Gate package publishing on trusted setup

Author: emeisazam

.github/workflows/python-release.yml

@@ -80,6 +80,7 @@ jobs:
   publish:
     name: Publish verified stack to PyPI
     needs: build
+    if: ${{ vars.PYPI_PUBLISH_ENABLED == 'true' }}
     runs-on: ubuntu-latest
     environment: pypi
     permissions:

CHANGELOG.md

@@ -5,8 +5,9 @@
 - **Installable Python release chain**: the public distribution is now
   `sonicfield-oida` because the shorter PyPI name belongs to an unrelated
   project; imports and CLIs remain `oida`. A tag-gated Trusted Publishing
-  workflow builds, isolates, and publishes the canonical `akouo-contract`,
-  `akousma`, `akousmata`, and Oída distributions without repository tokens.
+  workflow builds and isolates the canonical `akouo-contract`, `akousma`,
+  `akousmata`, and Oída distributions without repository tokens. Publishing
+  is enabled only after all four PyPI Trusted Publishers are configured.
 
 - **Oída-owned reasoning layer**: event conversation now has a fixed prompt
   hierarchy, a whitelist-built evidence packet, and a strict response contract.

README.md

@@ -359,3 +359,7 @@ variables as the fallback; they are never written into reasoning settings.
   installed as one stack rather than copied into divergent forks. Those
   dependencies must be published to the target package index before a
   public-index Oída release.
+- Version tags build, isolate-test, and retain all four Python distributions.
+  The PyPI upload job additionally requires the repository variable
+  `PYPI_PUBLISH_ENABLED=true` and matching Trusted Publisher records for
+  `akouo-contract`, `akousma`, `akousmata`, and `sonicfield-oida`.