npm-publish.yml cannot publish neo-app: the token is rejected and the runner's Node is below the engine's floor #43

Context

Found at the Engine v13.3.1 cut (neomjs/neo#20022, 2026-10-24 00:1xZ). After #42 (bump to 13.3.1, merged dacf149) the publish was dispatched: run 40044021612 failed at npm publish with npm error 404 Not Found - PUT https://registry.npmjs.org/neo-app. The same log warns EBADENGINE: neo.mjs@13.3.1 required node >=24.0.0, current v22.23.3. npm view neo-app version reads 13.2.0 (published 2026-10-11): the 13.3.0 bump (#40, merged 2026-10-21) was never published either, so npx neo-app has scaffolded 13.2.0 workspaces since then.

The Problem

.github/workflows/npm-publish.yml is workflow_dispatch only and publishes with NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} on actions/setup-node@v6 with node-version: '22.x'. The registry answers a PUT from a token without publish rights on an existing package with 404, so the secret is revoked, expired or scoped away from neo-app; the last successful runs of this workflow are from 2026-03-30. Separately, the scaffold's own engines.node is >=24.0.0 and so is the engine's, while the publish job runs on Node 22.

The Architectural Reality

The Engine publishes through npm Trusted Publishing (OIDC) in neomjs/neo's .github/workflows/npm-publish.yml on the release event, with no token (neomjs/neo#20022 AC-7 for 13.3.1: run 40039753731). neo-app is a sibling package of the same owner; the same mechanism applies once a Trusted Publisher for neo-app is configured on npm for this repository and workflow.

The Fix

1. npm side (the operator): configure a Trusted Publisher for neo-app naming neomjs/create-app and npm-publish.yml (or renew the token as the stopgap).
2. Workflow: permissions: id-token: write, setup-node with node-version: '24.x' and registry-url, npm publish --provenance --access public without NODE_AUTH_TOKEN; keep workflow_dispatch, or trigger on the release event the way the engine does if a release is cut per version here.
3. Publish neo-app@13.3.1 from the merged head and read back npm view neo-app version.

Acceptance Criteria

• AC-1: npm-publish.yml publishes through Trusted Publishing on Node 24 with no NPM_TOKEN.
• AC-2: npm view neo-app version reads 13.3.1 (or the current bump).
• AC-3: The workflow's EBADENGINE warning is gone (the runner's Node satisfies the scaffold's and the engine's engines.node).

Post-Merge Validation

Moved here from AC-1 and AC-2 on 2026-10-25, because no pre-merge run can show them:

• The first Trusted-Publishing dispatch from main succeeds at the next version bump. It needs the npm-side Trusted Publisher for neo-app (operator-owned); 13.3.1 was published by hand, so a dispatch before the bump is an E403 whatever the auth path. A failure becomes a new ticket.
• From the next Engine cut on, the cut record carries npm view neo-app version as a named AC-8 line.

Out of Scope

The scaffold's contents; the engine's own publish.

Related

neomjs/neo#20022 · #41 / #42 · #39 / #40 (the unpublished 13.3.0 bump) · the engine's npm-publish.yml

unowned-rationale: the npm-side Trusted Publisher (or token) is the operator's credential surface; the workflow edit follows it and is a one-file change any maintainer takes after that.

Live latest-open sweep: no open issues in neomjs/create-app at 2026-10-24T00:20:17Z. Keyword sweep (npm-publish, token, OIDC): none open. A2A: no claim on the create-app publish path.

Origin Session ID: d6f6838c-943b-4fe2-aa9a-b57cd3719d2d
Retrieval Hint: "create-app npm-publish token 404 OIDC trusted publishing node 24 neo-app unpublished"