release: @whynot/design v0.4.2 on Forgejo

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43

.npmrc

@@ -1,6 +1,6 @@
-# @whynot/* is published to and installed from the coulomb Gitea npm registry.
+# @whynot/* is published to and installed from the coulomb Forgejo npm registry.
 # The auth token is NOT stored here — set NPM_AUTH_TOKEN in your shell/CI.
 # It is operator/OpenBao-owned (credential-routing.md: tokens route, never vend);
-# obtain a Gitea package token from the operator. Publish flow: see PUBLISHING.md.
-@whynot:registry=https://gitea.coulomb.social/api/packages/coulomb/npm/
-//gitea.coulomb.social/api/packages/coulomb/npm/:_authToken=${NPM_AUTH_TOKEN}
+# obtain a Forgejo package token through the governed lane. Publish flow: see PUBLISHING.md.
+@whynot:registry=https://forgejo.coulomb.social/api/packages/coulomb/npm/
+//forgejo.coulomb.social/api/packages/coulomb/npm/:_authToken=${NPM_AUTH_TOKEN}

BOOTSTRAP.md

@@ -19,7 +19,7 @@ ls -la
 #         .gitea/  .github/  scripts/  tests/
 
 # 3. Replace placeholder host names.
-#    Search-and-replace `gitea.example.com` with your actual Gitea host in:
+#    Search-and-replace `forgejo.example.com` with your actual Forgejo host in:
 #      - package.json
 #      - .npmrc
 #      - .gitea/workflows/ci.yml  (and .github/ if you keep that)
@@ -54,8 +54,8 @@ git push
 
 ## Notes
 
-- The `git+ssh` URL in `package.json` (`gitea.example.com/whynot/whynot-design.git`) is a placeholder. Replace with your actual Gitea host.
-- The same goes for `.npmrc` and the registry URL in `.gitea/workflows/ci.yml` (commented out — uncomment when you stand up a Gitea Packages registry).
+- The `git+ssh` URL in `package.json` (`forgejo.example.com/whynot/whynot-design.git`) is a placeholder. Replace with your actual Forgejo host.
+- The same goes for `.npmrc` and the registry URL in `.gitea/workflows/ci.yml` (commented out — uncomment when you stand up a Forgejo Packages registry).
 - `.gitea/workflows/ci.yml` and `.github/workflows/ci.yml` are identical. Keep whichever your forge uses and delete the other.
 - The `examples/showcase/index.html` page uses `importmap` to load Lit from esm.sh **for the standalone-no-build case**. When you have a bundler in the consuming app, the bundler resolves `lit` from `node_modules` and the importmap is irrelevant.
 

CHANGELOG.md

@@ -6,6 +6,15 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Version
 
 ## [Unreleased]
 
+## [0.4.2] — 2026-09-04
+
+### Changed
+
+- **Forgejo is now the canonical package registry** (WHYNOT-WP-0004). Package,
+  consumer, and release configuration consistently use
+  `https://forgejo.coulomb.social/api/packages/coulomb/npm/`; the legacy Gitea
+  publication remains historical evidence only.
+
 ### Added
 
 - **Lit adapter completed + refresh pipeline** (WHYNOT-WP-0002, Phases 3–6). The

CONSUMING.md

@@ -23,7 +23,7 @@ This is the inverse of whynot-design's own upstream machinery
 
 ## 1. Pin a version
 
-`@whynot/design` is published to the coulomb Gitea npm registry. Pin an exact
+`@whynot/design` is published to the coulomb Forgejo npm registry. Pin an exact
 tagged version; your lockfile becomes the real pin.
 
 ```bash

CONTRIBUTING.md

@@ -73,7 +73,7 @@ After PR merge:
 1. Bump `package.json` version following the [versioning rules in `DesignSystemIntroduction.md` §5](./DesignSystemIntroduction.md#5-versioning-discipline).
 2. Move the `## [Unreleased]` block in `CHANGELOG.md` under a new `## [vX.Y.Z] — YYYY-MM-DD` header.
 3. Tag: `git tag vX.Y.Z && git push --tags`.
-4. CI's release workflow attaches the CHANGELOG slice to the Gitea release. (If publishing to a registry, this is where `npm publish` runs.)
+4. CI's release workflow attaches the CHANGELOG slice to the Forgejo release. (If publishing to a registry, this is where `npm publish` runs.)
 5. Renovate picks up the new tag in consumer repos within ~24h. Or manually:
 
    ```sh

DesignSystemIntroduction.md

@@ -112,15 +112,15 @@ In order of effort:
 
 **a) pnpm workspaces (recommended for now)** — put `whynot-design` and your consuming app in the same monorepo (or use `file:` / `link:` references). Zero registry, zero auth, instant updates.
 
-**b) Install directly from Gitea** — no registry needed.
+**b) Install directly from Forgejo** — no registry needed.
 
 ```sh
-pnpm add git+ssh://git@gitea.example.com/whynot/whynot-design.git#v0.2.0
+pnpm add git+ssh://git@forgejo.coulomb.social/coulomb/whynot-design.git#v0.2.0
 ```
 
 Pin to a tag, not `main`. Tag-pinning is the entire versioning discipline at A1.
 
-When you outgrow either (second team needs read access without cloning, semver resolution becomes valuable), publish to **Gitea Packages** (native npm protocol) or a private Verdaccio.
+When you outgrow either (second team needs read access without cloning, semver resolution becomes valuable), publish to **Forgejo Packages** (native npm protocol) or a private Verdaccio.
 
 ### 4.2 What a consumer imports
 

MultiFrameworkSupport.md

@@ -109,7 +109,7 @@ This is the canonical non-React case and worth covering in detail.
 
