Default compilation to local output and publish latest

.github/workflows/publish.yml

@@ -17,6 +17,7 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
+      actions: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -50,10 +51,18 @@ jobs:
           git rev-list --first-parent refs/remotes/origin/main > "$RUNNER_TEMP/main-first-parent"
           grep -Fqx "$release_sha" "$RUNNER_TEMP/main-first-parent"
           # release-source-checks:end
-      - run: npm ci --ignore-scripts
-      - run: npm audit
-      - run: npm run check
-      - run: npm pack --dry-run --json --ignore-scripts
+      - name: Reuse successful CI for this source
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          release_sha="$(git rev-parse 'HEAD^{commit}')"
+          ci_url="$(gh run list --repo "$GITHUB_REPOSITORY" --workflow ci.yml \
+            --branch main --event push --commit "$release_sha" --status success \
+            --limit 1 --json url --jq '.[0].url // empty')"
+          test -n "$ci_url" || { echo "No successful main CI run for $release_sha." >&2; exit 1; }
+          echo "Reusing $ci_url"
+      - run: npm run pack:check
 
   publish:
     name: Publish to npm
@@ -77,7 +86,7 @@ jobs:
       - name: Verify approved release
         env:
           NPM_RELEASE_ENABLED: ${{ vars.NPM_RELEASE_ENABLED }}
-        # Inline by design: the approved job reruns the reviewed checks before OIDC publication.
+        # Recheck mutable refs after environment approval, without rerunning CI.
         # test/package.test.js enforces synchronization with verify.
         run: |
           # release-source-checks:begin
@@ -104,4 +113,4 @@ jobs:
           grep -Fqx "$release_sha" "$RUNNER_TEMP/main-first-parent"
           # release-source-checks:end
       - name: Publish verified source with OIDC
-        run: npm publish --access public --tag next --provenance --ignore-scripts
+        run: npm publish --access public --tag latest --provenance --ignore-scripts

AGENTS.md

@@ -4,10 +4,10 @@ Start with `docs/README.md` and follow its task routes. Detailed command semanti
 handled-error recovery in `docs/errors.md`, living release policy in `RELEASING.md`, and dated release observations
 in `docs/release-history.md`. When behavior changes, update its owning document in the same change.
 
-- After merging to `main`, report the exact merged SHA and ask whether to coordinate and promote the three-repository
-  candidate. If the user defers, call the SHA unpromoted. Never publish npm, deploy First Draft, or release the
-  plugin without explicit approval.
-- Treat npm publication under `next` as candidate availability, not a completed stable release. A stable CLI release
-  is complete only after that exact candidate passes its explicitly named release-specific qualification, is
-  separately approved, and is selected by npm's `latest` dist-tag. Preserve dated alpha observations as history
-  rather than describing them as current channel state.
+- `firstdraft plan compile` defaults to local output in the current directory. GitHub publication requires
+  `--github`; Codespaces is a fallback. Keep Skill callers and recovery instructions aligned with this boundary.
+- A coordinated release needs explicit approval once. Reuse an existing approval for its named scope; do not ask
+  again between repository publication steps. A merge alone does not authorize a release.
+- Publish approved versions directly to `latest`. Reuse successful CI for the exact source and relevant smoke
+  evidence. When changed behavior needs a smoke, use local compilation; Codespaces and Revyl are not release gates.
+  Preserve dated release observations as history.

README.md

@@ -4,9 +4,13 @@ firstdraft is the command-line client shared by First Draft agents and automatio
 files, calls the versioned Service API, exposes reviewed analysis and GapSets, materializes verified Compilations,
 and coordinates private GitHub publication.
 
-Trying First Draft as a tester? Start with the
-[Drawing Board guide](https://github.com/firstdraft/drawing-board#build-an-app-with-first-draft), which installs a
-compatible CLI and Skill together.
+Start with the [local development guide](https://gist.github.com/raghubetina/3d424a97a1eaa6de8c406e67f32a237e):
+install the CLI and Skill, then compile into your current folder with `firstdraft plan compile --output .`. No Drawing Board
+clone or GitHub push is required. The [Drawing Board guide](https://github.com/firstdraft/drawing-board#build-an-app-with-first-draft)
+is the Codespaces fallback.
+
+CLI 0.4 makes `--output .` the default. Keep the explicit flag with CLI 0.3, whose zero-flag command selects GitHub
+publication.
 
 ## What this repository owns
 
@@ -17,7 +21,7 @@ compatible CLI and Skill together.
 - retained Compilation inspection and artifact download;
 - terminal output, exit status, and recovery contracts;
 - the dependency-free npm package; and
-- package provenance and release promotion.
+- package provenance and publication.
 
 The Service owns Foundation Plan meaning and server-side lifecycle. Skills own the agent conversation. This
 repository owns the exact command and transport behavior between them.
@@ -29,7 +33,7 @@ repository owns the exact command and transport behavior between them.
 | Change the CLI                       | [Agent instructions](https://github.com/firstdraft/cli/blob/main/AGENTS.md), then [documentation map](docs/README.md) |
 | Find a command or output contract    | [Command reference](docs/commands.md)                                                                                 |
 | Interpret an error or recover safely | [Errors and recovery](docs/errors.md)                                                                                 |
-| Prepare or promote a package         | [Release runbook](RELEASING.md)                                                                                       |
+| Prepare or publish a package         | [Release runbook](RELEASING.md)                                                                                       |
 | Inspect dated package observations   | [Release history](docs/release-history.md)                                                                            |
 | Report a vulnerability               | [Security policy](SECURITY.md)                                                                                        |
 
@@ -84,7 +88,7 @@ npm install --global @firstdraft.com/cli
 ```
 
 Pin an exact compatible version when a repeatable installation matters; [RELEASING.md](RELEASING.md) owns channel
-and promotion meaning.
+and release meaning.
 
 The published package:
 
@@ -101,6 +105,5 @@ including the release runbook and dated release history, ships with the package.
 
 ## Release boundary
 
-Merging source is not package publication. Publishing a candidate, moving npm dist-tags, coordinating the Skills
-package, and promoting a stable release are distinct steps in [RELEASING.md](RELEASING.md). Verify the exact packed
-digest and Service compatibility before any promotion.
+Merging source is not package publication. An approved coordinated release publishes directly to `latest`, reusing
+successful CI for the exact source. [RELEASING.md](RELEASING.md) owns the short release and recovery procedure.