ci(publish): re-enable npm provenance (repo public)

.github/workflows/publish.yml

@@ -34,7 +34,7 @@ jobs:
           node-version: 22
           registry-url: "https://registry.npmjs.org"
       - name: Publish
-        # --provenance requires a PUBLIC repo; re-add it if/when this repo goes public.
-        run: npm publish --access public
+        # Repo is public → emit a signed provenance attestation (sigstore).
+        run: npm publish --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CHANGELOG.md

@@ -5,7 +5,13 @@ All notable changes to `@fusengine/harness`. Format: [Keep a Changelog](https://
 ## [Unreleased]
 
 ### Planned
-- Go public → re-enable `--provenance` + Trusted Publishing (OIDC), drop `NPM_TOKEN`
+- Trusted Publishing (OIDC) on npmjs → drop the `NPM_TOKEN` secret
+
+## [0.1.23] - 2026-06-24
+
+### Changed
+- Repo is now **public** → the publish workflow emits a signed **provenance**
+  attestation (`npm publish --provenance`, sigstore). First release with provenance.
 
 ## [0.1.22] - 2026-06-24
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusengine/harness",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
   "type": "module",
   "module": "src/index.ts",