OSS distribution channels

Where Skyphusion Labs ships public artifacts outside GitHub. GitHub remains source of truth; these channels are install shortcuts.

npm (@skyphusion scope)

Create the @skyphusion npm organization and add org secret NPM_TOKEN (Automation token with publish access) on skyphusion-labs/.github and each publishing repo.

Package	Repo	Install	Published contents
@skyphusion/search-mcp	search-mcp	npm install @skyphusion/search-mcp	Corpus sync CLIs (search-mcp-sync, search-mcp-sync-run), ask-widget assets
@skyphusion/hollow-grid-bot	mud-bots	npm install @skyphusion/hollow-grid-bot	Hollow Grid AI player (hollow-grid-bot bin)
@skyphusion/sidvicious-exe	SidVicious_exe	npx @skyphusion/sidvicious-exe	Discord roadie (sidvicious bin); search-worker stays deploy-from-git
@skyphusion/create-prism	prism	npm create @skyphusion/prism	Scaffolder that bootstraps a new prism deployment (create-prism bin); the prism Worker itself stays deploy-from-git
@skyphusion/common-thread-verify	common-thread	npx @skyphusion/common-thread-verify	Offline Ed25519 evidence-packet verifier (paper §8.1.3); MIT carve-out. Publish on verify-v* tags via publish-verify-npm.yml. Worker monorepo stays deploy-from-git.

Release mechanics: bump version in the package manifest, tag GitHub Release vX.Y.Z, workflow publishes on release publish. Verifier packages may use a verify-v* tag pattern instead of a GitHub Release.

PyPI

Org secret PYPI_API_TOKEN on publishing repos (pypi.org → Account settings → API tokens).

Package	Repo	Install
postern-client	postern	pip install postern-client

GHCR (container images)

GPU modules, bots, and fleet services publish to ghcr.io/skyphusion-labs/<image>:<tag> from their home repos (see each repo’s release workflow). Examples:

• ghcr.io/skyphusion-labs/mud-bots-hg
• ghcr.io/skyphusion-labs/vivijure-backend
• ghcr.io/skyphusion-labs/vivijure-local-12gb

Not on npm/PyPI (deploy from git)

Cloudflare Workers and full stacks (vivijure, postern worker, the-hollow-grid, common-thread monorepo) deploy from a clone via wrangler / project runbooks. Use the repo README and docs/DEPLOY.md; npm/PyPI only cover CLI/library slices where that helps adopters (common-thread’s offline verifier is the exception; the AGPL Worker is not on npm).

Adding a new channel

1. Add the package manifest (package.json, pyproject.toml, etc.) with publishConfig.access: public for scoped npm.
2. Add .github/workflows/publish-*.yml gated on GitHub Release + version match.
3. Document install path in the repo README.
4. Add a row to this file.