fix(verify-sdk): wait for matching broker tarball before install

.github/workflows/verify-publish-sdk.yml

@@ -85,12 +85,20 @@ jobs:
       # The SDK pins internal runtime deps to the exact same release version;
       # wait for those too so npm/Bun installs cannot resolve a half-published
       # SDK that later fails at runtime inside @agent-relay/sdk/workflows.
-      - name: Wait for SDK and internal deps on registry
+      #
+      # The matching broker package is included because npm silently skips
+      # optionalDependencies that 404 — if the broker tarball hasn't reached
+      # the CDN edge serving this runner yet, install would "succeed" with
+      # no broker installed and the next step would fail confusingly.
+      # `npm view <pkg> version` and the actual tarball fetch can hit
+      # different caches, so additionally probe the tarball URL directly.
+      - name: Wait for SDK, internal deps, and matching broker on registry
         shell: bash
         run: |
           set -euo pipefail
           SPEC="${{ steps.spec.outputs.spec }}"
           VERSION="${{ steps.spec.outputs.version }}"
+          EXPECTED_BROKER="${{ matrix.expected_pkg }}"
           if [ "$VERSION" = "latest" ]; then
             echo "version=latest — no wait needed"
             exit 0
@@ -102,18 +110,35 @@ jobs:
             "@agent-relay/github-primitive@$VERSION"
             "@agent-relay/slack-primitive@$VERSION"
             "@agent-relay/workflow-types@$VERSION"
+            "${EXPECTED_BROKER}@$VERSION"
           )
 
-          for i in 1 2 3 4 5 6; do
+          for i in 1 2 3 4 5 6 7; do
             missing=()
             for pkg in "${PACKAGES[@]}"; do
               if ! npm view "$pkg" version >/dev/null 2>&1; then
                 missing+=("$pkg")
               fi
             done
 
+            # Even when `npm view` succeeds, the tarball may still 404 from
+            # the CDN edge that npm install hits. Probe the tarball URL of
+            # the matching broker directly.
             if [ "${#missing[@]}" -eq 0 ]; then
-              echo "registry has SDK and internal deps for $VERSION"
+              TARBALL_URL=$(npm view "${EXPECTED_BROKER}@$VERSION" dist.tarball 2>/dev/null || true)
+              if [ -z "$TARBALL_URL" ]; then
+                missing+=("${EXPECTED_BROKER}@$VERSION (no tarball url)")
+              else
+                STATUS=$(curl -sS -o /dev/null -w "%{http_code}" -I \
+                  --connect-timeout 5 --max-time 15 "$TARBALL_URL" || echo "000")
+                if [ "$STATUS" != "200" ]; then
+                  missing+=("${EXPECTED_BROKER}@$VERSION (tarball HTTP $STATUS)")
+                fi
+              fi
+            fi
+
+            if [ "${#missing[@]}" -eq 0 ]; then
+              echo "registry has SDK, internal deps, and ${EXPECTED_BROKER} for $VERSION"
               exit 0
             fi
 

.gitignore

@@ -87,6 +87,7 @@ web/waitlist.json
 web/.open-next
 .msd/
 /workflows/*
+.workflow-artifacts/*
 !/workflows/ci/
 !/workflows/refactor/
 !/workflows/relayauth-integration/

package.json

@@ -147,7 +147,7 @@
     "@relayfile/local-mount": "^0.2.2",
     "@relayfile/sdk": "^0.6.0",
     "@sinclair/typebox": "^0.34.14",
-    "agent-trajectories": "^0.5.7",
+    "agent-trajectories": "^0.5.8",
     "chalk": "^4.1.2",
     "chokidar": "^5.0.0",
     "commander": "^12.1.0",

prpm.lock

@@ -154,9 +154,9 @@
       "installedPath": ".claude/skills/choosing-swarm-patterns/SKILL.md"
     },
     "@agent-relay/writing-agent-relay-workflows#claude": {
-      "version": "1.5.1",
-      "resolved": "https://registry.prpm.dev/api/v1/packages/%40agent-relay%2Fwriting-agent-relay-workflows/1.5.1.tar.gz",
-      "integrity": "sha256-745f43edd930c5f930065e8f92a3f2fae6ef902dd768576d574f9c3a50837042",
+      "version": "1.6.2",
+      "resolved": "https://registry.prpm.dev/api/v1/packages/%40agent-relay%2Fwriting-agent-relay-workflows/1.6.2.tar.gz",
+      "integrity": "sha256-2394f6b0cd6ef65e871720646d23b9406a2193a314bd82e1f9a6eb0416c672ed",
       "format": "claude",
       "subtype": "skill",
       "sourceFormat": "claude",
@@ -194,9 +194,9 @@
       "installedPath": ".agents/skills/choosing-swarm-patterns/SKILL.md"
     },
     "@agent-relay/writing-agent-relay-workflows#codex": {
-      "version": "1.5.1",
-      "resolved": "https://registry.prpm.dev/api/v1/packages/%40agent-relay%2Fwriting-agent-relay-workflows/1.5.1.tar.gz",
-      "integrity": "sha256-745f43edd930c5f930065e8f92a3f2fae6ef902dd768576d574f9c3a50837042",
+      "version": "1.6.2",
+      "resolved": "https://registry.prpm.dev/api/v1/packages/%40agent-relay%2Fwriting-agent-relay-workflows/1.6.2.tar.gz",
+      "integrity": "sha256-2394f6b0cd6ef65e871720646d23b9406a2193a314bd82e1f9a6eb0416c672ed",
       "format": "codex",
       "subtype": "skill",
       "sourceFormat": "claude",
@@ -244,5 +244,5 @@
       "installedPath": ".agents/skills/relay-80-100-workflow/SKILL.md"
     }
   },
-  "generated": "2026-05-04T08:36:28.666Z"
+  "generated": "2026-05-09T09:15:37.156Z"
 }