAME),
+    `${JSON.stringify(manifest, null, 2)}\n`,
+    { encoding: "utf8" },
+  );
+  return manifest;
+}
+
+/** Copy the qualified archive under its fixed name and prepare its manifest. */
+export async function retainVerifiedPackage({
+  sourceTarball,
+  directory,
+  metadata,
+}) {
+  const tarball = join(directory, TARBALL_NAME);
+  await copyFile(sourceTarball, tarball);
+  const sha256 = await sha256File(tarball);
+  return {
+    directory,
+    metadata: createVerifiedPackageManifest({ ...metadata, sha256 }),
+  };
+}
+
+/** Validate a retained package against the current checkout and workflow attempt. */
+async function validateVerifiedPackage({
+  directory,
+  sourceSha,
+  runId,
+  runAttempt,
+  packageVersion,
+  nodeVersion,
+}) {
+  if (!/^[a-f0-9]{40}$/u.test(sourceSha))
+    throw new Error("Expected source SHA must be a full commit SHA");
+  if (!Number.isSafeInteger(runId) || runId <= 0)
+    throw new Error("Expected workflow run ID must be a positive integer");
+  if (!Number.isSafeInteger(runAttempt) || runAttempt <= 0)
+    throw new Error("Expected workflow run attempt must be a positive integer");
+  const manifestPath = join(directory, MANIFEST_NAME);
+  let manifest;
+  try {
+    manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+  } catch (cause) {
+    throw new Error(`Could not read verified package manifest: ${cause}`, {
+      cause,
+    });
+  }
+  validateManifestShape(manifest);
+  assertEqual(manifest.sourceSha, sourceSha, "source SHA");
+  assertEqual(manifest.runId, runId, "workflow run ID");
+  // A successful producer may belong to an earlier attempt when only failed
+  // publisher jobs are rerun. The workflow still requires same-run qualification.
+  if (manifest.runAttempt > runAttempt)
+    throw new Error("Verified package workflow run attempt is from the future");
+  assertEqual(manifest.platform, "linux", "verifier platform");
+  assertEqual(manifest.architecture, "x64", "verifier architecture");
+  assertEqual(manifest.packageVersion, packageVersion, "package version");
+  assertEqual(manifest.nodeVersion, nodeVersion, "Node.js version");
+
+  // The artifact format deliberately fixes the name; no manifest value can
+  // redirect validation to another path.
+  const tarball = resolve(directory, TARBALL_NAME);
+  const digest = await sha256File(tarball);
+  assertEqual(manifest.sha256, digest, "tarball SHA-256");
+  return tarball;
+}
+
+function validateManifestShape(manifest) {
+  if (
+    typeof manifest !== "object" ||
+    manifest === null ||
+    Array.isArray(manifest)
+  )
+    throw new Error("Verified package manifest must be a JSON object");
+  const keys = Object.keys(manifest).sort();
+  if (
+    keys.length !== MANIFEST_KEYS.length ||
+    keys.some((key, index) => key !== MANIFEST_KEYS[index])
+  )
+    throw new Error("Verified package manifest has missing or unknown fields");
+  if (manifest.schemaVersion !== 1)
+    throw new Error("Unsupported verified package manifest schema version");
+  if (
+    typeof manifest.sourceSha !== "string" ||
+    !/^[a-f0-9]{40}$/u.test(manifest.sourceSha)
+  )
+    throw new Error("Verified package manifest has an invalid source SHA");
+  if (!Number.isSafeInteger(manifest.runId) || manifest.runId <= 0)
+    throw new Error("Verified package manifest has an invalid workflow run ID");
+  if (!Number.isSafeInteger(manifest.runAttempt) || manifest.runAttempt <= 0)
+    throw new Error(
+      "Verified package manifest has an invalid workflow run attempt",
+    );
+  for (const key of [
+    "platform",
+    "architecture",
+    "packageVersion",
+    "nodeVersion",
+  ])
+    if (typeof manifest[key] !== "string" || manifest[key].length === 0)
+      throw new Error(`Verified package manifest has an invalid ${key}`);
+  if (
+    typeof manifest.sha256 !== "string" ||
+    !/^[a-f0-9]{64}$/u.test(manifest.sha256)
+  )
+    throw new Error("Verified package manifest has an invalid tarball SHA-256");
+}
+
+function assertEqual(actual, expected, label) {
+  if (actual !== expected)
+    throw new Error(`Verified package ${label} mismatch`);
+}
+
+async function sha256File(path) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+}
+
+async function validateFromCli(directory) {
+  const sourceSha = process.env.GITHUB_SHA;
+  const runId = parsePositiveInteger(
+    process.env.GITHUB_RUN_ID,
+    "GITHUB_RUN_ID",
+  );
+  const runAttempt = parsePositiveInteger(
+    process.env.GITHUB_RUN_ATTEMPT,
+    "GITHUB_RUN_ATTEMPT",
+  );
+  if (sourceSha === undefined || !/^[a-f0-9]{40}$/u.test(sourceSha))
+    throw new Error("GITHUB_SHA must be a full commit SHA");
+  const checkoutSha = (
+    await execFileAsync("git", ["rev-parse", "HEAD"])
+  ).stdout.trim();
+  assertEqual(checkoutSha, sourceSha, "checked out source SHA");
+  const packageJson = JSON.parse(await readFile("package.json", "utf8"));
+  const tarball = await validateVerifiedPackage({
+    directory,
+    sourceSha,
+    runId,
+    runAttempt,
+    packageVersion: packageJson.version,
+    nodeVersion: process.version,
+  });
+  if (process.env.GITHUB_OUTPUT === undefined)
+    throw new Error(
+      "GITHUB_OUTPUT is required to publish the validated tarball path",
+    );
+  await writeFile(process.env.GITHUB_OUTPUT, `tarball=${tarball}\n`, {
+    encoding: "utf8",
+    flag: "a",
+  });
+  process.stdout.write(`${tarball}\n`);
+}
+
+function parsePositiveInteger(value, name) {
+  if (value === undefined || !/^[1-9]\d*$/u.test(value))
+    throw new Error(`${name} must be a positive integer`);
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed))
+    throw new Error(`${name} must be a safe positive integer`);
+  return parsed;
+}
+
+const invokedPath = process.argv[1];
+if (
+  invokedPath !== undefined &&
+  resolve(invokedPath) === fileURLToPath(import.meta.url)
+) {
+  const [command, directory, ...extra] = process.argv.slice(2);
+  if (command !== "validate" || directory === undefined || extra.length > 0) {
+    process.stderr.write(
+      "Usage: node scripts/ci/verified-package.mjs validate <artifact-directory>\n",
+    );
+    process.exitCode = 2;
+  } else {
+    await validateFromCli(directory);
+  }
+}

