ci(release): upload artifacts before alias sync

.github/workflows/release.yml

@@ -190,6 +190,12 @@ jobs:
         if: ${{ steps.release.outputs.release_created }}
         run: npm publish --access public --ignore-scripts --tag ${{ steps.release-target.outputs.npm_tag }}
 
+      - name: Upload release artifacts
+        if: ${{ steps.release.outputs.release_created }}
+        env:
+          GH_TOKEN: ${{ steps.release-bot-token.outputs.token }}
+        run: gh release upload ${{ steps.release.outputs.tag_name }} dist/bin/* --clobber
+
       - name: Sync quantex alias package
         if: ${{ steps.release.outputs.release_created }}
         env:
@@ -218,9 +224,3 @@ jobs:
             -H "Accept: application/vnd.github+json" \
             https://api.github.com/repos/Drswith/quantex/dispatches \
             -d "{\"event_type\":\"sync-quantex-cli-release\",\"client_payload\":{\"version\":\"${version}\",\"npm_tag\":\"${npm_tag}\"}}"
-
-      - name: Upload release artifacts
-        if: ${{ steps.release.outputs.release_created }}
-        env:
-          GH_TOKEN: ${{ steps.release-bot-token.outputs.token }}
-        run: gh release upload ${{ steps.release.outputs.tag_name }} dist/bin/* --clobber

openspec/changes/fix-release-artifacts-before-alias-sync/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-05-20

openspec/changes/fix-release-artifacts-before-alias-sync/design.md

@@ -0,0 +1,35 @@
+## Context
+
+The Release workflow publishes npm packages, uploads GitHub release binaries, and dispatches an alias-package sync. The alias sync is useful, but it is not the source of truth for Quantex CLI binaries. If it fails before `gh release upload`, users can receive an npm version whose corresponding binary artifacts are absent from the GitHub Release.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Ensure binary artifacts are uploaded before auxiliary alias synchronization can fail the publish job.
+- Keep the release workflow simple and native to GitHub Actions.
+- Preserve strict failure reporting for alias sync after primary artifacts are safe.
+
+**Non-Goals:**
+
+- Redesign release-please, npm publishing, or alias repository synchronization.
+- Add retry queues, workflow orchestration, or new repo-local release commands.
+
+## Decisions
+
+- Move `Upload release artifacts` before `Sync quantex alias package`.
+  - Rationale: the binary artifacts are part of the primary release output, while alias sync is downstream coordination.
+  - Alternative considered: mark alias sync `continue-on-error`. That would protect binary upload too, but it could hide a real alias sync failure from release maintainers.
+
+## Risks / Trade-offs
+
+- Alias sync can still fail the publish job after artifacts are uploaded. -> This is acceptable because the primary release is complete and the failing auxiliary sync remains visible.
+- If artifact upload fails, alias sync will not run. -> This preserves the current fail-fast behavior for incomplete primary releases.
+
+## Migration Plan
+
+Merge the workflow ordering change. No data migration is required. If rollback is needed, revert the workflow commit.
+
+## Open Questions
+
+None.

openspec/changes/fix-release-artifacts-before-alias-sync/proposal.md

@@ -0,0 +1,23 @@
+## Why
+
+The release workflow can publish the npm package before attempting alias-package synchronization, but a later alias sync failure currently prevents GitHub release binaries from being uploaded. This can leave a partially published release where self-upgrade and binary installers cannot fetch the matching artifacts.
+
+## What Changes
+
+- Upload GitHub release binary artifacts immediately after the package is published.
+- Run alias-package synchronization only after core release artifacts are already attached to the GitHub Release.
+- Keep alias synchronization strict when it runs; this change only reduces its blast radius over primary release artifacts.
+
+## Capabilities
+
+### New Capabilities
+
+### Modified Capabilities
+
+- `release-workflow`: publishing a release must prioritize attaching binary artifacts before auxiliary alias-package synchronization.
+
+## Impact
+
+- Affects `.github/workflows/release.yml`.
+- Updates the `release-workflow` OpenSpec contract.
+- No CLI runtime API, dependency, or schema changes.

openspec/changes/fix-release-artifacts-before-alias-sync/specs/release-workflow/spec.md

@@ -0,0 +1,12 @@
+## ADDED Requirements
+
+### Requirement: Release Publishing Prioritizes Primary Artifacts
+
+The Release workflow SHALL attach generated binary artifacts to the GitHub Release before running auxiliary downstream synchronization that is not required for those artifacts to be available.
+
+#### Scenario: alias synchronization fails after publish
+
+- **WHEN** a release publish run has created the GitHub Release and published the npm package
+- **AND** generated binary artifacts are ready to upload
+- **THEN** the workflow MUST upload the binary artifacts before dispatching alias-package synchronization
+- **AND** an alias-package synchronization failure MUST NOT prevent those binary artifacts from being attached to the GitHub Release

openspec/changes/fix-release-artifacts-before-alias-sync/tasks.md

@@ -0,0 +1,10 @@
+## 1. Release Workflow
+
+- [x] 1.1 Move GitHub release artifact upload before alias-package synchronization.
+- [x] 1.2 Update the release-workflow OpenSpec delta for the ordering guarantee.
+
+## 2. Validation and Delivery
+
+- [x] 2.1 Run OpenSpec validation.
+- [x] 2.2 Run required lint, format, and typecheck validation.
+- [x] 2.3 Commit and push the fix branch.