Answer prose round 1: 0 🔴, 4 🟡; name the package-repository checks, list the release secrets, and point each sentence at its actor

.github/workflows/packages.yml

@@ -45,21 +45,19 @@ jobs:
           path: src
           fetch-depth: 0
           persist-credentials: false
-      # The packaging config comes from the workflow's commit, so a tag cut before it
-      # existed can still be packaged.
+      # Check out the packaging config at the workflow's commit, so a tag cut before the
+      # config existed can still be packaged.
       - uses: actions/checkout@v7
         with:
           path: tooling
           persist-credentials: false
-      - name: The Go the gate tests
+      - name: The Go version the gate tests
         id: go
         run: sed -n 's/^ARG GO_VERSION=/version=/p' tooling/Dockerfile >> "$GITHUB_OUTPUT"
       - uses: actions/setup-go@v7
         with:
           go-version: ${{ steps.go.outputs.version }}
           cache: false
-      # The tap, the bucket, the AUR, the image's latest tag and the Linux repositories each
-      # hold one version, so only the latest release updates them.
       - name: Channels holding one version
         id: latest
         env:

AGENTS.md

@@ -1,6 +1,6 @@
 # Rules
 
-- Go runs only through `docker compose run --rm <test|vet|fmt|build|cyclo|generate>`; the merge gate is `docker build .` plus CI's changelog check, and, where a change touches the packaging, the package-repository checks the README's Development section shows.
+- Go runs only through `docker compose run --rm <test|vet|fmt|build|cyclo|generate>`; the merge gate is `docker build .`, CI's changelog check and, for a change the README's Development section lists, its package-repository checks.
 - Tests first, in their own commit; the implementation follows in the next. A re-pin of seeded output or of `testdata/shipped_shape.txt` is its own commit.
 - A change under `data/` or to the shape pin adds its `CHANGELOG.md` entry under `Unreleased` in the same PR, and so does a change to a flag, an exit code, an exported name, a fence, a builtin or the lowest Go; what is major is the README's Versioning table.
 - One-line commit messages: no ticket prefix, no repo name, no authorship trailers.

README.md

@@ -64,8 +64,8 @@ apk add fejkdata
 
 Each [release](https://github.com/larvit/fejkdata/releases) also carries the binaries for
 Linux, macOS and Windows on amd64 and arm64, and the `.deb`, `.rpm` and `.apk` packages.
-The binaries are not signed, so macOS refuses one a browser downloaded until
-`xattr -d com.apple.quarantine fejkdata` clears its quarantine flag.
+The binaries are unsigned. macOS refuses to run one a browser downloaded until you run
+`xattr -d com.apple.quarantine fejkdata`.
 
 ## CLI
 
@@ -1209,9 +1209,9 @@ supported Go, and must pass before it can be merged — unless it changes none o
 the files the build and its tests read, nor the workflow itself, in which case
 it's skipped. That build runs vet, complexity, the format check, the Go tests and the
 release tooling's tests; the rest of the gate is the changelog check, which CI runs
-against the PR base, and the package-repository checks below. Run it locally before
-pushing. The lowest Go builds the `portable` stage, which skips the format check and the
-release tooling's tests:
+against the PR base, and the package-repository checks below. Run `docker build .`
+locally before pushing. The lowest Go builds the `portable` stage, which skips the format
+check and the release tooling's tests:
 
 ```sh
 docker build .                                                  # latest
@@ -1220,9 +1220,9 @@ GO_VERSION=1.22.12 docker compose run --rm test                 # the same tests
 ```
 
