PM-invocable protocol for Cargo publish and release operations in the trusty-tools Rust monorepo: semver rules, 10-step release sequence, macOS codesign safety, and cross-crate dependency ordering
PM-invocable protocol for Cargo publish and release operations in the trusty-tools Rust monorepo: semver rules, 10-step release sequence, macOS codesign safety, and cross-crate dependency ordering
user-invocable
false
disable-model-invocation
true
version
1.0.0
category
toolchain
author
Claude MPM Team
license
MIT
progressive_disclosure
{"entry_point":{"summary":"10-step Cargo release sequence with semver rules, macOS codesign safety, and cross-crate dependency ordering","when_to_use":"When user says 'release', 'publish', 'bump version', 'ship', or 'tag a release' for any crate in the monorepo","quick_start":"1. Determine semver bump 2. Update Cargo.toml(s) 3. Quality gates 4. Commit + tag + push 5. cargo publish 6. cargo install --locked (for binaries)"},"token_estimate":{"entry":140,"full":1800}}
Invoke this protocol when the user says: "release", "publish", "bump version", "ship", "tag a release", or "cut a version" for any crate in the trusty-tools monorepo.
Semver Bump Rules
Determine the version increment from the commit history since the last tag:
Commit type
Bump
BREAKING CHANGE footer or ! suffix (e.g. feat!:)
Major (X.0.0)
feat: — new capability, no breaking change
Minor (0.X.0)
fix:, chore:, refactor:, perf:, docs:, test:
Patch (0.0.X)
For the trusty-mpm-* family, all eight crates share a single workspace version and are bumped together regardless of which crate was touched.
Crate Name vs Directory Name
Cargo -p flags use the name field in Cargo.toml, not the directory name:
Directory
Cargo flag
Tag prefix
crates/trusty-git-analytics/
-p tga
tga-v
crates/open-mpm/
-p open-mpm
open-mpm-v
All others: directory name equals crate name (e.g. crates/trusty-search/ → -p trusty-search, tag trusty-search-v).
10-Step Release Sequence
Execute steps in order. Stop on any failure.
Step 1 — Bump the crate version
# crates/<name>/Cargo.toml[package]version = "0.5.1"# was 0.5.0
For trusty-mpm-*, the version is set under [workspace.package] in the root Cargo.toml. Bump it once; all trusty-mpm-* crates inherit it.
Step 2 — Update all dependent crates in the workspace
If other crates pin the version being bumped (e.g. trusty-common = "0.4.20"), update every occurrence to the new version. Use grep to find all pins:
Never commit Step 1 without completing Step 2 — a partial update breaks cargo check workspace-wide.
Step 3 — Quality gate: tests
cargo test -p <crate>
Must produce: test result: ok. N passed; 0 failed; ...
Step 4 — Quality gate: clippy
cargo clippy -p <crate> -- -D warnings
Must produce no warnings. See rust-quality-gate for the open-mpm exception.
Step 5 — Quality gate: format
cargo fmt --check
Must produce no output (exit 0). Fix with cargo fmt if needed.
Step 6 — Commit the version bump
git add crates/<name>/Cargo.toml # and any updated dependent Cargo.toml files
git commit -m "chore(<crate>): bump to v<version>"
Example: chore(trusty-memory): bump to v0.5.1
For trusty-mpm-* family: chore(trusty-mpm): bump to v0.7.0
Step 7 — Create the git tag
Tag format: <crate-name>-v<version>
git tag trusty-memory-v0.5.1
Examples:
trusty-search-v1.2.0
trusty-memory-v0.5.1
tga-v0.3.0
open-mpm-v0.2.1
trusty-mpm-cli-v0.7.0 (one tag per trusty-mpm-* crate)
Step 8 — Push the tag to GitHub
git push origin trusty-memory-v0.5.1
Push the commit first if not already on the remote:
git push origin main # or the current branch
git push origin trusty-memory-v0.5.1
Step 9 — Publish to crates.io
cargo publish -p trusty-memory
Publishing order for cross-crate deps: publish dependencies before consumers. If trusty-common is being published alongside trusty-search, publish trusty-common first and wait for the index to propagate (~30 seconds) before publishing trusty-search.
publish = false crates — skip this step: Some crates are not published to crates.io. Check the crate's Cargo.toml for:
[package]publish = false
Known non-published crates include those that are internal-only or tightly coupled to the monorepo. Skip Step 9 for these and proceed directly to Step 10.
On macOS, cargo build produces "ad-hoc linker-signed" binaries. The kernel's code-signing cache is keyed by cdhash. A plain cp over an existing on-PATH binary leaves the kernel with a stale cached identity. The next execution is killed with EXC_CRASH / CODESIGNING — Taskgated Invalid Signature before any code runs, producing only zsh: killed with zero output — indistinguishable from an OOM kill but unrelated.
cargo install writes to a temp path and renames atomically, keeping the signing cache consistent. Always use it.
If a manual copy was made by mistake, fix with:
codesign --force --sign - ~/.cargo/bin/<binary>
trusty-mpm-* Family Release
The trusty-mpm-* family uses a shared workspace version. Release all eight crates together:
Bump version under [workspace.package] in root Cargo.toml.
Run quality gates across all trusty-mpm-* crates: cargo test -p trusty-mpm-core, cargo test -p trusty-mpm-mcp, etc.
Commit: chore(trusty-mpm): bump to v<version>.
Tag each crate separately: trusty-mpm-core-v<version>, trusty-mpm-mcp-v<version>, trusty-mpm-daemon-v<version>, trusty-mpm-client-v<version>, trusty-mpm-cli-v<version>, trusty-mpm-tui-v<version>, trusty-mpm-telegram-v<version>, trusty-mpm-gui-v<version>.
Publish publishable crates in dependency order (core → client → mcp/daemon/cli/tui/telegram/gui).
