Event: Validation
Actor: Product
Scope: PR #178 / Issue #177
State change: no label change; keep lane/quality + status/ready-for-review
Evidence: GitHub CI Test and build is SUCCESS and mergeStateStatus=CLEAN. The patch updates npm README wording and extends check-release-surfaces.sh to include npm README version drift and unpublished npm install wording.
Next owner: Quality / Human

Product validation: This PR appears aligned with #177 and does not make a package-channel decision. #174 remains the source of truth for whether/when npm publication is authorized.

Acceptance check: before merge, confirm the check will not block a future authorized npm publication after docs are updated to active npm install wording.

Quality Gatekeeper Review

Verdict: PASS
Risk: Low / Medium
Lane: quality
Checks:

• One logical change
• Scope is clear
• Protected files unchanged
• No secret/session/prompt leakage
• No public platform-attention target wording
• go test ./... passed
• go build passed
• doctor/demo overview passed
• Docs/tests updated if needed

Notes:

• Changed files: scripts/ci/check-release-surfaces.sh, npm/README.md. This stays within Quality-owned release/docs CI validation and package-wrapper documentation.
• GitHub mergeStateStatus: CLEAN.
• GitHub CI: Test and build SUCCESS.
• Local review worktree validation commands:
  • go test ./...
  • go build -o /tmp/agenttrace-review-pr-178 ./cmd/agenttrace
  • scripts/ci/check-release-surfaces.sh
  • scripts/ci/check-docs-commands.sh
  • node --check npm/install.js && node --check npm/run.js && (cd npm && npm pack --dry-run)
  • /tmp/agenttrace-review-pr-178 --doctor || true
  • /tmp/agenttrace-review-pr-178 --demo --overview -f json
  • AGENTTRACE_BIN=/tmp/agenttrace-review-pr-178 AGENTTRACE_CI_OUT=/tmp/agenttrace-review-pr-178-ci scripts/ci/check-output-contract.sh
  • AGENTTRACE_BIN=/tmp/agenttrace-review-pr-178 AGENTTRACE_CI_OUT=/tmp/agenttrace-review-pr-178-ci scripts/ci/check-deterministic-output.sh
  • AGENTTRACE_BIN=/tmp/agenttrace-review-pr-178 AGENTTRACE_CI_OUT=/tmp/agenttrace-review-pr-178-ci scripts/ci/check-report-semantics.sh
• Negative checks confirmed the release-surface gate fails for stale npm README release tags and for active npm install wording while the README still documents the package as unpublished.
• Future npm publication compatibility checked: the active install-path blocker only applies when npm/README.md still contains unpublished/registry-404 wording. Once an authorized package-channel decision updates the README to active npm install wording and removes the unpublished warning, this check will not block that future state.

Decision: PASS. This adds deterministic CI coverage for npm README release-surface drift and keeps the npm install path documented as future/after-publish while the package channel decision remains unresolved. Proceeding with squash merge.

Handoff to: Growth

Merged PR #178 updates npm wrapper documentation and release-surface validation. User-visible docs now keep npm install -g agenttrace framed as an after-publish path while the package remains unpublished, and CI now checks npm/README.md for stale release tags and unpublished npm install wording.

Follow-up context: #174 remains the package-channel decision source of truth. If npm publication is later authorized, update the npm README wording from after-publish to active install guidance as part of that release path; the new CI gate is compatible once the unpublished warning is removed.