[thirtytwobits]

CETL currently checks stable tag/header alignment only after a GitHub release is published, inside the docs job. This adds a maintainer command that validates the exact tagged commit and waits for full verification before publishing.

• Share strict header/tag/prerelease validation between CI and the release script. Gate source/header/docs archives, their commit manifest, and checksums on all 15 compiler/standard jobs plus tooling and documentation checks. Every full-gate trigger, including a #verification push, also enables documentation.
• Use a Python 3.14+ standard-library CLI with authenticated Git and GitHub CLI. Preflight checks tools, repository access, merged commits, version progression, tag conflicts, workflow availability, and Pages configuration. A dry run fetches remote main, reads its version, and prints an exact release command pinned to that commit.
• Create the draft after CI passes, verify uploads before and after publication, and preserve existing tags/assets on retries. Print exact resume and full-run CI retry commands. Resume verifies published assets directly even after CI artifacts expire; pending documentation deployments are reused.
• Verify the version actually displayed by both built and deployed documentation. Stable documentation retains the main-only Pages environment, receives full verification, and cannot be rolled backward by an older retry.
• Document version selection, release commands, and recovery in RELEASING.md. Preflight and verification checks run in the script.
• Exercise interrupted uploads, failed gates, missing tools/configuration, expired artifacts, publication recovery, and documentation failures in disposable local Git repositories. PR CI also compiles C++14/C++20 consumers using only the extracted headers.
• Align development containers and contribution examples with Toolshed ts26.4.5, preserving legacy GCC 7 on ts24.4.3.
• Document each Python module and public API, including parameters, return values, errors, side effects, and retry contracts. Add concise documentation for internal callbacks, fixtures, and test cases following AGENTS.md.
• Add a shared Pyright/Pylance configuration and fix fixture/API type contracts: avoid shadowing unittest's run method, check regex matches and optional state, distinguish text/binary subprocess output, and reject malformed API responses or disappearing releases.

Distribution assessment (future work; no Conan/vcpkg integration is added):

• Conan 2 / ConanCenter: a header-only recipe and consumer test_package fit CETL. Use the verified header archive/checksum, preserve include/cetl, and install licenses without CETLVaSt dependencies. Revisit Release CETL via conan center #9 and establish recipe ownership before registry submission.
• vcpkg: prototype an overlay port pinned to a release source/checksum, with license installation and installed-consumer tests on Windows and Linux. Establish port ownership and an update process before curated-registry submission.
• Direct CMake consumption: add a minimal interface target and install/export config as a packaging follow-up. This PR adds no find_package(CETL) target.

Validation:

• All 62 Python tests passed on Python 3.14.6. Pyright 1.1.414 reports zero errors and warnings across all three Python files; actionlint and git diff --check passed.
• The trigger regression test reproduces the review finding before the fix and passes afterward. It checks that every full-gate trigger enables each conditional dependency.
• Commit 642a67b uses #verification without #docs to exercise the reported push scenario. Its push workflow and PR verification are queued/running; hosted results appear in the PR checks.

The script reports configuration/access fixes without changing administrator policies. GitHub branch/tag protections and release immutability remain repository governance choices; an after-publication workflow cannot prevent a privileged manual publication. Local rehearsals simulate GitHub; no production release or Pages setting was changed.

Closes #258.

[thirtytwobits]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T16:57:16.356780Z	904eff1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 904eff1bac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".