From 03b26e58900798353c39593ffe1422b31879772b Mon Sep 17 00:00:00 2001
From: Yaacov <coryacos1@gmail.com>
Date: Mon, 20 Jul 2026 15:59:43 +0300
Subject: [PATCH 1/2] Establish the agent release promotion lane

---
 .github/workflows/scient-quality.yml |  4 +-
 .github/workflows/scient-release.yml | 60 ++++++++++++++++++++++++++++
 script/scient-workflow-check.ts      |  1 +
 3 files changed, 63 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/scient-release.yml

diff --git a/.github/workflows/scient-quality.yml b/.github/workflows/scient-quality.yml
index 621d3cd91..1c7320de2 100644
--- a/.github/workflows/scient-quality.yml
+++ b/.github/workflows/scient-quality.yml
@@ -2,9 +2,9 @@ name: Scient quality
 
 on:
   push:
-    branches: [dev]
+    branches: [dev, release/stable]
   pull_request:
-    branches: [dev]
+    branches: [dev, release/stable]
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/scient-release.yml b/.github/workflows/scient-release.yml
new file mode 100644
index 000000000..063d2c309
--- /dev/null
+++ b/.github/workflows/scient-release.yml
@@ -0,0 +1,60 @@
+name: Scient release lane
+
+on:
+  pull_request:
+    branches: [release/stable]
+  workflow_dispatch:
+
+concurrency:
+  group: scient-release-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  release-policy:
+    name: Scient release policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Verify release promotion source
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          HEAD_BRANCH: ${{ github.head_ref }}
+          REF_NAME: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            case "$HEAD_BRANCH" in
+              dev|hotfix/*) ;;
+              *)
+                echo "release/stable accepts promotion PRs only from dev or emergency hotfix/* branches." >&2
+                exit 1
+                ;;
+            esac
+          elif [[ "$REF_NAME" != "release/stable" ]]; then
+            echo "Manual release validation must run from release/stable." >&2
+            exit 1
+          fi
+
+      - name: Verify Scient public identity
+        run: bun run scient:identity-check
+
+      - name: Verify workflow isolation and immutable actions
+        run: bun run scient:workflow-check
+
+      - name: Record validated source
+        run: |
+          echo "Validated release source: $(git rev-parse HEAD)"
+          echo "This workflow validates the promotion boundary; it does not publish agent artifacts."
diff --git a/script/scient-workflow-check.ts b/script/scient-workflow-check.ts
index bf83e18a7..8950e4842 100644
--- a/script/scient-workflow-check.ts
+++ b/script/scient-workflow-check.ts
@@ -5,6 +5,7 @@ import path from "node:path"
 
 const OWNED_WORKFLOWS = new Set([
   ".github/workflows/scient-quality.yml",
+  ".github/workflows/scient-release.yml",
   ".github/workflows/scient-upstream-monitor.yml",
 ])
 const UPSTREAM_REPOSITORY_GUARD =

From 460a70488e8482c9d406c199b1dadc234bca3153 Mon Sep 17 00:00:00 2001
From: Yaacov <coryacos1@gmail.com>
Date: Mon, 20 Jul 2026 16:08:56 +0300
Subject: [PATCH 2/2] Install Bun for release validation

---
 .github/workflows/scient-release.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/scient-release.yml b/.github/workflows/scient-release.yml
index 063d2c309..2144c7379 100644
--- a/.github/workflows/scient-release.yml
+++ b/.github/workflows/scient-release.yml
@@ -26,6 +26,11 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: package.json
+
       - name: Verify release promotion source
         env:
           EVENT_NAME: ${{ github.event_name }}