npm --provenance validates package.json repository.url against the GitHub repo
from the OIDC attestation; these two lacked the field (reactor had it), so
publish failed E422 after reactor@0.3.0 already published. Additive metadata only.
Ships @openprose/reactor 0.3.0, @openprose/reactor-cli 0.2.0, @openprose/reactor-devtools 0.2.0: the Reactor harness (compile-once-intelligent then dumb reconciler, content-addressed receipts, cost scales with surprise) with the distilled ideal public API — curated front door, full @openai/agents passthrough, one typed handle, one Substrate, unified observe, branded ids, and additive forward seams for the fixpoint.