G-128: punkbin publication route settled, staged and documented; punkshell 0.30.6

Distribution convention (recorded in src/tools/punkres/PROVENANCE.md): the
tool publishes to the punkbin tools tier as
win32-x86_64/tools/punkres-x86_64-windows-<ver>.exe (arch-os-version beside
the zig archives; immutable), integrity via that tier's sha1sums.txt.
0.3.1 STAGED as punkbin commit 1b471fc (sha1 166cd176..., built by the tool
step from vendored 0.3.1/f0af880, all other sha1sums SAME) - push is
maintainer-gated per punkbin AGENTS.md, and agents never push. Route
documented in bin/AGENTS.md; the seam's skip notice names both remedies
(build from vendored source, or fetch the prebuilt artifact). Demonstrated
in the program-files checkout: artifact placed as bin/punkres.exe reports
0.3.1 and make.tcl tool list reads it CURRENT against the vendored tree.
Reproducibility note recorded: zig builds differ across invocations in the
PE-header timestamp region - the published sha1 pins THE artifact.

Goal Progress: increment 1f; the only remaining acceptance item is the
maintainer push making the fetch URL live - achieved flip flagged for
confirmation at that point. punkres.test 8/8 re-verified.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

CHANGELOG.md

@@ -5,6 +5,17 @@ The latest `## [X.Y.Z]` header must match the `version` field in `punkproject.to
 Entries are newest-first; one bullet per notable change. See the root `AGENTS.md`
 "Project Versioning" section for the bump policy.
 
+## [0.30.6] - 2026-07-29
+
+- punkres is publishable as a punkbin artifact (G-128 distribution route):
+  `win32-x86_64/tools/punkres-x86_64-windows-<ver>.exe`, sha1-verified via
+  the tools tier's `sha1sums.txt`, placed at `bin/punkres.exe` - the
+  no-toolchain route that does not depend on the committed twapi. 0.3.1
+  staged in the punkbin repo (push maintainer-gated); route recorded in
+  `src/tools/punkres/PROVENANCE.md` and `bin/AGENTS.md`, and the kit-icon
+  seam's skip notice now names both remedies (build from vendored source,
+  or fetch the prebuilt artifact).
+
 ## [0.30.5] - 2026-07-29
 
 - `punk-getzig.cmd` fixed for spaced checkout paths and Windows PowerShell 5:

bin/AGENTS.md

@@ -168,7 +168,11 @@ never modified). Two mechanisms share one semantic and yield equivalent
 resource content (G-128 parity evidence): `bin/punkres(.exe)` - the vendored
 portable stamper, built via `make.tcl tool build punkres`, host-independent -
 is selected when present; otherwise the twapi arm serves windows hosts with
-nothing built. The embedded RT_GROUP_ICON is NAMED from the icon file's
+nothing built. A no-toolchain machine can also FETCH the prebuilt tool from
+the punkbin artifact repo (`win32-x86_64/tools/punkres-x86_64-windows-<ver>.exe`,
+sha1-verified against that tier's `sha1sums.txt`, placed at `bin/punkres.exe` -
+full route in `src/tools/punkres/PROVENANCE.md`). The embedded RT_GROUP_ICON
+is NAMED from the icon file's
 uppercased rootname (`punkshell.ico` -> `PUNKSHELL`, RC convention; applies
 to per-kit overrides identically since they are also named `punkshell.ico`),
 with the resource language adopted from the group being replaced. Stub