 A change to Go code, `release-tooling/`, the `Dockerfile`, `.dockerignore`, the licence
-files or either workflow also builds the release binaries for every platform, the apt, dnf
-and apk repositories from their packages, signed with throwaway keys, and installs
-fejkdata from each:
+files or either workflow also runs the package-repository checks. They build the release
+binaries for every platform and the apt, dnf and apk repositories, sign the repositories
+with throwaway keys, and install fejkdata from each repository:
 
 ```sh
 docker build -f release-tooling/package-repos.Dockerfile --target throwaway-keys --output /tmp/fejkdata-keys .
@@ -1277,13 +1277,18 @@ docker compose run --rm --user "$(id -u):$(id -g)" data-import data-import/usera
 To release, head `CHANGELOG.md` with the version's section in place of `Unreleased`
 and merge: once `main` passes the gate, CI tags that commit `vX.Y.Z` and publishes
 the GitHub release with the section as its body. A top heading of `[Unreleased]`
-publishes nothing. The new release then runs the Packages workflow, which attaches the
+publishes nothing. CI then runs the Packages workflow on the new tag, which attaches the
 binaries and packages, pushes the image, updates the Homebrew tap, the Scoop bucket and
-the AUR, and deploys the apt, dnf and apk repositories to GitHub Pages. It reads the
-repository secrets `TAP_GITHUB_TOKEN`, a token that can push to `larvit/homebrew-tap` and
-`larvit/scoop-bucket`; `AUR_KEY`, the AUR account's SSH key; and `PACKAGES_GPG_KEY` and
-`PACKAGES_RSA_KEY`, the private keys that sign the repositories. The image's GHCR package
-must be public, and Pages must deploy from GitHub Actions. To package a release again,
+the AUR, and deploys the apt, dnf and apk repositories to GitHub Pages. The workflow reads
+these repository secrets:
+
+- `AUR_KEY`: the AUR account's SSH key.
+- `PACKAGES_GPG_KEY`, `PACKAGES_RSA_KEY`: the private keys that sign the repositories.
+- `TAP_GITHUB_TOKEN`: a token that can push to `larvit/homebrew-tap` and
+  `larvit/scoop-bucket`.
+
+The image's GHCR package must be public, and Pages must deploy from GitHub Actions. To
+package a release again,
 run the workflow by hand with its tag; it replaces what it uploaded before. For a tag older
 than the latest release it leaves the tap, the bucket, the AUR, the image's `latest` and
 the repositories alone, since each holds one version.

docs/decisions.md

@@ -903,7 +903,7 @@ By the maintainer's decision of 2026-10-09, every 0.1.0 chunk ships under the fl
 
 Shipped under that decision: item 89, the last of 0.1.0, at 52e0304. Its paired ruling against 90ffcff was better. The release's scoring run read Navigation 7.00, Locality 5.75, Shape 6.38, Self-sufficiency 6.50 and overall 6.25; its seats named places items 170 to 172 and 178 hold, and `isPath`, filed as item 251.
 
-Shipped under the floor by the maintainer's decision of 2026-10-13: item 58, prebuilt binaries and packages, as the distribution of 0.1.0 rather than a 0.2.0 item. It changes no Go code.
+Shipped under the floor by the maintainer's decision of 2026-10-13: item 58, prebuilt binaries and packages, which the plan had under 0.2.0, ships as 0.1.0's distribution. It changes no Go code.
 
 Shipped by the maintainer's decision of 2026-10-11 with its ratchet waived: item 182, the shipped data as Go packages, at a632a92. Its last paired ruling against bf1becb was same overall, Mid A better and Junior A worse, with Shape fallen, three seats against the namespace mount in `internal/datafiles/mount.go` and the `at` field of `datafiles.Source`; the scoring run that would rule it worse under the floor was not run. `todo.md` item 197 replaces that mount.
 
@@ -966,13 +966,14 @@ data, or the country opens a register.
 ## The apt, dnf and apk repositories are static files on GitHub Pages, holding the latest release only
 
 2026-10-13, decided by the maintainer. Serves goal 1.1; technical principle: prefer the
-vendor-neutral option (`~/.claude/principles/technical-principles.md`). A hosted package
-service would sign and index the packages for us, but only saves tooling, so the repositories
-are built here: `release-tooling/package-repos.Dockerfile` signs them with a GPG key (apt,
-dnf) and an RSA key (apk), and any static host can serve the result. GitHub already hosts the
-code (see "GitHub is canonical"), so Pages adds no new vendor; the image sits on GHCR for the
-same reason, and as OCI it moves by changing its path. A Pages site holds at most 1 GB and a
-release's packages take about 35 MB, so the repositories hold the latest release only; every
-release keeps its own packages, and the image keeps a tag per version. Leaving Pages costs
+vendor-neutral option (`~/.claude/principles/technical-principles.md`). The repositories
+are built here, as static files any host can serve: `release-tooling/package-repos.Dockerfile`
+signs them with a GPG key (apt, dnf) and an RSA key (apk). A hosted package service would
+only save that tooling. GitHub already hosts the code (see "GitHub is canonical, and the
+module path names it"), so Pages adds no new vendor. The image sits on GHCR for the same
+reason; being OCI, it moves to another registry by changing its path. A Pages site holds at
+most 1 GB and a release's packages take about 35 MB, so the repositories hold the latest
+release only; each GitHub release still carries its own packages, and the image keeps a tag
+per version. Leaving Pages costs
 each Linux user an edit: their apt list, `.repo` file or apk line names `larvit.github.io`.
 Valid while GitHub hosts the code.

release-tooling/goreleaser.yaml

@@ -1,6 +1,5 @@
-# The packages workflow runs this from a checkout of the release's tag, in src/, beside
-# this repository's tooling/ checkout: the paths below are relative to src/. A dist/
-# inside src/ would make Go stamp the binaries' version +dirty.
+# Paths are relative to the release's source checkout; dist/ sits outside it because a
+# dist/ inside would make Go stamp the version +dirty.
 version: 2
 
 project_name: fejkdata

release-tooling/publish_release.py

@@ -3,7 +3,7 @@
 
 A top heading of `[Unreleased]`, or a version already released, publishes nothing.
 Env: FORGE_API_URL, FORGE_REPOSITORY (owner/repo), FORGE_TOKEN, SHA, and GITHUB_OUTPUT,
-where a published release writes `tag=vX.Y.Z`.
+to which it appends `tag=vX.Y.Z` when it publishes a release.
 """
 
 import json

renovate.json

@@ -16,7 +16,7 @@
       "customType": "regex",
       "datasourceTemplate": "docker",
       "depNameTemplate": "goreleaser/goreleaser",
-      "description": "the GoReleaser the Packages workflow runs, which must match the image the gate checks its config with",
+      "description": "GoReleaser in the Packages workflow; keep it equal to the goreleaser image the gate checks the config with",
       "managerFilePatterns": [
         "/^\\.github/workflows/packages\\.yml$/"
       ],