fix(openapi-mcp): retire bootstrap and tolerate registry propagation

[Adam Poulemanos (bashandbone)]

What

Finish the repository-side transition after the verified public bootstrap of @knitli/openapi-mcp@0.0.0.

• Remove the completed manual bootstrap dispatch and token-backed jobs.
• Preserve the OIDC readiness gate and the release adapter's rejection of token authentication/wiring.
• Before the public install, wait for the exact version to appear in npm's package listing: six attempts maximum, ten-second request timeouts and ten-second intervals. Retry only package/version absence; other errors fail closed.
• Keep publication exactly once and cryptographic verification mandatory, outside the availability retry.
• Record the bootstrap source/run/artifact hashes and the successful subsequent public-install, signature/provenance, and consumer checks. Keep owner-reported npm settings distinct from independently verified state.

The bootstrap run published successfully, then received a registry 404 about 0.68 seconds later. Subsequent public verification passed. This PR does not rerun 0.0.0, set OPENAPI_MCP_OIDC_READY, start a regular release, or deploy OS.

Plugin(s) affected

• None (repo-level release workflow and openapi-mcp documentation)

Verification

• Full repository suite: 1,003 passed, one known Graph skip, zero failures; 4,903 assertions across 40 files.
• Focused release regressions: 12 passed, 124 assertions, including visibility retry/exhaustion, malformed metadata, request/body timeout, OIDC gates, exactly-one publication, and executing the actual verification-step script to enforce readiness-before-install and abort-on-readiness-failure.
• Repository validation and generated-file synchronization: passed.
• Biome check of changed release helper/tests and whitespace check: passed.
• Live read-only wait-for-version 0.0.0 CLI smoke check: passed.
• Independent review and scoped re-review: no outstanding findings. The review's one minor workflow-ordering test gap was addressed and re-reviewed.

Operational follow-up

The owner removed the bootstrap GitHub secret and reports configuring npm trusted publishing and disabling token publication. Confirm the exact knitli/toolshed / release.yml / npmrelease publisher settings and npm token revocation before separately enabling the first regular release. The unused bootstrap owner/enablement repository variables can be retired independently.

Rollback: revert this PR only with OPENAPI_MCP_OIDC_READY still disabled. Do not restore a bootstrap token or attempt to republish 0.0.0.

Checklist

• Conventional commit with openapi-mcp scope
• Repository validation and release regression tests pass
• Package README and bootstrap release record updated
• No manually authored package changelog or version bump

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T16:54:39.655226Z	1fc7b6f	PR opened
🔒 Security Review	✅ Completed 2026-09-05T16:53:21.064889Z	1fc7b6f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