AIWG 2026.9.11 — A release waits until the evidence arrives

Release date: 2026-09-14

Channel: stable

This patch makes the release pipeline tolerate npm's normal package-processing delay without weakening its provenance gate.

The 2026.9.10 publish was accepted by npm and produced a Sigstore transparency log entry, but the large root package was still processing when the workflow queried it ten seconds later. That lookup exited immediately, so the workflow skipped the remaining dist-tag, cosign, SBOM, checksum, installer, and GitHub release-asset steps.

Publication now retries each package's provenance lookup for up to three minutes. A package must still become queryable with its attestation before the release continues. If it does not, the job reports the affected package after the bounded wait instead of disappearing at the first registry error.

The release-cut audit also found three floating action tags in the isolated OMP native conformance workflow. Checkout, Bun setup, and artifact upload are now pinned to immutable commits recorded in the CI pin manifest.

No application behavior or public API changes in this patch.