MotirBuilding in public
MOTIR · moooon
onMotir
You’re viewing a public project. Anyone can view it — no account needed. Sign in to submit, upvote, or comment on requests.View-only — you can’t edit work items
MOTIR-2613

Cut `cli-v0.2.1` — `package.json` has said 0.2.1 since MOTIR-2537 and four CLI commits sit unreleased, including a user-visible `motir link` error fix and the ACME copy rename the docs already show

Cancelled
Description

Repo: motir-core. No PR — this card's deliverable is a pushed tag and the verified artifacts it produces. Carved out of MOTIR-2611 by its 2026-08-10 re-plan.

⚠️ Read this first: the reason MOTIR-2611 gave for cutting this tag was FALSE. That card asserted cli-v0.2.0's tree predated motir login. It did not — git show cli-v0.2.0:packages/cli/src/program.ts carries register(program, 'login') at line 95 and commandCatalog.ts path: 'login' at line 146, the same lines the card cited as main-only, and @motir/cli@0.2.0 installed from npm lists login first under SETUP COMMANDS. Nothing user-facing is broken today, and this tag does not fix a reported symptom. It is release hygiene. Do not restore the urgency the original card carried.

What is actually unreleased (measured on origin/main @ 816eb501, 2026-08-10)

git log --oneline cli-v0.2.0..origin/main -- packages/cli → 4 commits (MOTIR-2611 said 20; that number was wrong too):

commitwhat it changes
e27a6b77"API tokens" → "Tokens" in the three packages/cli/src hint sites (MOTIR-2537) — the same commit that bumped package.json to 0.2.1
248de2d8the PROD example key retired for ACME across reader-facing CLI copy (MOTIR-2343 family)
672e4931motir link reports the real failure instead of "not accessible" (MOTIR-2492) — the only behaviour change
b814889epackages/cli/sandbox/README.md records the cli-v0.2.0 digests

So the published CLI still prints PROD-7 in its help and still says "API tokens", while /docs and the app say ACME and "Tokens". That skew is the real (small) cost of leaving this untagged, and sandbox-staleness.yml will fail on it once the drift passes its 7-day window (tag cut 2026-08-08 → fires 2026-08-15).

Why this is blocked by MOTIR-2612

A cli-v* lane replays the tag's own tree ([[tag-triggered-release-replays-tag-tree]]). If the tag is cut before MOTIR-2612's credential-free content check is on main, that check does not run on this release and the release ships ungated — which is the whole point of the pair. Cut the tag only after MOTIR-2612 has merged.

Do this

  1. Confirm packages/cli/package.json still reads 0.2.1 and that git log cli-v0.2.1..origin/main -- packages/cli will be empty at tag time — if further CLI commits have landed since this card was written, re-read them and bump again rather than tagging a subset.
  2. git tag cli-v0.2.1 <origin/main sha> && git push origin refs/tags/cli-v0.2.1. Never move cli-v0.2.0 — a tag lane replays its tree, and moving it silently rewrites what the existing immutable :claude-0.2.0 tag and every recorded digest mean.
  3. gh run watch both lanes the tag fires — release-cli.yml (npm, OIDC Trusted Publishing; see [[npm-cli-publish-404-is-token-auth]] if it 404s) and release-sandbox.yml (the GHCR profile matrix).
  4. Verify as an OUTSIDER, and record the evidence on this card.

Acceptance criteria

  1. cli-v0.2.1 exists on origin, both lanes it fires are green, and npm view @motir/cli version returns 0.2.1.
  2. git log cli-v0.2.1..origin/main -- packages/cli is empty at tag time — the tag carries every CLI commit then on main, not a subset.
  3. Anonymous pull check, no Authorization header / registry login / packages: scope: node packages/cli/sandbox/smoke/assert-public.mjs --ref ghcr.io/moooon-b-v/motir-sandbox:claude exits 0, run with the out-of-org control ghcr.io/astral-sh/uv:latest proven able to report "public" first.
  4. Content, not just pull: a container from the newly published image prints 0.2.1 for motir -v AND lists login in motir help. Assert something only the new build says — asserting the pull succeeded is what let MOTIR-2131 through.
  5. MOTIR-2612's sandbox-commands job ran on THIS release and passed — visible in the release run, not inferred from its presence on main.
  6. The digests of the republished :claude / :base / every profile tag are recorded on this card and in packages/cli/sandbox/README.md's published-images table (that README edit is the one file change, and it belongs to whoever cuts the tag).

Context refs

  • .github/workflows/release-cli.yml, .github/workflows/release-sandbox.yml, .github/workflows/sandbox-images.yml — the lanes the tag fires.
  • .github/workflows/sandbox-staleness.yml — the 7-day drift tripwire that makes this scheduled rather than urgent.
  • packages/cli/sandbox/README.md — the published-images / digest table to update.
  • packages/cli/sandbox/smoke/assert-public.mjs — AC 3's probe, control-first.

Out of scope

The docker pull gap in the guide — that is MOTIR-2611. The content-check job itself — that is MOTIR-2612.