# ReleaseOrigin static handoff outline
# Variant: GitLab CI + pnpm workspace, one accepted workspace package
# DOCUMENTATION ONLY — this file is intentionally not a runnable CI file.
# It contains no dependency install, lifecycle-script, credential, or publish step.

releaseorigin_reference:
  provider: gitlab-ci
  package_manager: pnpm
  accepted_scope:
    packages: 1
    workspace_packages: 1
    repositories: 1
    release_workflows: 1
    hosted_ci_paths: 1
    consolidated_revisions: 1
  owner_confirms:
    - exact npm package name and exact workspace directory
    - package-declared public GitLab repository
    - workspace lockfile and package-manager declaration as text metadata
    - existing release stage, job, and owner-approved trigger
    - supported GitLab.com runner and identity path against current npm documentation
    - authorized npm publisher and GitLab project owner
  static_review:
    - bind every proposed change to the one accepted workspace package
    - parse proposed CI structure without running it
    - record proposed identity-token audience and minimum job permissions
    - identify legacy release-token references by name, never by value
    - document rollback to the last reviewed CI revision
  customer_controlled_checklist:
    - review the exact package selector and proposed diff
    - configure trusted publisher in the customer-controlled npm account
    - run any dry run only in the customer's controlled environment
    - merge and trigger publication only through an authorized publisher
  deliberately_omitted:
    - executable CI job
    - dependency installation
    - package lifecycle execution
    - monorepo-wide migration
    - token or credential values
    - npm account mutation
    - package publication