goals/G-128-portable-pe-resource-stamping.md

@@ -410,3 +410,27 @@ the parked RT_VERSION stamping wants, since the project version is known late.
   artifact, not nondeterminism.
   REMAINS for acceptance: only the punkbin publication route (G-123/G-006
   channels) for no-toolchain users.
+- 2026-07-29 increment 1f (user-directed): PUNKBIN PUBLICATION ROUTE settled,
+  staged and documented - the acceptance's final clause pending only the
+  maintainer push. Convention (recorded in
+  src/tools/punkres/PROVENANCE.md "Distribution"): the tool publishes to the
+  punkbin tools tier as win32-x86_64/tools/punkres-x86_64-windows-<ver>.exe
+  (arch-os-version naming beside the zig archives; immutable - new versions
+  add files), integrity via that tier's sha1sums.txt (punkbin's authority for
+  first-party tools; maintainer-signed .minisig = natural complement, not yet
+  present). STAGED: punkbin commit 1b471fc adds
+  punkres-x86_64-windows-0.3.1.exe (sha1 166cd176..., built by the tool step
+  from vendored 0.3.1/f0af880 with the pinned toolchain), sha1sums row
+  regenerated all-SAME-plus-one-NEW; push is maintainer-gated per punkbin
+  AGENTS.md. Route documented in bin/AGENTS.md (kit icon section) and the
+  seam's skip notice now names BOTH remedies (build from vendored source, or
+  fetch the punkbin artifact). DEMONSTRATED in the program-files checkout:
+  the artifact placed as bin/punkres.exe reports 0.3.1, make.tcl tool list
+  reads it CURRENT against the vendored tree, and the seam selects by
+  presence. Reproducibility note: zig builds differ across invocations in
+  the PE-header timestamp region, so the published sha1 pins THE artifact
+  (the vendored source + pinned toolchain reproduce a functionally
+  identical tool, not identical bytes).
+- REMAINS for acceptance: the maintainer push of punkbin 1b471fc (making the
+  fetch URL live). On push, every acceptance clause reads satisfied -
+  flagging the achieved flip for confirmation at that point.

punkproject.toml

@@ -1,4 +1,4 @@
 [project]
 name = "punkshell"
-version = "0.30.5"
+version = "0.30.6"
 license = "BSD-2-Clause"

src/make.tcl

@@ -6534,7 +6534,7 @@ proc ::punkboot::kiticon::punkres_available {repo_root} {
     if {[file isfile $exe]} {
         set punkres_state [list 1 $exe]
     } else {
-        set punkres_state [list 0 "portable stamper not present at $exe - 'tclsh src/make.tcl tool build punkres' builds it from vendored source (G-128)"]
+        set punkres_state [list 0 "portable stamper not present at $exe - 'tclsh src/make.tcl tool build punkres' builds it from vendored source, or fetch the prebuilt punkbin artifact (win32-x86_64/tools/punkres-*; route: src/tools/punkres/PROVENANCE.md) (G-128)"]
     }
     return $punkres_state
 }

src/tools/punkres/PROVENANCE.md

@@ -69,3 +69,31 @@ Origin):
   is first-party punkshell-project code with no external lineage; recorded by
   agent at vendoring, 2026-07-29.
 - No third-party dependencies: `build.zig.zon` declares `.dependencies = .{}`.
+
+## Distribution (punkbin route)
+
+Beside building from this vendored source, the tool is published as a punkbin
+artifact so a no-toolchain user has a route that does not depend on the
+committed twapi (the G-128 acceptance's distribution clause):
+
+- Artifact: `win32-x86_64/tools/punkres-x86_64-windows-<version>.exe` in the
+  punkbin artifact repo (arch-os-version naming per that tier's convention,
+  beside the zig archives; artifacts are immutable - a new version ADDS a new
+  file). First published: 0.3.1, sha1
+  `166cd17628f6f9457f927eb67d34c9f01c5c5646`, built from this vendored state
+  with the pinned toolchain via `make.tcl tool build punkres` (test gate
+  33/33, ReleaseSafe).
+- Integrity: the tools tier's `sha1sums.txt` (regenerated by punkbin's
+  `src/build_sha1sums.tcl`; punkbin's integrity authority for first-party
+  tools). A maintainer-signed `.minisig` sidecar is the natural complement
+  per punkbin's metadata notes - maintainer-gated, not yet present.
+- The route: download
+  `<punkbin base>/win32-x86_64/tools/punkres-x86_64-windows-<version>.exe`
+  (canonical base `https://www.gitea1.intx.com.au/jn/punkbin/raw/branch/master`;
+  mirrors per the `PUNKBIN_URL` conventions in `bin/AGENTS.md`), verify the
+  sha1 against the tier's `sha1sums.txt`, place at
+  `<projectroot>/bin/punkres.exe`. The G-057 kit-icon seam selects the tool
+  by presence; `make.tcl tool list` then reports its installed state against
+  the vendored version.
+- Publication is maintainer-gated: agents stage and commit artifacts in the
+  punkbin checkout but never push (punkbin `AGENTS.md`).