feat(release): rag-platform PyPI meta + release.yml fans one tag to every channel (Step 7.7)

.github/workflows/release.yml

@@ -0,0 +1,131 @@
+name: Release
+
+# Tag-triggered distribution. On a `vX.Y.Z` tag this publishes the user-facing
+# install channels; docker.yml (gateway image) and release-airgap.yml (offline
+# bundle) fire on the same tag, so one tag fans out to every channel.
+on:
+  push:
+    tags: ["v*.*.*"]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Build artifacts but skip publishing"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+env:
+  REGISTRY: ghcr.io
+
+jobs:
+  pypi:
+    name: PyPI (rag-platform + SDK)
+    runs-on: ubuntu-22.04
+    permissions:
+      id-token: write # PyPI Trusted Publishing (OIDC) — no API token
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install build
+      - name: Build meta-distribution + SDK
+        run: |
+          python -m build --outdir dist-pypi packaging/rag-platform
+          python -m build --outdir dist-pypi sdks/python
+      - name: Publish to PyPI
+        if: ${{ github.event_name == 'push' || !inputs.dry_run }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist-pypi
+
+  npm:
+    name: npm (@agentcontextos/sdk)
+    runs-on: ubuntu-22.04
+    permissions:
+      id-token: write # npm provenance
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: "https://registry.npmjs.org"
+      - working-directory: sdks/typescript
+        run: |
+          npm ci
+          npm run build
+      - name: Publish (with provenance)
+        if: ${{ github.event_name == 'push' || !inputs.dry_run }}
+        working-directory: sdks/typescript
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  admin-ui-image:
+    name: Container — admin-ui (sign + SBOM)
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      id-token: write # cosign keyless OIDC
+    env:
+      IMAGE_NAME: ${{ github.repository_owner }}/agentcontextos/admin-ui
+    steps:
+      - uses: actions/checkout@v6
+      - run: echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV"
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix=sha-
+      - id: build
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: apps/admin-ui/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - uses: sigstore/cosign-installer@v3
+      - name: Sign (keyless)
+        run: cosign sign --yes "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}"
+      - name: SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
+          artifact-name: admin-ui.spdx.json
+          format: spdx-json
+
+  helm-oci:
+    name: Helm chart → OCI (sign)
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      id-token: write # cosign keyless OIDC
+    steps:
+      - uses: actions/checkout@v6
+      - uses: azure/setup-helm@v4
+      - uses: sigstore/cosign-installer@v3
+      - name: Package + push + sign
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login "${REGISTRY}" -u "${{ github.actor }}" --password-stdin
+          repo="oci://${REGISTRY}/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/agentcontextos/charts"
+          helm package infra/helm/rag-platform --destination .
+          chart="$(ls rag-platform-*.tgz)"
+          out="$(helm push "${chart}" "${repo}" 2>&1)"; echo "${out}"
+          digest="$(echo "${out}" | awk '/Digest:/ {print $2}')"
+          name="$(helm show chart infra/helm/rag-platform | awk '/^name:/{print $2}')"
+          cosign sign --yes "${REGISTRY}/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/agentcontextos/charts/${name}@${digest}"

TRACKER.md

@@ -14,12 +14,13 @@
 | | |
 |---|---|
 | **Last updated** | 2026-06-10 |
-| **Current phase** | Phase 7 — Pilot, Harden, GA (**6 / 10 steps**) — Phases 0–6 ✅ complete |
-| **Overall** | **80 / 84 steps** — Phases 0–6 complete |
-| **Next action** | **Step 7.7 — Packaging & distribution**: PyPI `rag-platform`, npm `@ragplatform/sdk`, GHCR images (cosign + SBOM), Helm OCI repo, air-gap bundle per release; one-command install per channel; release workflow. |
+| **Current phase** | Phase 7 — Pilot, Harden, GA (**7 / 10 steps**) — Phases 0–6 ✅ complete |
+| **Overall** | **81 / 84 steps** — Phases 0–6 complete |
+| **Next action** | **Step 7.8 — Support, SLAs, on-call**: support tiers (Community/Pro/Business/Enterprise); SLA targets; incident response + postmortem template; per-alert runbooks; public status page; PagerDuty tie-in. |
 
