From c43a88102dc698e0eb41d4f77c7a4ed333d33af5 Mon Sep 17 00:00:00 2001
From: Buffrr <contact@buffrr.dev>
Date: Sun, 26 Jul 2026 19:01:06 +0200
Subject: [PATCH 1/2] fix(js): restore "*" workspace dep so publish CI can pin
 it

---
 fabric/js/fabric-react-native/package.json | 2 +-
 fabric/js/fabric-web/package.json          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fabric/js/fabric-react-native/package.json b/fabric/js/fabric-react-native/package.json
index f19569d..5a4460a 100644
--- a/fabric/js/fabric-react-native/package.json
+++ b/fabric/js/fabric-react-native/package.json
@@ -22,7 +22,7 @@
     "build": "tsc"
   },
   "dependencies": {
-    "@spacesprotocol/fabric-core": "^0.1.0",
+    "@spacesprotocol/fabric-core": "*",
     "@spacesprotocol/react-native-libveritas": "^0.3.1",
     "uniffi-bindgen-react-native": "0.29.3-1"
   },
diff --git a/fabric/js/fabric-web/package.json b/fabric/js/fabric-web/package.json
index 32a67af..d98cf75 100644
--- a/fabric/js/fabric-web/package.json
+++ b/fabric/js/fabric-web/package.json
@@ -26,7 +26,7 @@
   },
   "dependencies": {
     "@noble/curves": "^1.8.0",
-    "@spacesprotocol/fabric-core": "^0.1.0",
+    "@spacesprotocol/fabric-core": "*",
     "@spacesprotocol/libveritas": "^0.3.1"
   },
   "devDependencies": {

From 5dd4859fe8c983e7762aec01bf6aee57a1476997 Mon Sep 17 00:00:00 2001
From: Buffrr <contact@buffrr.dev>
Date: Sun, 26 Jul 2026 19:04:57 +0200
Subject: [PATCH 2/2] fix(ci): serialize Go mirror publish to avoid ref-lock
 race

---
 .github/workflows/publish-go.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-go.yml b/.github/workflows/publish-go.yml
index 9f7ca55..ab3b3c0 100644
--- a/.github/workflows/publish-go.yml
+++ b/.github/workflows/publish-go.yml
@@ -9,6 +9,13 @@ on:
 permissions:
   contents: write
 
+# Serialize runs: the mirror push force-updates fabric-go's main, so two
+# concurrent runs race on the ref ("cannot lock ref refs/heads/main").
+# Queue instead of cancel so no publish is dropped.
+concurrency:
+  group: publish-go
+  cancel-in-progress: false
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -47,5 +54,14 @@ jobs:
           git commit -m "Release ${VERSION}"
           git tag "${VERSION}"
           git remote add origin "https://x-access-token:${GH_TOKEN}@github.com/spacesprotocol/fabric-go.git"
-          git push origin main --force
+          # Force-mirror main; retry the ref update in case a concurrent run
+          # moved it between negotiation and lock (belt-and-suspenders on top
+          # of the concurrency group above).
+          for attempt in 1 2 3; do
+            if git push origin main --force; then
+              break
+            fi
+            echo "main push attempt ${attempt} failed; retrying in 5s"
+            sleep 5
+          done
           git push origin "${VERSION}"