From c19b465e9ec4435983581292eeb7802c5cecc31c Mon Sep 17 00:00:00 2001
From: David Spencer <1526975+DecisionNerd@users.noreply.github.com>
Date: Sat, 1 Aug 2026 01:00:43 -0600
Subject: [PATCH 1/2] fix(release): load reviewed npm recovery publisher

---
 .github/workflows/publish.yaml               | 12 ++++++++++++
 scripts/ci/test-release-publish-preflight.py |  2 ++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index bf5430077..05246d775 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -198,6 +198,18 @@ jobs:
         with:
           ref: ${{ needs.candidate-preflight.outputs.release_sha }}
 
+      - name: Load reviewed npm recovery publisher
+        if: github.event_name == 'workflow_dispatch'
+        shell: bash
+        run: |
+          git fetch --no-tags origin \
+            +refs/heads/main:refs/remotes/origin/main
+          git show refs/remotes/origin/main:scripts/publish_npm_artifacts.py \
+            > "$RUNNER_TEMP/publish_npm_artifacts.py"
+          install -m 0755 \
+            "$RUNNER_TEMP/publish_npm_artifacts.py" \
+            scripts/publish_npm_artifacts.py
+
       - uses: actions/setup-node@v6
         with:
           node-version: "20"
diff --git a/scripts/ci/test-release-publish-preflight.py b/scripts/ci/test-release-publish-preflight.py
index 7cd1a7d82..3849849ad 100644
--- a/scripts/ci/test-release-publish-preflight.py
+++ b/scripts/ci/test-release-publish-preflight.py
@@ -126,6 +126,8 @@ def load_module():
 npm_job = workflow.split("  publish-npm:\n", 1)[1].split("\n  publish-crates:", 1)[0]
 assert "needs: [candidate-preflight, publish-pypi]" in npm_job
 assert "scripts/publish_npm_artifacts.py" in npm_job
+assert "Load reviewed npm recovery publisher" in npm_job
+assert "refs/remotes/origin/main:scripts/publish_npm_artifacts.py" in npm_job
 assert "--group native" in npm_job
 assert "--group cli" in npm_job
 assert "--group skills" in npm_job

From 35bf9aa3753ec2cf9eb2d405fadcda919287f7c4 Mon Sep 17 00:00:00 2001
From: David Spencer <1526975+DecisionNerd@users.noreply.github.com>
Date: Sat, 1 Aug 2026 01:03:28 -0600
Subject: [PATCH 2/2] test(release): distinguish recovery publisher overlay

---
 scripts/ci/test-publish-cli-contract.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/ci/test-publish-cli-contract.py b/scripts/ci/test-publish-cli-contract.py
index b86ae1963..f1e7cfb3d 100644
--- a/scripts/ci/test-publish-cli-contract.py
+++ b/scripts/ci/test-publish-cli-contract.py
@@ -17,7 +17,8 @@ def main() -> None:
     assert "needs: [candidate-preflight, publish-pypi]" in npm_job
     assert "pnpm --filter @curatelabs/graphforge-cli test:offline" in npm_job
     assert "node scripts/ci/verify-node-cli-release-package.mjs" in npm_job
-    assert npm_job.count("scripts/publish_npm_artifacts.py") == 3
+    assert npm_job.count("python3 scripts/publish_npm_artifacts.py") == 3
+    assert "Load reviewed npm recovery publisher" in npm_job
     assert npm_job.index("--group native") < npm_job.index("verify-node-cli-release-package.mjs")
     assert npm_job.index("verify-node-cli-release-package.mjs") < npm_job.index("--group cli")
     assert npm_job.index("--group cli") < npm_job.index("--group skills")