Publish Peekling Pack

1. Default to preparation only. Audit files, private flags, package identity, provenance, licence, hashes, size, secrets, and pack validity.
2. Inspect

   package.json

   before invoking npm. A data-only pack must not define lifecycle hooks or other package scripts, include executables, or depend on install-time code. Stop if any are present.
3. Run

   npm pack --dry-run --ignore-scripts --json

   or an equivalent local inspection that cannot execute package code. Inspect the exact tarball file list and produce a release checklist. Do not change accounts or remotes.
4. Stop if art is UNLICENSED or private, rights are unresolved, metadata leaks paths or secrets, or any gate fails.
5. Immediately before any real publish, push, remote, account, or registry mutation, request and receive explicit authorization naming that action and target. Re-run the clean gates, use script-disabled registry commands, and verify the exact remote result. Without authorization, end at dry-run artifacts only.

agents/openai.yaml