Add Kent release workflow infrastructure

.kent/commands/release.md

@@ -0,0 +1,43 @@
+---
+description: Prepare and publish a Puber release through one workflow
+---
+
+# Release
+
+Human-facing Puber release command. Use this for backlog tasks such as "make next minor release from master".
+
+## Defaults
+
+- Base branch: `origin/master`, unless the task explicitly names another base.
+- Version bump: next **minor** by default.
+- Patch release only when the task explicitly says patch/hotfix.
+- Major release only when the task explicitly says major.
+
+## Flow
+
+1. Fetch `origin/master` and tags.
+2. Read `currentVersion` from `app/build.gradle.kts` on the base branch.
+3. Compute the target version:
+   - minor default: `X.Y.Z` -> `X.(Y+1).0`
+   - patch explicit: `X.Y.Z` -> `X.Y.(Z+1)`
+   - major explicit: `X.Y.Z` -> `(X+1).0.0`
+4. Create or reuse `release/<version>` from the fetched base.
+5. Update `currentVersion` in `app/build.gradle.kts`.
+6. Commit `Bump version to <version>`.
+7. Verify with compile checks. If release signing secrets are unavailable, report that production packaging could not be
+   locally proven, but do not block the version-bump PR solely for missing local signing secrets.
+8. Run Compliance Review.
+9. Create or update a PR for `release/<version>`.
+10. Monitor CI/checks.
+11. After approval, verify the PR is merged into `origin/master`, create tag `v<version>` on the master commit, and push
+    the tag.
+12. Monitor release automation when available.
+13. Cleanup conservatively.
+
+## Safety Rules
+
+- Never push directly to `master`.
+- Never merge the PR.
+- Never create or push the release tag before the version bump is present on `origin/master`.
+- If the PR is not merged, publication must block with a clear `blocker_reason`.
+- If a tag already exists locally or remotely and does not point to the intended commit, block.

.kent/commands/ship-pr.md

@@ -16,7 +16,8 @@ Desktop workflows.
 - Compliance Review passed for the work product.
 - The task worktree contains the final reviewed changes.
 - There are no unresolved blockers or unreviewed compliance findings.
-- Release workflows are excluded; release branch/tag publication uses dedicated release workflow gates.
+- Release workflows may use this command for the release version-bump PR. Tag publication still uses dedicated release
+  workflow gates after the PR is merged.
 
 ## Steps
 

.kent/project-contract.md

@@ -15,6 +15,9 @@ Puber workflow commands must use explicit task artifacts. Do not infer a feature
 - Compliance Review produces `compliance_report`.
 - PR creation produces `pr_url`, `branch_name`, and `workspace_path`; no-diff/report-only PR skips produce `pr_report`.
 - PR/CI monitoring produces `ci_report`.
+- Release preparation produces `release_version`, `release_type`, `release_branch`, `release_tag`, `workspace_path`,
+  `version_bump_commit`, and `verification_summary`.
+- Release publication produces `target_commit`, `tag_push_status`, and `release_report`.
 - Every blocked transition must provide `blocker_reason`.
 - Cleanup produces `cleanup_report`.
 
@@ -28,6 +31,7 @@ Puber workflow commands must use explicit task artifacts. Do not infer a feature
 - `migration_start_command`: `.kent/commands/migration-start.md`
 - `smoke_command`: `.kent/commands/smoke-test.md`
 - `ship_pr_command`: `.kent/commands/ship-pr.md`
+- `release_command`: `.kent/commands/release.md`
 - `release_prepare_command`: `.kent/commands/release-branch.md`
 - `release_tag_command`: `.kent/commands/release-tag.md`
 - `cleanup_command`: `.kent/commands/cleanup-task.md`
@@ -85,15 +89,28 @@ worktree metadata until Kent rebind behavior is fixed.
   merged PR.
 - Cleanup always emits `cleanup_report`; skipped cleanup is a valid result and must be visible.
 
+## Release Policy
+
+Use `Puber Release` for human-facing release tasks.
+
+- Default release type is next minor from `origin/master`.
+- Patch and major releases require explicit task wording.
+- The workflow prepares the version bump, runs Compliance Review, creates/updates a PR, monitors CI, then publishes the
+  tag only after explicit approval and after verifying the release PR is merged into `origin/master`.
+- Never create or push a release tag before the version bump is present on `origin/master`.
+- Legacy split workflows (`Puber Release Preparation`, `Puber Release Publication`) are not intended for new tasks.
+
 ## Naming Policy
 
 Use generic workflow graph keys and project-prefixed live workflow names:
 
 - Live workflow names: `Puber Feature Delivery`, `Puber Refactor With Audit`, `Puber Bugfix Investigation`,
-  `Puber Dependency Update`, `Puber Test Coverage`, `Puber Smoke Test`, `Puber Release Preparation`,
-  `Puber Release Publication`.
-- Node keys: `plan`, `implement`, `audit`, `fix`, `smoke`, `ship_pr`, `ci_monitor`, `cleanup`, `done`, `blocked`.
+  `Puber Dependency Update`, `Puber Test Coverage`, `Puber Smoke Test`, `Puber Release`.
+- Node keys: `plan`, `implement`, `audit`, `fix`, `smoke`, `prepare`, `compliance`, `ship_pr`, `ci_monitor`, `publish`,
+  `monitor`, `cleanup`, `done`, `blocked`.
 - Transition IDs: `implement`, `continue_implementation`, `audit`, `needs_changes`, `smoke`, `ship_pr`, `monitor_ci`,
   `done`, `blocked`.
 - Portable params: `workspace_path`, `plan_path`, `audit_report`, `review_report`, `verification_report`, `pr_url`,
-  `branch_name`, `pr_report`, `ci_report`, `compliance_report`, `blocker_reason`, `cleanup_report`.
+  `branch_name`, `pr_report`, `ci_report`, `compliance_report`, `release_version`, `release_type`, `release_branch`,
+  `release_tag`, `version_bump_commit`, `target_commit`, `tag_push_status`, `release_report`, `blocker_reason`,
+  `cleanup_report`.

.kent/workflows/README.md

@@ -31,13 +31,16 @@ Kent Desktop workflow graph
   create/update PR -> monitor CI -> cleanup.
 - `Puber Smoke Test`: focused device smoke test -> optional approved fix -> rerun smoke -> compliance ->
   create/update PR when changes exist -> monitor CI -> cleanup.
-- `Puber Release Preparation`: prepare release branch/version bump -> approved verify/push step -> compliance -> cleanup.
-- `Puber Release Publication`: qualify release tag -> approved tag push -> optional automation monitor -> compliance ->
-  cleanup.
+- `Puber Release`: default next minor release from `origin/master` -> version bump branch/PR -> CI -> approved tag
+  publication after the PR is merged -> optional automation monitor -> cleanup. Patch/major releases require explicit
+  task wording.
 
 Only `Puber Feature Delivery` should be the project default. The other workflows are linked to the project for explicit
 task creation when the work type is known.
 
+Legacy split release workflows (`Puber Release Preparation` and `Puber Release Publication`) are superseded by
+`Puber Release` and must not be linked to the project for new tasks.
+
 ## Authoring Rules
 
 - Use `default` as node assignee unless Kent workflow validation can see project-local roles.