 ```sh
 # In the Django app's repo.
-pnpm add git+ssh://git@gitea.example.com/whynot/whynot-design.git#v0.2.0
+pnpm add git+ssh://git@forgejo.coulomb.social/coulomb/whynot-design.git#v0.2.0
 
 # Or vendor without Node tooling — copy three files:
 mkdir -p myapp/static/whynot

PUBLISHING.md

@@ -1,6 +1,6 @@
 # Publishing `@whynot/design`
 
-`@whynot/design` is published to the **coulomb Gitea npm registry** so consuming
+`@whynot/design` is published to the **coulomb Forgejo npm registry** so consuming
 repos can pin a version (`npm i @whynot/design@x.y.z`) and track it at their own pace
 (WHYNOT-WP-0003). The git tag cut by `make release` (see `DesignSystemIntroduction.md`
 §6) is the version; publishing makes that version installable.
@@ -12,13 +12,14 @@ repos can pin a version (`npm i @whynot/design@x.y.z`) and track it at their own
 
 ## The token (never commit it)
 
-Publishing and installing `@whynot/*` need a Gitea package token. It is **not stored in
+Publishing and installing `@whynot/*` need a Forgejo package token. It is **not stored in
 this repo** — per `.claude/rules/credential-routing.md`, tokens are routed, not vended:
-a Gitea package token is operator/OpenBao-owned (`railiance-platform`). Obtain one from
-the operator and export it:
+a Forgejo package token is operator/OpenBao-owned (`railiance-platform`). Use the
+`whynot-design-npm-publish` governed lane for publishing; interactive operators may
+export a value obtained through the same route:
 
 ```sh
-export NPM_AUTH_TOKEN=…        # Gitea package token; never paste into git/chat/logs
+export NPM_AUTH_TOKEN=…        # Forgejo package token; never paste into git/chat/logs
 ```
 
 `.npmrc` (committed) references it via `${NPM_AUTH_TOKEN}` — no secret lives in the file.

README.md

@@ -38,7 +38,7 @@ Framework-agnostic by design. Consumers do **not** re-implement components per f
 
 ### Node-tooled consumer (React, Vite, Next, Vue, …)
 
-Install from the coulomb Gitea npm registry (add the scope to your `.npmrc` first — see
+Install from the coulomb Forgejo npm registry (add the scope to your `.npmrc` first — see
 [`PUBLISHING.md`](./PUBLISHING.md) for the token). `lit` is a peer dependency:
 
 ```ini

ir/INDEX.md

@@ -1,7 +1,7 @@
 <!-- GENERATED by scripts/ir-extract.mjs (make ir) — do not hand-edit. -->
 # whynot-design IR catalog
 
-**designVersion** `0.4.0` · **components** 10 · **generated** 2026-06-30T07:46:35.138Z
+**designVersion** `0.4.2` · **components** 10 · **generated** 2026-09-04T21:25:01.914Z
 
 Machine-readable companion: [`manifest.json`](./manifest.json) (per-component + token hashes).
 

ir/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
-  "designVersion": "0.4.0",
-  "generatedAt": "2026-06-30T07:46:35.138Z",
+  "designVersion": "0.4.2",
+  "generatedAt": "2026-09-04T21:25:01.914Z",
   "tokensHash": "sha256:426f565a9ce6c36f",
   "components": [
     {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whynot/design",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "The neutral, mostly-black-and-white visual language for whynot — prototype cards, signal records, beta plans, decision documents, and any other deliberately-unfinished artefact. Ships tokens, CSS, and Lit-based web components consumable from React, Django, Vue, plain HTML, or anywhere a custom element runs.",
   "private": false,
   "type": "module",

workplans/WHYNOT-WP-0004-forgejo-npm-migration.md

@@ -0,0 +1,55 @@
+---
+id: WHYNOT-WP-0004
+type: workplan
+title: "Move @whynot/design publication to Forgejo Packages"
+domain: infotech
+repo: whynot-design
+status: active
+owner: codex
+topic_slug: forgejo-npm-migration
+created: "2026-09-04"
+updated: "2026-09-04"
+---
+
+## Reconcile the package release state
+
+```task
+id: WHYNOT-WP-0004-T01
+status: done
+priority: high
+```
+
+Audit the partially completed Forgejo migration, choose a new immutable package
+version when the existing Gitea release cannot be reused safely, and verify the
+release contents before any credentialed write. This work promotes routed intake
+`01a06e08-6936-7762-a347-f832182b7705`.
+
+## Publish and verify the Forgejo package
+
+```task
+id: WHYNOT-WP-0004-T02
+status: progress
+priority: high
+```
+
+Use the governed `whynot-design-npm-publish` credential lane to publish the new
+version to `https://forgejo.coulomb.social/api/packages/coulomb/npm/`. Verify an
+authenticated exact-version install and the shipped IR/version contract without
+printing or persisting the credential.
+
+## Align consumer and operator documentation
+
+```task
+id: WHYNOT-WP-0004-T03
+status: done
+priority: medium
+```
+
+Make Forgejo the single canonical npm endpoint in current package, consumer, and
+release guidance. Hand the verified endpoint to ops-warden for catalog and
+playbook reconciliation.
+
+Prepared `@whynot/design@0.4.2` on 2026-09-04. The package dry-run contains 105
+files with IR `designVersion` 0.4.2; all five Playwright visual tests pass. The
+changelog gate correctly reports no *post-release* `[Unreleased]` entry after the
+0.4.2 section was cut.