fix(release): enter npm-publish environment for scoped token

.github/workflows/publish-cli.yml

@@ -21,8 +21,22 @@ name: Publish @workspacejson/cli
 # reaches the registry. A tag that disagrees with the manifest fails the run
 # instead of publishing a version nobody named.
 #
-# Required repository secret:
+# Required ENVIRONMENT secret, on the `npm-publish` environment:
 #   NPM_TOKEN  npm automation token with publish rights on @workspacejson/cli
+#
+# Environment, not repository. This distinction is load-bearing and it is what
+# failed the 0.6.1 release: GitHub exposes an environment secret only to a job
+# that explicitly declares `environment:`. The job did not, so
+# `${{ secrets.NPM_TOKEN }}` resolved to the empty string and the credential
+# guard below reported a missing token on a repository whose token was
+# correctly configured all along. The secret was never the problem; the job was
+# simply never in the scope where it exists.
+#
+# Scoping it to an environment rather than the repository is deliberate: it is
+# the same reviewer-gateable boundary the standard's `standard-v*` releases
+# publish behind. Moving NPM_TOKEN to a repository secret would "fix" this by
+# widening the blast radius of every workflow in the repository, which is the
+# opposite of what the environment is for.
 # ---------------------------------------------------------------------------
 
 on:
@@ -40,6 +54,12 @@ concurrency:
 
 jobs:
   publish:
+    # `name` is cosmetic — it labels the job in the Actions UI. `environment` is
+    # the line that actually admits the job to the scope where NPM_TOKEN exists.
+    # They are named alike on purpose, so a reader of a failed run sees the same
+    # word in the job label and the environment it needs.
+    name: npm-publish
+    environment: npm-publish
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

README.md

@@ -13,9 +13,9 @@ consumed here as released packages.
 >
 > **Registry snapshot, verified 2026-08-19:** the published versions are
 > `@workspacejson/cli@0.5.2` and `agents-audit@0.4.4`. The manifest table below
-> declares `0.6.1`. `0.6.0` was tagged but never published — its publish run
-> stopped at the tarball gate on a packaging defect (see the CLI changelog) —
-> so the registry skips from `0.5.2` to `0.6.1`.
+> declares `0.6.2`. `0.6.0` and `0.6.1` were both tagged but never published —
+> each publish run stopped at a different gate before reaching the registry (see
+> the CLI changelog) — so the registry skips from `0.5.2` to `0.6.2`.
 >
 > The versions shown in the table below are the versions declared by this
 > repository's package manifests. `pnpm run check:package-docs` keeps those
@@ -33,7 +33,7 @@ consumed here as released packages.
 
 | Directory | Package | Version | Role |
 | -- | -- | -- | -- |
-| [`packages/cli/`](./packages/cli/) | `@workspacejson/cli` | `0.6.1` | the neutral producer and its `workspacejson` binary |
+| [`packages/cli/`](./packages/cli/) | `@workspacejson/cli` | `0.6.2` | the neutral producer and its `workspacejson` binary |
 | [`packages/agents-audit-compat/`](./packages/agents-audit-compat/) | `agents-audit` | `0.4.4` | frozen compatibility bridge; preserves the historical command and API |
 | [`packages/mining-core/`](./packages/mining-core/) | `@workspacejson/mining-core` | `0.0.0`, private | L0 commit-graph mining core — extraction, path identity, completeness semantics (META-297 Phases 1–2) |
 

packages/cli/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog — `@workspacejson/cli`
 
+## 0.6.2
+
+### Patch Changes
+
+- Enter the `npm-publish` environment in the publish job, so the scoped
+  `NPM_TOKEN` is actually in scope. **`0.6.1` was tagged but never published**;
+  this is the same release with that workflow defect corrected.
+
+  No package, mining, retrieval, provenance or artifact behavior changes. The
+  `0.5.0` standard authority migration and the `0.6.1` packaging-boundary repair
+  both ship here unchanged.
+
+  **What stopped `0.6.1`.** The publish run cleared every gate — guards, build,
+  typecheck, tests, and the tarball verification that stopped `0.6.0` — then
+  failed on the credential check with both variables empty:
+
+  ```
+  NODE_AUTH_TOKEN:
+  NPM_TOKEN:
+  ```
+
+  `NPM_TOKEN` is stored as an **environment** secret on the `npm-publish`
+  environment, and this repository holds no repository-level `NPM_TOKEN` at all.
+  GitHub exposes an environment secret only to a job that explicitly declares
+  `environment:`. The `publish` job never did, so `${{ secrets.NPM_TOKEN }}`
+  resolved to the empty string and the guard reported a missing credential on a
+  repository whose credential was correctly configured the whole time.
+
+  `publish` is the job id; `npm-publish` is the environment. Nothing in the run
+  output made that distinction visible, which is most of why it read as a token
+  problem.
+
+  **The fix is one line of behavior.** The job now declares
+  `environment: npm-publish`, and takes `name: npm-publish` so the Actions UI
+  labels it with the same word as the scope it needs. The workflow header, which
+  said "Required repository secret", now names the environment secret it actually
+  requires and records why the token is scoped that way — an environment is the
+  reviewer-gateable boundary the standard's own releases publish behind, so
+  widening the token to the repository would have been the wrong repair.
+
+  **Why the tag moved rather than the run being re-run.** A re-run replays the
+  workflow as it existed at the tagged commit, and `cli-v0.6.1` points at a commit
+  whose workflow has no `environment:` line. Re-running it would fail identically.
+  The failed tag is left in place: `0.6.0` and `0.6.1` each record a real defect
+  that a gate caught before anything reached the registry.
+
 ## 0.6.1
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workspacejson/cli",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "The workspace.json producer — scans a repository and generates .agents/workspace.json deterministically, preserving human-authored manual evidence.",
   "license": "Apache-2.0",
   "author": "workspace.json contributors",