 **Recently shipped**
 
+- **7.7** ✅ Packaging & distribution — **one-command install per channel** + **one tag fans out to every channel**.  New `rag-platform` PyPI **meta-package** (`packaging/rag-platform/`) pins the workspace component dists for a reproducible `pip install rag-platform`; the existing `agentcontextos` SDK scope is kept (no rename).  A new `release.yml` publishes PyPI (OIDC Trusted Publishing) + npm (`@agentcontextos/sdk`, provenance) + the **admin-ui image** (new `apps/admin-ui/Dockerfile`, cosign + SBOM) + the Helm chart → **OCI** (cosign), alongside the existing `docker.yml` (gateway image, cosign + SBOM) and `release-airgap.yml` — all keyed off the same `vX.Y.Z` tag.  Deferred: Go/Java/.NET SDK publish, worker/eval-runner images (single-process today).  [ADR-0049](docs/adr/ADR-0049-packaging-distribution.md)  [#180](https://github.com/officialCodeWork/AgentContextOS/pull/180)
 - **7.6** ✅ Marketplace listings — listing artifacts for AWS / Azure / GCP under a new `marketplace/` (approval + procurement stay an external per-cloud process, like the 7.3 pentest).  **One canonical `pricing.yaml`** (tiers + usage-metered dimensions whose ids match the Step 7.9 metering signals) + **one shared `listing-content.md`** mapped to all three clouds, so listings can't drift and prices reconcile with metering.  Each per-cloud spec maps the model to that cloud's billing primitives and **reuses existing delivery** (Helm / AMI / air-gap bundle / GHCR — no new packaging); per-cloud submission checklists + a procurement acceptance test in the guide.  [ADR-0048](docs/adr/ADR-0048-marketplace-listings.md)  [#179](https://github.com/officialCodeWork/AgentContextOS/pull/179)
 - **7.5** ✅ Documentation site — a **Docusaurus 3** app (`website/`) that serves the repo `docs/` tree **in place** (single source of truth; `markdown.format: 'detect'` renders hand-written `.md` as CommonMark).  The **REST API reference** (`docs/reference/rest-api.md`) is **generated + drift-gated** from `dist/openapi.json` by `scripts/gen_api_reference.py` (`task docs:api`) — never hand-edited.  Doc honesty is a `tests/docs/` suite (every `ragctl` / `/v1/` reference in a quickstart must be real) + `lychee` offline link-check + `codespell`, wired into a new `docs` CI workflow.  Deferred: Algolia search, versioned docs, the deploy workflow.  [ADR-0047](docs/adr/ADR-0047-documentation-site.md)  [#178](https://github.com/officialCodeWork/AgentContextOS/pull/178)
 - **7.4** ✅ Design-partner pilots — the pilot program shipped as a **repo-backed machine** (signing the referenceable partners is the external GTM deliverable, like the 7.3 pentest): an operator runbook + five fill-in templates (`docs/pilots/`), a **customer-support/KB kit** (`docs/pilots/customer-support/` — sample corpus with synthetic PII + a planted injection probe; domain-calibrated criteria), and **`ragctl pilot`** (`onboard` renders the per-tenant config + checklist; `report` assembles a weekly-KPI dashboard + **PASS/FAIL** verdict from the platform's own feedback / drift / cost signal components — the same ones behind `GET /v1/status/*`).  KPIs are **pulled, not self-reported**.  A worked case study runs it end-to-end on the kit with real `ragctl pilot report` output (satisfaction **+0.733**, **0/5** drift, cost **ok** → **PASS**) + the PII-redaction + injection-blocked security demo.  No `dist`/SPI/config change.  [#174](https://github.com/officialCodeWork/AgentContextOS/pull/174)
@@ -810,7 +811,7 @@ New ground — the only prior crypto was HMAC signing.  The V1 plan calls for en
 | 7.4 | Design partner onboarding | ✅ | [#174](https://github.com/officialCodeWork/AgentContextOS/pull/174) — repo-backed pilot program: operator runbook + 5 templates (`docs/pilots/`) + ADR-0046; **customer-support/KB kit** (corpus w/ PII + planted injection probe; domain criteria); **`ragctl pilot`** `onboard` + `report` (weekly KPIs + PASS/FAIL verdict from feedback/drift/cost signal components, KPIs pulled not self-reported); worked case study (real `pilot report` → PASS). Signing partners = external GTM item |
 | 7.5 | Documentation site | ✅ | [#178](https://github.com/officialCodeWork/AgentContextOS/pull/178) — Docusaurus app (`website/`) serving `docs/` in place; **generated + drift-gated REST API reference** from `dist/openapi.json`; `tests/docs/` quickstart-honesty suite + `lychee`/`codespell`; `docs` CI workflow; `task docs:api`/`docs:build` |
 | 7.6 | Marketplace listings | ✅ | [#179](https://github.com/officialCodeWork/AgentContextOS/pull/179) — `marketplace/` listing artifacts (AWS/Azure/GCP); one canonical `pricing.yaml` (dims = 7.9 metering signals) + shared listing copy mapped to all three; reuse Helm/AMI/airgap/GHCR delivery; submission checklists + procurement test; approval = external process |
-| 7.7 | Packaging & distribution | ⏳ | PyPI publish (`rag-platform`), npm publish (`@ragplatform/sdk`), Docker Hub images |
+| 7.7 | Packaging & distribution | ✅ | [#180](https://github.com/officialCodeWork/AgentContextOS/pull/180) — `rag-platform` PyPI meta-package; `release.yml` fans one tag out to PyPI/npm/GHCR(admin-ui)/Helm-OCI (cosign-keyless + SPDX SBOM + OIDC/provenance) alongside `docker.yml`+`release-airgap.yml`; `apps/admin-ui/Dockerfile`; channels matrix + guide |
 | 7.8 | Support & SLA | ⏳ | Support tiers defined; SLA dashboards; PagerDuty integration; runbooks |
 | 7.9 | Billing integration | ⏳ | Stripe metered billing; usage export API; invoice generation |
 | 7.10 | GA cutover | ⏳ | `main` tag `v1.0.0`; release notes; all Phase 7 exit gates passed |
@@ -866,6 +867,14 @@ New ground — the only prior crypto was HMAC signing.  The V1 plan calls for en
 - **Reuse existing delivery — no new packaging.**  AWS (SaaS + AMI), Azure (SaaS + managed app), GCP (SaaS + K8s app) each map the model to that cloud's billing primitives and deploy via the existing Helm chart (`infra/`) + air-gap bundle (6.9) + GHCR/OCI artifacts (7.7).  The per-cloud Marketplace wrappers (packer AMI, Azure ARM, GCP `schema.yaml`) are thin shells, skeletoned.
 - **Scope:** `marketplace/` (canonical pricing + shared copy + three per-cloud specs + checklists) + the process guide.  No code / `dist` change.  **Deferred:** the Marketplace wrapper artifacts, the procurement/metering API integrations, and the actual submissions/approvals (external).  Pure docs/manifests, link-checked.  [ADR-0048](docs/adr/ADR-0048-marketplace-listings.md), [guides/marketplace-listings.md](docs/guides/marketplace-listings.md).
 
