Motir

motir.co consumes the PUBLISHED package. npm's newest tarball is 0.1.1, cut from tag design-system-v0.1.1 at c5d11f7f1441 and published 2026-08-29T09:51:55Z — twenty-six hours BEFORE MOTIR-3933 merged (d851bbb32d3f). So /design renders ten identical palette tiles today, and will until this tag is pushed.

This card is the CUT, and only the cut. It opens no pull request and changes no file. Its whole deliverable is a tag, the run that tag fires, and the evidence that a stranger can fetch what the run published.

⚠️ RE-SCOPED 2026-08-30, by the run that picked it up. As authored this card also carried the version bump and the motir-marketing re-pin — three of its five criteria discharged in a second repository, and a human merge sitting between criterion 1 and criterion 2. release-design-system.yml fires on the tag and guards tag == package.json version, and the README's procedure is bump → merge → tag: the publish is only possible on a commit that is already on main, which no run in manual merge mode can produce. The bump and the re-pin are now the sibling cards this one sits between. The planning defect is recorded under MOTIR-1465.

What to do

1. Confirm the bump is on main — this is the step that protects the version. git fetch origin --tags, then git show origin/main:packages/design-system/package.json must read 0.1.2; take the commit from git log origin/main --format=%H -1. The lane's guard catches a tag whose version disagrees with package.json; it does NOT catch a tag on an unmerged branch, which would publish from a commit main never saw and leave npm ahead of the repository for good.
2. Tag and push — git tag design-system-v0.1.2 <that commit> && git push origin design-system-v0.1.2. This is the irreversible act: npm will not accept a second 0.1.2, and recovery is another bump and another release. Everything above it is checked first, and nothing below it is guessed.
3. Watch the lane — gh run watch the Release @motir/design-system run the tag fired (gh run list --workflow=release-design-system.yml). Read the JOB, not the check title: the publish step is conditional on already == 'false', so a version already on npm produces a GREEN run that published nothing. Confirm the Publish to npm step actually ran.
4. PULL IT AS THE CONSUMER, anonymously — npm pack @motir/design-system@0.1.2 from a directory with no .npmrc and no credential. A green lane is not evidence; the pull is. (npm view can 404 for minutes after a successful publish while the registry's negative cache expires — read the version endpoint or pull the tarball; that 404 is not evidence the publish failed.)
5. Read the TARBALL, not the repo — unpack what you just pulled and check the fix is in it.

Acceptance criteria

• Tag design-system-v0.1.2 exists on origin, its commit is an ancestor of origin/main, and packages/design-system/package.json at that commit reads 0.1.2.
• The run the tag fired is quoted by id, its event is push on that tag, and its Publish to npm step RAN rather than being skipped as already-published.
• npm pack @motir/design-system@0.1.2 succeeds with no credential, and the resulting shasum is quoted on this card.
• In that tarball — not in the repository — package/dist/components/theme/StyleVignette.js emits data-appearance-scope, and package/theme.css carries the same data-appearance-scope and :not([data-theme]) counts as the source at the tagged commit (13 and 10 at c6409c20c; re-measure at the tag and quote both commands).
• This card opens NO pull request, so nothing moves its status automatically: transition it by hand on the evidence above, and paste that evidence in a comment.
• ORDERING — every criterion reads on a tag and on a registry, both of which exist only after the bump card has MERGED. That is why the bump is a blocked_by edge and not a step here. Nothing reads on motir-marketing; the re-pin is the sibling card blocked by this one.

Context refs

• .github/workflows/release-design-system.yml — the lane: the tag guard, the npm pack --dry-run tarball check, the already-published skip, and OIDC Trusted Publishing (no NPM_TOKEN).
• packages/design-system/README.md § Releasing — steps 3 and 4, which this card performs.
• Run 33246425826 — design-system-v0.1.1's release, 1m23s, the shape to expect. (The workflow's own comment claiming "NO HEALTHY run on record" predates it and is stale.)
• MOTIR-3933 / motir-core#2465 — the fix being shipped.
• MOTIR-3947 will owe its OWN release once it lands; deliberately not waited for.