[AlexMikhalev]

The public release workflow packages the LSP-only terraphim-lsp catalog extension instead of uploading the combined legacy terraphim build. Package qualification binds the exact catalog manifest, source path, tagged files and CI-produced WASM. The publisher consumes the original verify-job artifact by ID and rejects substituted variants or changed bytes before upload.

The catalog provisions the actual public terraphim_lsp-v1.22.0-rc.7 release using fixed tag/target asset URLs and verified checksums, avoiding the GitHub metadata API failure observed in a fresh stock-Zed installation. It has no PATH fallback; an explicit user binary path remains supported. The combined legacy adapter retains its existing Gitea/API/PATH behavior and independent MCP pin.

JSON and JSONC attach only to the catalog adapter for passive tracking of open export destinations. The RC7 server refuses graph export over unsaved edits; it does not run Markdown alternatives, Lab analysis or diagnostics on those buffers. All six RC7 binaries have been anonymously verified, and actual downloaded macOS binaries pass dirty-buffer protocol checks with changed pending graph content. The source-native check remains required: the prior RC6 run exposed an overwritten unsaved interior JSON edit, and its failure evidence is preserved.

Tag pushes verify without publishing. Protected publication requires manual dispatch at the exact tag, the native-tested source SHA, and an immutable source-repository JSON receipt. CI checks the receipt's source/catalog identity, recorded dev-module hash, actual released-server hash and required saved-output results. The native dev module remains distinct from the CI release module. Install instructions require a separate check of the downloaded four-file package without rebuilding it.

Validation: 80 root Rust tests, 67 default catalog Rust tests and 72 Python tests pass. Native/WASI Clippy denies warnings; both release WASM builds, formatting and actionlint pass. Tests use real Git fixtures, archives, both compiled WASM variants and the actual Rust release contract. The actual-manifest regression fails on the prior Markdown-only catalog and passes with the JSON/JSONC attachment. Independent review found no blocking findings. Linux/macOS PR CI is running at b75b475adebe42604ac9ba86023b884c7049bc58.

Release remains held for exact-source native qualification, including visible dirty-interior-JSON refusal and preserved buffer/disk with a differing pending export. After CI publication, a separate native installation must verify the actual compiled archive. Official Zed catalog submission requires a human-authored upstream PR; the Zed application fork stays separate.