fix(release): require signed agent review

[hasna-identity]

Summary

• remove the human/manual npm-release approval dependency while retaining the protected environment for scoped secrets
• require one fixed independent coding-agent Ed25519 receipt bound to the exact release candidate and zero open reachable P0/P1 blockers
• preserve tag, OIDC, deterministic build, provenance, staged verification, and promotion gates
• prepare the immutable forward release as @hasna/accounts@0.2.42; 0.2.41 remains unpublished

Verification

• focused release provenance: 63 pass, 0 fail
• full suite: 1635 pass, 1 skip, 0 fail
• PostgreSQL: 14 pass, 0 fail
• typecheck, compatibility, build, provenance crypto, contract scans/conformance, audit, deterministic pack: all pass
• Gitleaks staged and exact commit-range scans: no leaks

References OPE-00210.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #149 @ 2e7f5e8 — lens: correctness+security+gates, reviewer unresolved-account001 (1 of 1)

Exact candidate read

• Confirmed HEAD = 2e7f5e81516d990a2a637efaac2dfe49b6ab374b and origin/main = a7d6cb194495539cdf92c3ba37a45f03a95f752b.
• Read git log --oneline origin/main..HEAD, git diff origin/main...HEAD --stat, the full diff of all six changed files, and surrounding workflow, release-provenance, test, package, changelog, and release-documentation code.
• Changed files read: .github/workflows/release.yml, CHANGELOG.md, docs/RELEASING.md, package.json, scripts/release-provenance.test.ts, and scripts/release-provenance.ts.

Commands and gates

• bun install — exit 0. Setup only, not a repository test gate; 121 packages installed.
• bun run typecheck — exit 0. PASS; TypeScript emitted no diagnostic count.
• bun run test — exit 78. FAIL; no pass/fail counts were emitted because hasna-test-guard refused the unscoped Bun test when systemd user scopes were unavailable, so the declared suite did not start. I did not substitute bare bun test or a different command.

Blocking P0/P1 findings

1. P1, high confidence — the publishing administrator can replace the release-review trust root and forge the independent-review condition.

   The workflow reads RELEASE_REVIEWER_AGENT and RELEASE_REVIEW_PUBLIC_KEY from mutable npm-release environment variables (.github/workflows/release.yml:148-149, repeated before each preflight). The preflight simultaneously requires the triggering release actor to have repository admin permission (scripts/release-provenance.ts:1008) and accepts whatever live values those variables contain as the expected reviewer and Ed25519 trust root (scripts/release-provenance.ts:1344-1359). GitHub exposes an environment-variable update endpoint with Environments: write permission: https://docs.github.com/en/rest/actions/variables#update-an-environment-variable.

   Reachable path: an authorized release administrator generates a new key pair, changes both environment variables, posts a self-authored receipt signed by that key while naming a different reviewer string, and pushes the protected release tag. Signature validation, reviewer-name matching, and the string inequality between reviewer and publisher all pass. The release therefore has no independently controlled authority boundary, which defeats this PR's required agent-review gate.

   Required remedy: anchor the accepted reviewer trust root in an authority the publishing actor cannot mutate, or require a separately controlled machine-verifiable attestation over any trust-root change. Add an adversarial fixture/control demonstrating that a publisher-admin-controlled replacement key cannot authorize a release.

2. P1 gate failure — the repository-declared test gate is not green on the exact candidate.

   bun run test exited 78 before tests ran. The release cannot be accepted until the declared command executes and returns exit 0 with its pass/fail counts in the supported review environment; bypassing the guard or replacing the command is not equivalent evidence.

Non-blocking follow-ups

• None. I found no separate P2/P3 item worth recording from the reviewed diff.

Verdict: NO_GO. Leave the PR open. Fix the trust-root authority boundary and restore the declared test gate, then have this same review lane re-check only those two blockers and direct regressions at the new head.