Publish and verify

The release records the tarball integrity, tag, version, commit, checks, and a post-publish smoke test. That contrast gives us something useful to test instead of a rule to memorize.

A successful publish response is not the final proof; the registry artifact and fresh consumer install are. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

The happy path can hide a bad design: you can rebuild between inspection and publishing or verify only from the local workspace and still get one successful demo. Push past the demo. publish the already-checked state, inspect registry metadata, and install the exact version in a clean consumer, then test the condition most likely to prove the choice wrong.

The module is moving toward one outcome: Publish an intentional immutable artifact with strong account controls and a release record you can verify. Save the before-and-after evidence now; it will make the final project review much more honest.

Practice with a private test scope or dry run, then write the commands and evidence required for the real release. Save the evidence, then explain which requirement would force you to choose a different design.