Motir

The trio's middle leg, and the one no agent can hold: it needs 11.5.10's pull request to be MERGED first, and the merge is the user's. No PR comes out of this card — it is marked done on the user's confirmation.

The steps

1. Confirm the prep PR is merged, and take the merge commit — the tag goes on main, never on a branch tip that is about to be rewritten.
2. git tag cli-v0.2.0 <merge-sha> and push it. release-cli.yml asserts the tag version equals packages/cli/package.json#version, so a mismatch fails the lane loudly rather than publishing the wrong thing.
3. Watch BOTH lanes. The tag fires the npm publish AND the BYOK sandbox image build. Two green checks, not one — a green npm lane beside a silently failed image lane is the shape that has bitten this package before.
4. Install it as a stranger would. npm install -g @motir/cli@0.2.0 from a clean environment with no repo checkout and no privileged credential, then run a command against a real Motir with a real PAT. Publishing is not the same fact as obtainable — the acceptance here is a package PULLED from the registry a user reads and run, not a green workflow.
5. Record the outcome — the published version, the tag sha, and both lanes' run URLs — so 11.5.12 has something to transcribe rather than something to go looking for.

Scope BOUNDARY

Ends at a published, installable @motir/cli@0.2.0 proven by an anonymous install. It writes no code and opens no PR. It does NOT transcribe the published digests into the repository (11.5.12 — that is a code change and needs its own pull request). It does NOT fix the lane if it fails: a broken release workflow is a defect to file, not to patch from inside the cut.

Acceptance criteria

• The cli-v0.2.0 tag exists on the prep PR's merge commit on main, and its version matches the manifest.
• Both the npm publish lane and the sandbox image lane completed successfully, and both run URLs are recorded on this card.
• npm install -g @motir/cli@0.2.0 succeeds from a clean environment with no repository checkout and no privileged credential.
• The installed binary runs a real command against a real Motir with a real PAT and returns real data — the migration proven from the outside, on the artefact a user gets.
• The published version, tag sha and both run URLs are recorded on this card for the recording leg to consume.

Context refs

• .github/workflows/release-cli.yml — the cli-v* trigger and the tag-vs-manifest assertion.
• Precedent: the 0.1.1 cut — the same two-lane cut, including the anonymous-consumer verification.
• Predecessor: 11.5.10 — nothing here is possible until its PR is merged.
• Story: 11.5.