scripts/verify-package.mjs

@@ -1,6 +1,8 @@
-import { mkdtemp, rm } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, unlink } from "node:fs/promises";
+import { execFile } from "node:child_process";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { promisify } from "node:util";
 
 import { TOOL_CONTRACTS } from "../dist/contracts/toolContracts.js";
 import { PRODUCT_IDENTITY } from "../dist/identity.js";
@@ -21,12 +23,19 @@ import { verifyRepositorySkill } from "./verify-repository-skill.mjs";
 import { verifyManaged } from "./verify-package-managed.mjs";
 import { verifyUnknownProvider } from "./verify-package-unknown-provider.mjs";
 import { completeVerifierRun, createVerifierRun } from "./lib/verifier-run.mjs";
+import {
+  createVerifiedPackageMetadata,
+  retainVerifiedPackage,
+  writeVerifiedPackageManifest,
+} from "./ci/verified-package.mjs";
 import {
   measureMcpStartup,
   profileMcpModuleLoading,
 } from "./lib/mcp-startup-probe.mjs";
 
 const root = process.cwd();
+const execFileAsync = promisify(execFile);
+const retentionDirectory = process.env.REA_VERIFIED_PACKAGE_DIRECTORY;
 const verifierRun = createVerifierRun();
 const workspace = await mkdtemp(join(tmpdir(), "rea-package-"));
 const evidenceRoot = join(workspace, "evidence");
@@ -37,6 +46,8 @@ let mcpModuleLoading;
 let update;
 let repositorySkill;
 let report;
+let retainedPackage;
+let retentionMetadata;
 
 const runStage = async (name, action) => {
   const started = performance.now();
@@ -49,6 +60,27 @@ const runStage = async (name, action) => {
 };
 
 try {
+  if (retentionDirectory !== undefined && retentionDirectory !== "") {
+    const sourceSha = (
+      await execFileAsync("git", ["rev-parse", "HEAD"], { cwd: root })
+    ).stdout.trim();
+    retentionMetadata = createVerifiedPackageMetadata({
+      sourceSha,
+      runId: process.env.GITHUB_RUN_ID,
+      runAttempt: process.env.GITHUB_RUN_ATTEMPT,
+      platform: process.platform,
+      architecture: process.arch,
+      packageVersion: PRODUCT_IDENTITY.packageVersion,
+      nodeVersion: process.version,
+    });
+    await mkdir(retentionDirectory, { recursive: true });
+    await unlink(join(retentionDirectory, "manifest.json")).catch((cause) => {
+      if (
+        !(cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+      )
+        throw cause;
+    });
+  }
   repositorySkill = await runStage("repository skill", () =>
     verifyRepositorySkill({ root, workspace }),
   );
@@ -215,6 +247,13 @@ try {
     mcpStartup,
     mcpModuleLoading,
   };
+  if (retentionMetadata !== undefined) {
+    retainedPackage = await retainVerifiedPackage({
+      sourceTarball: tarball,
+      directory: retentionDirectory,
+      metadata: retentionMetadata,
+    });
+  }
 } finally {
   await runStage("workspace cleanup", () =>
     rm(workspace, { recursive: true, force: true }),
@@ -223,6 +262,11 @@ try {
 const verifierLineage = await runStage("verifier lineage", () =>
   completeVerifierRun(verifierRun),
 );
+if (retainedPackage !== undefined)
+  await writeVerifiedPackageManifest(
+    retainedPackage.directory,
+    retainedPackage.metadata,
+  );
 process.stdout.write(
   `${JSON.stringify({ verifier_run: verifierLineage, ...report })}\n`,
 );