chore(release): add pre-tag gate and installer coverage roadmap

Author: Jeremy8776

TODO.md

@@ -48,11 +48,20 @@ This list is prioritized for mission-critical readiness: secure-by-default behav
   - [ ] Fix failing `test/plugins-ipc.test.js` model payload shape expectation.
   - [ ] Keep `npm test` fully passing.
   - [ ] Reduce lint warnings to zero or explicitly codify allowed warnings.
+- [ ] Release/tag hygiene:
+  - [ ] Only create release tags from commits that already passed CI on `main`.
+  - [x] Add a pre-tag check script (`typecheck`, `test`, build smoke) and document required order.
+  - [ ] If a tagged release fails, cut a new patch tag instead of reusing the failed tag.
 - [ ] Add pre-release gate script:
   - [ ] `check:loc`
   - [ ] `lint`
   - [ ] `test`
   - [ ] build smoke
+- [ ] Installer coverage:
+  - [ ] Build and verify installer artifacts for each supported OS release:
+    - [ ] Windows installer/portable
+    - [ ] Linux AppImage + deb
+    - [ ] macOS dmg + zip
 
 ## P2 - Architecture / Refactor (next session)
 

docs/release.md

@@ -20,6 +20,8 @@
 ## Recommended Release Steps
 
 1. Ensure CI passes on `main`.
-2. Bump version and changelog notes.
-3. Create and push a tag like `v1.0.1`.
-4. Verify release artifacts on GitHub Releases.
+2. Run local pre-tag checks in this order:
+   - `npm run check:pretag` (runs: typecheck -> test -> build runtime smoke -> bundle smoke)
+3. Bump version and changelog notes.
+4. Create and push a tag like `v1.0.1`.
+5. Verify release artifacts on GitHub Releases.

package.json

@@ -51,6 +51,7 @@
     "check:loc:desktop": "node scripts/check-file-loc.cjs --root src --warn 500 --fail 700",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "typecheck:strict": "tsc -p tsconfig.strict.json --noEmit",
+    "check:pretag": "node scripts/pretag-check.cjs",
     "test:desktop": "node test/desktop-security.test.js && node test/path-guards.test.js",
     "test:ipc": "npm run check:ipc && node test/system-ipc.test.js && node test/skills-ipc.test.js && node test/plugins-ipc.test.js",
     "test": "npm run build:runtime && npm run test:desktop && npm run test:ipc",

scripts/pretag-check.cjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+'use strict';
+
+const { spawnSync } = require('node:child_process');
+
+const npmBin = 'npm';
+
+const checks = [
+  { name: 'Typecheck', args: ['run', 'typecheck'] },
+  { name: 'Tests', args: ['run', 'test'] },
+  { name: 'Build smoke', args: ['run', 'build:runtime'] },
+  { name: 'Bundle smoke', args: ['run', 'bundle-engine'] }
+];
+
+function runCheck(check) {
+  const pretty = `${npmBin} ${check.args.join(' ')}`;
+  console.log(`\n[pretag] ${check.name}: ${pretty}`);
+  const result = spawnSync(npmBin, check.args, {
+    stdio: 'inherit',
+    env: process.env,
+    shell: process.platform === 'win32'
+  });
+
+  if (result.error) {
+    console.error(`[pretag] ${check.name} failed to start:`, result.error.message);
+    process.exit(1);
+  }
+
+  if (typeof result.status === 'number' && result.status !== 0) {
+    console.error(`[pretag] ${check.name} failed with exit code ${result.status}`);
+    process.exit(result.status);
+  }
+
+  if (result.signal) {
+    console.error(`[pretag] ${check.name} terminated by signal ${result.signal}`);
+    process.exit(1);
+  }
+}
+
+console.log('[pretag] Running pre-tag checks...');
+checks.forEach(runCheck);
+console.log('\n[pretag] All pre-tag checks passed.');