+### 7.7 — Packaging & distribution ✅ [#180](https://github.com/officialCodeWork/AgentContextOS/pull/180)
+
+- The acceptance bar — **one-command install from every channel, all artifacts signed + SBOM-attested** — met by adding a server meta-package + a release path that fans one tag out to every channel with the same signing posture the gateway image already had.
+- **`rag-platform` PyPI meta-package** (`packaging/rag-platform/`) pins the workspace component distributions, so `pip install rag-platform==X` resolves a reproducible server stack (optional backends + cloud KMS as extras).  The `agentcontextos` SDK stays a separate, lighter dist; **the existing `agentcontextos` / `@agentcontextos/sdk` scope is kept — no rename** (the plan's aspirational `ragplatform` names would break existing consumers).
+- **One tag → every channel.**  A `vX.Y.Z` tag triggers `docker.yml` (gateway image, cosign + SBOM, already shipped), the new **`release.yml`** (PyPI Trusted Publishing for the meta + SDK · npm with provenance · the **admin-ui** image via a new `apps/admin-ui/Dockerfile`, cosign + SBOM · the Helm chart pushed to **OCI** + cosign-signed), and `release-airgap.yml` (signed offline bundle).  Kept as separate workflows so each re-runs independently.
+- **Signed + SBOM, keyless.**  cosign keyless (GitHub OIDC) for images + chart, SPDX SBOM per image, OIDC Trusted Publishing for PyPI, `--provenance` for npm, cosign-over-`SHA256SUMS` for the air-gap bundle — no long-lived registry tokens.
+- **Scope:** the meta-package + `release.yml` + the admin-ui Dockerfile + a channels-matrix `packaging/README.md` + the guide.  **Deferred:** publishing the generated Go/Java/.NET SDKs; separate `worker`/`eval-runner` images (single gateway process today; `core` is a library, not an image); the one-time trusted-publisher / GHCR setup + first publish (external).  [ADR-0049](docs/adr/ADR-0049-packaging-distribution.md), [guides/packaging-distribution.md](docs/guides/packaging-distribution.md).
+
 ---
 
