AIWG 2026.9.12 — Release workflows get their own lanes

AIWG 2026.9.12 completes the release-cut recovery with two workflow fixes found only after the signed 2026.9.11 tag exercised the production release path.

Independent release workflows

Gitea treated four workflows as one concurrency stream because each used the literal group name `release`. On a tag push, release creation and plugin packaging were canceled while the npm workflow ran. Each workflow now has a distinct group, and a regression test checks that required and release workflows cannot cancel one another.

A realistic npm processing window

npm accepted the root package but kept it in processing for longer than the first three-minute retry window. The two scoped packages were already queryable with provenance. The root-package provenance check now waits up to fifteen minutes, and the job has a forty-five-minute budget so the remaining signing, SBOM, checksum, installer, and release-asset steps can finish.

The wait remains bounded and preserves a package-specific failure diagnostic.

Release integrity

The tag is created through the dedicated AIWG release-signing key held in OpenBao. The release commit, version lockstep, full test suite, metadata, documentation, Fortemi index, and workflow pin gates are verified before the tag is pushed.