Directly land Homebrew tap updates

Author: Zac

.beads/issues.jsonl

@@ -8,7 +8,6 @@ on:
 permissions:
   contents: write
   id-token: write
-  pull-requests: write
 
 jobs:
   verify-version:
@@ -243,24 +242,27 @@ jobs:
           token: ${{ env.HOMEBREW_TAP_TOKEN }}
           path: homebrew-tap
 
-      - name: Update Homebrew formula
+      - name: Land Homebrew formula in tap
         if: ${{ env.HOMEBREW_TAP_TOKEN != '' }}
         shell: bash
         run: |
           set -euo pipefail
+          version="${{ needs.verify-version.outputs.version }}"
+
+          # Spine release policy: the release tag is the review gate, so tap
+          # updates land directly instead of opening a follow-up Homebrew PR.
+          mkdir -p homebrew-tap/Formula
           cp dist/archives/airlock.rb homebrew-tap/Formula/airlock.rb
 
-      - name: Open Homebrew tap PR
-        if: ${{ env.HOMEBREW_TAP_TOKEN != '' }}
-        uses: peter-evans/create-pull-request@v7
-        with:
-          token: ${{ env.HOMEBREW_TAP_TOKEN }}
-          path: homebrew-tap
-          commit-message: "airlock v${{ needs.verify-version.outputs.version }}"
-          branch: "release/airlock-v${{ needs.verify-version.outputs.version }}"
-          delete-branch: true
-          title: "airlock v${{ needs.verify-version.outputs.version }}"
-          body: |
-            Update `Formula/airlock.rb` for `airlock` v${{ needs.verify-version.outputs.version }}.
-          add-paths: |
-            Formula/airlock.rb
+          cd homebrew-tap
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add Formula/airlock.rb
+
+          if git diff --cached --quiet; then
+            echo "Formula unchanged. No-op."
+            exit 0
+          fi
+
+          git commit -m "airlock v${version}"
+          git push origin HEAD:main

.github/workflows/release.yml

@@ -1,6 +1,6 @@
 [package]
 name = "airlock"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 rust-version = "1.80"
 description = "Prove what crossed the model boundary"

Cargo.lock

@@ -45,14 +45,14 @@ brew install cmdrvl/tap/airlock
 ### From Source
 
 ```bash
-cargo install --git https://github.com/cmdrvl/airlock --tag v0.2.0
+cargo install --git https://github.com/cmdrvl/airlock --tag v0.2.1
 ```
 
 ### Verify
 
 ```bash
 airlock --version
-# airlock 0.2.0
+# airlock 0.2.1
 ```
 
 ## Quick Start
@@ -399,7 +399,7 @@ evidence patterns, and real model-boundary sensitivity.
 
 ## Roadmap
 
-v0.2.0 is the current foundational release. Next:
+v0.2.1 is the current foundational release. Next:
 
 1. Seal integration with `pack` for immutable manifest bundles
 2. Register Airlock proofs in catalog

Cargo.toml

@@ -1084,6 +1084,9 @@ Airlock should ship with the same release posture as the mature spine tools:
 - keyless signing / attestation for release checksums
 - published SBOM artifact
 - Homebrew tap update in `cmdrvl/homebrew-tap`
+- generated Homebrew formula lands directly on the tap default branch when
+  `HOMEBREW_TAP_TOKEN` is configured; Airlock follows the spine-tool policy
+  that the release tag is the review gate, not a follow-up tap PR
 
 The release workflow should validate that the requested release version matches
 `Cargo.toml` before publishing immutable artifacts.
@@ -1289,6 +1292,8 @@ Airlock follows the same pattern:
 - Versioning: independent semver via `Cargo.toml`
 - Interop: `operator.json` declaring pipeline position
 - CI: `.github/workflows/release.yml` matching existing spine release template
+- Tap landing: direct-push `Formula/airlock.rb` into the `main` branch of
+  `cmdrvl/homebrew-tap` during release, instead of opening a tap PR
 
 ### Execution guardrails live outside this repo
 

README.md

@@ -1,6 +1,6 @@
 {
   "name": "airlock",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Prove what crossed the model boundary",
   "pipeline_position": {
     "upstream": [