Publishes to Hex from the tag push

[johnnyt]

What

A release workflow that publishes predicator to Hex when a version tag is pushed, and the authority rows, release recipe and record that move with it. Moving the publish to the tag push was ruled by the operator, 2026-10-04.

• .github/workflows/release.yml (new). Trigger: a push of a tag matching v*.*.*, and nothing else (no branch push, no pull request, no workflow_dispatch). permissions: contents: read; one job; concurrency keyed by the tag ref, never cancelled; full-history checkout. Before any toolchain step it stops when the tagged commit is not an ancestor of the default branch (the branch read from github.event.repository.default_branch, passed through env:), when the tag without its v differs from @version in mix.exs at the tagged commit, or when Hex already shows the version (reported, never published twice). Then ci.yml's toolchain, cache, dependency and gate steps, copied byte for byte, the gate being gate.full from .claude/wurk.json; a red gate publishes nothing. Then mix hex.publish --yes, the docs with the package, with HEX_API_KEY from the secret of that name in that one step's env:; then the published version's hex.pm and hexdocs addresses.
• CLAUDE.md: the mix hex.publish row, the release-prep row's tag clause, the paragraph after the table, the relay paragraph's last clause, the version-bump exception, the Release preps paragraph's publish sentence and the /wurk:release skill row now say that the release workflow publishes on the tag push the release-prep row allows, that no agent or session runs the publish command, and that a failed workflow is re-run from its Actions page, never worked round by a local publish. The pointer above the table names ADR-0018 beside ADR-0006.
• .claude/wurk/release.md: the publish section (renamed from "has no trigger, ever") and the release trigger's publish sentence say the same.
• docs/adr/0018-the-release-workflow-publishes-on-the-tag-push.md (new, proposed) and its index row in docs/adr/README.md.

Provenance

• Record shape: a new ADR that supersedes ADR-0006's publish sentences, per docs/adr/README.md ("An ADR is amended by a new ADR that supersedes it"), with no line of ADR-0006 edited; ruled by the operator, 2026-10-04. The index row in docs/adr/README.md is an added line the record forces.
• Running the gate inside the workflow, the default branch from the event payload, the version from mix.exs at the tag, the toolchain copied from ci.yml, and no manual dispatch: decided by the conductor under a standing consent, 2026-10-03.
• The docs publishing with the package, the failed-publish rule, and the "already on Hex" check: decided by the conductor under a standing consent, 2026-10-04.
• ci.yml's Codecov export and upload are not copied: they only feed the README badge, and they would put a second secret in the job that holds HEX_API_KEY. ci.yml itself is untouched; its branches: [main] is the forge's default branch.
• Two CLAUDE.md sentences outside the publish row and the Release preps paragraph moved because they said the publish has no trigger or is a person's step: the paragraph after the table ("which is why it has no trigger at all") and the /wurk:release row ("the human-gated publish"). The publish row's "cannot be recalled, only retired" now reads that a new version of this package can be reverted or replaced only within its first hour, then only retired, which is mix help hex.publish's rule ("Reverting a package"); ADR-0018 states the same.

Checks

• The full gate (mix quality) is green on the committed tree: every stage passed, with doctor, gettext and sobelow skipped as the manifest allows.
• actionlint was not run (not installed here). The workflow parses as YAML, every run: script passes bash -n, the copied block is byte-identical to ci.yml's toolchain-to-gate steps, and no event field or repository file is interpolated into a run: script.
• The four check scripts ran under bash in a scratch clone at v9.4.2 with the step environment set by hand: the ancestry and version checks passed and the Hex check stopped with "already on Hex"; a mismatched tag name stopped the version check; a commit off main stopped the ancestry check; an unpublished version passed the Hex check. No step from the toolchain on, and no publish, ran.
• No changelog fragment: changelog.d/README.md excludes "documentation, ADRs, or plans" and "quality gate, CI, or agent tooling changes". No file under lib/ changes, and there is no version bump and no tag.

Direction check of the record

Every sentence ADR-0018 says it replaces was re-read verbatim in ADR-0006 on main: the Decision's fourth rung ("4. Irreversible to everyone, forever - no trigger exists at all."), the conclusions of "Why mix hex.publish has no trigger, rather than a strict one" and its "cannot be recalled, only retired" (in so far as it denies Hex's one-hour window), and the two publish sentences of the 2026-09-29 Note; the successor clause it cites is the Consequences bullet "New actions get placed, not debated." Its claims about the repository were checked against this branch by anchor: the Release preps paragraph and the authority rows in CLAUDE.md, the gate steps in ci.yml, the Docs stage in .quality.exs, @version in mix.exs, and each step of release.yml; the Hex revert window is mix help hex.publish's "Reverting a package". git diff origin/main -- docs/adr/ shows zero removed lines.

Not done here

The HEX_API_KEY secret and its scope are the maintainer's, set outside the repository. The workflow first runs on the next version tag; nothing publishes from this PR.