The update coordinator needs the maintained TUF observer extensions without distribution patches. This source client now has the explicit identity @stacksjs/tuf-js; the local CLI and conformance harness import that package rather than upstream tuf-js. Original MIT attribution is retained.
bun run release:patch uses the existing native Changesets workflow and successfully prepared client 6.0.1, its internal CLI dependency update, frozen lockfile and package archive. The fork publishes only the client as a versioned GitHub release archive, SHA512SUMS and source.json. This distribution requires no npm publication or registry credentials. Repository release immutability is enabled and verified.
The tag-only workflow builds and packs the exact source, runs the full native test suite, lint and format checks, verifies tag/package identity, main ancestry, a clean source tree and the single expected archive, then publishes its assets. The inherited npm publishing workflow is replaced so upstream workspace packages are not published by this fork. Verification implementation and test assertions are unchanged.
Validation: source build, lint, formatting and client types pass. The 19-file local archive contains the expected scoped manifest, exact README and original MIT license. Independent Spec and Standards reviews cover the source changes. A local focused run had 39 passes and two HTTP timeout failures on the loaded host; it is not counted as green. Full local suite admission was denied below 4 GB. Exact-head remote full matrix, conformance and smoke checks are required before main, followed by exact-tag release qualification and downloaded archive checks. No package release or Drone adoption is claimed yet.
Refs stacksjs/drone#108.
Final exact-head CI 40122782407 passed all 16 jobs on its first attempt, including 348 tests in every one of the 15 OS/Node combinations. Conformance and smoke passed. Both final independent reviews are clean. The local timeout failure remains recorded; remote results do not rewrite it. Main/tag publication is the next step.