fix: gate LLRT publishing behind explicit dispatch

[robinbraemer]

Intent

Ship the OpenAPI/CodeMode reliability fix safely: preserve fully pre-resolved schemas for AI search while avoiding oversized sandbox graphs and repeated work, then publish a new immutable CodeMode patch without rewriting the failed 0.4.1 release. The release must not trigger or republish unrelated LLRT 0.2.0 packages; LLRT publishing should require an explicit main-branch dispatch. The user explicitly authorized autonomous no-mistakes/Luna validation, PR merge, and production shipment.

What Changed

• Bumped @robinbraemer/codemode from 0.4.1 to immutable patch version 0.4.2.
• Changed LLRT native publishing to require an explicit manual dispatch with publish=true on main, and serialized runs without cancelling active publishes.
• Updated the LLRT publishing documentation and added regression coverage for the workflow’s publish gating and concurrency behavior.

Risk Assessment

✅ Low: The scoped changes are well-bounded and correctly isolate LLRT publishing behind an explicit main-branch dispatch while bumping CodeMode to 0.4.2.

Testing

After building the missing workspace LLRT entry, focused CodeMode, publication, LLRT workflow, and QuickJS end-to-end checks passed. Manual evidence confirms fully resolved schemas remain searchable, oversized sandbox transports are rejected, LLRT publishing requires explicit main-branch dispatch, and no transient worktree artifacts remain.

Evidence: Release validation evidence

Real QuickJS search returned resolved schema types (string, integer); oversized transport was rejected before marshalling; workflow contract confirms dispatch-only LLRT publishing.

CodeMode 0.4.2 release validation

Real QuickJS-backed CodeMode search output:
{
  "petNameType": "string",
  "featuredIdType": "integer"
}

Real QuickJS data-only oversized transport output:
data-only execution encoded input exceeds 10485760 bytes at input.spec.left.right.right.right.left.right.left.right.right.left.right.right.left.left.right.right.left.right.type

Workflow contract under test:
- workflow_dispatch.publish: boolean, default false
- no release: [published] trigger
- all LLRT publish steps: inputs.publish && github.ref == refs/heads/main
- concurrency cancel-in-progress: false

Final focused automated checks:
- CodeMode spec/cache/data-only/publication tests: exit 0
- LLRT native workflow contract test: exit 0
- QuickJS executor contract and CodeMode flow: exit 0

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• pnpm ... vitest run test/spec.test.ts test/codemode.test.ts test/data-only.test.ts test/package-publication.test.ts
• pnpm ... vitest run test/native-prebuild-workflow.test.ts
• pnpm ... vitest run test/quickjs-executor.test.ts
• Real QuickJS CodeMode search and oversized transport checks
• git status --short --branch

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.