Restore installable source ZIPs and OctoJPack release ownership

.github/workflows/ci.yml

@@ -32,20 +32,25 @@ jobs:
           coverage: none
       - name: Validate Composer metadata
         run: composer validate --no-check-publish
-      - name: Install PHP dependencies
-        run: composer install --no-interaction --prefer-dist --no-progress
+      - name: Verify the committed source ZIP and relocated runtime
+        run: |
+          mkdir -p build
+          git archive --format=zip --prefix=component-source/ --output=build/component-source.zip HEAD
+          php tests/package.php build/component-source.zip
+      - name: Verify locked dependencies are already installed
+        run: composer install --no-dev --no-interaction --no-scripts --dry-run
       - name: PHP syntax
         run: find . -type d \( -name vendor -o -name .git -o -name .reference -o -name build \) -prune -o -type f -name '*.php' -print0 | xargs -0 -r -n1 php -l
       - name: Verify source-pinned seed reproducibility
         run: |
           set -euo pipefail
           php tools/generate-catalogue.php
-          git diff --exit-code -- admin/sql data/catalogue-seed.json docs/migration/parity.json
+          git diff --exit-code -- admin/sql admin/data/catalogue-seed.json docs/migration/parity.json
       - name: Behavioural and source-parity contracts
         run: |
           set -euo pipefail
           mkdir -p build/evidence
-          for suite in run catalogue schema-shapes execution actions planned jobs process job-process jcb jcb-plan-preview protocol http ownership native/run; do
+          for suite in run catalogue schema-shapes execution actions planned jobs process job-process jcb jcb-plan-preview protocol http ownership native/run release; do
             php "tests/$suite.php" | tee "build/evidence/${suite//\//-}.log"
           done
       - name: Preserve the tested PHP runtime for reproducible investigation

.github/workflows/generate-catalogue.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Commit only generated catalogue files to the existing PR branch
         run: |
           set -euo pipefail
-          git add -- admin/sql data/catalogue-seed.json docs/migration/parity.json
+          git add -- admin/sql admin/data/catalogue-seed.json docs/migration/parity.json
           if git diff --cached --quiet; then
             exit 0
           fi

.github/workflows/golden-image.yml

@@ -27,8 +27,8 @@ jobs:
           extensions: curl, dom, fileinfo, intl, json, mbstring, sodium, xml, zip
           tools: composer:v2
           coverage: none
-      - name: Build the actual installable component
-        run: bash tools/build.sh && php tests/package.php
+      - name: Verify the committed installable component
+        run: php tests/package.php
       - name: Check out the JCB implementation under test
         uses: actions/checkout@v7
         with:

.github/workflows/integration.yml

@@ -70,16 +70,14 @@ jobs:
       - name: Install the client dependencies for HTTPS and remote stdio acceptance
         working-directory: build/client-source
         run: composer install --no-interaction --prefer-dist --no-progress
-      - name: Build a complete distributable with its PHP dependencies
+      - name: Record the reviewed companion sources
         run: |
-          bash tools/build.sh
-          bash tools/build-distribution.sh "$GITHUB_WORKSPACE/build/plugin-source"
           mkdir -p build/evidence
           git -C build/plugin-source rev-parse HEAD > build/evidence/console-plugin-source.txt
           git -C build/client-source rev-parse HEAD > build/evidence/client-source.txt
-      - name: Validate packaged files and native manifests
+      - name: Validate committed runtime files and native manifests
         run: |
-          php tests/package.php --distribution
+          php tests/package.php
           php tests/release.php
       - name: Install, execute HTTP, console and HTTPS client operations, then upgrade
         env:
@@ -93,15 +91,14 @@ jobs:
           MCP_PLUGIN_SOURCE: ${{ github.workspace }}/build/plugin-source
           MCP_CLIENT_SOURCE: ${{ github.workspace }}/build/client-source
         run: bash tests/integration/run.sh
-      - name: Preserve redacted evidence and the development package
+      - name: Preserve redacted evidence and the tested source ZIPs
         if: always()
         uses: actions/upload-artifact@v7
         with:
           name: installed-${{ matrix.database }}-php-${{ matrix.php }}
           path: |
             build/evidence/
-            build/*joomengine_mcp-*.zip
-            build/*joomengine_mcp-*.zip.sha256
-            build/distribution.json
+            build/component-source.zip
+            build/console-plugin-source.zip
           if-no-files-found: error
           retention-days: 7