 ## PR & Branch History
@@ -1019,6 +1028,7 @@ Complete log of every PR. Routine Dependabot bumps are grouped; everything else
 | [#177](https://github.com/officialCodeWork/AgentContextOS/pull/177) | 2026-06-10 | feat(admin-ui): wire dashboard + audit page to live data; clearer trace help |
 | [#178](https://github.com/officialCodeWork/AgentContextOS/pull/178) | 2026-06-10 | feat(docs): Docusaurus documentation site + generated API reference + doc-tests (Step 7.5) |
 | [#179](https://github.com/officialCodeWork/AgentContextOS/pull/179) | 2026-06-10 | docs(marketplace): AWS/Azure/GCP listing artifacts + canonical pricing model (Step 7.6) |
+| [#180](https://github.com/officialCodeWork/AgentContextOS/pull/180) | 2026-06-10 | feat(release): rag-platform PyPI meta + release.yml (PyPI/npm/Helm-OCI/admin-ui image) (Step 7.7) |
 | #78–#80, #116–#118 | Open | Dependabot bumps — awaiting merge |
 | #81 | Closed | Dependabot bump — superseded |
 

apps/admin-ui/Dockerfile

@@ -0,0 +1,28 @@
+# Admin console image — Next.js standalone output (next.config.ts: output:'standalone').
+# Build context is the repo root: docker build -f apps/admin-ui/Dockerfile .
+FROM node:20-bookworm-slim AS deps
+WORKDIR /app
+COPY apps/admin-ui/package.json apps/admin-ui/package-lock.json* apps/admin-ui/pnpm-lock.yaml* ./
+RUN if [ -f pnpm-lock.yaml ]; then corepack enable && pnpm i --frozen-lockfile; \
+    elif [ -f package-lock.json ]; then npm ci; \
+    else npm install; fi
+
+FROM node:20-bookworm-slim AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY apps/admin-ui/ ./
+RUN npm run build
+
+# Minimal runtime: just the standalone server + static assets, non-root.
+FROM node:20-bookworm-slim AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=3100
+RUN addgroup --system --gid 1001 nodejs \
+    && adduser --system --uid 1001 nextjs
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+USER nextjs
+EXPOSE 3100
+CMD ["node", "server.js"]