publish-harness

publish-harness

Codex skill that runs the full smoke-test → witness-sign → npm publish pipeline for a generated harness.

What it does

1. Builds the harness with npm run build
2. Runs npm test to confirm green tests
3. Calls harness sign to produce a fresh witness manifest (requires WITNESS_SIGNING_KEY env)
4. Confirms harness verify accepts the freshly signed manifest
5. Either:
   • dry_run=true (default): runs npm publish --dry-run and reports tarball stats
   • dry_run=false: runs the real npm publish --provenance --access public

Usage from Codex

/publish-harness path=./my-harness
/publish-harness path=./my-harness dry_run=false

Equivalent CLI

cd ./my-harness
npm run build
npm test
harness sign
harness verify
npm publish --provenance --access public

Required env

• WITNESS_SIGNING_KEY — 64-hex-char ed25519 seed (fetch from GCP Secret Manager via harness secrets fetch WITNESS_SIGNING_KEY)
• NPM_TOKEN — npm registry credential (Codex skill assumes the host has it set, or fetches via harness secrets fetch NPM_TOKEN)

See also

• validate-harness — release-readiness gate (run this FIRST)
• harness-secrets — manage GCP-stored signing/publishing tokens