ci: add tag-gated npm release workflow

.gitea/workflows/npm-release.yml

@@ -0,0 +1,87 @@
+name: npm release
+
+on:
+  push:
+    tags:
+      - 'v*'
+      - '[0-9]*'
+
+jobs:
+  verify:
+    name: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.13'
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Verify release tag matches package version
+        shell: bash
+        run: |
+          set -euo pipefail
+          TAG_NAME="${GITHUB_REF##refs/tags/}"
+          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+
+          if [ "$TAG_NAME" = "v$PACKAGE_VERSION" ] || [ "$TAG_NAME" = "$PACKAGE_VERSION" ]; then
+            echo "Release tag $TAG_NAME matches package version $PACKAGE_VERSION"
+            exit 0
+          fi
+
+          echo "Tag $TAG_NAME does not match package.json version $PACKAGE_VERSION" >&2
+          exit 1
+
+      - name: Run verify pipeline
+        run: |
+          bun run test
+          bun run check
+          bun run build
+
+  release:
+    name: publish to npm
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    needs:
+      - verify
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.13'
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build package
+        run: bun run build
+
+      - name: Publish package to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish

docs/plans/2026-05-11-identitydb-wiki-docs.md

@@ -0,0 +1,65 @@
+# IdentityDB Wiki Documentation Implementation Plan
+
+> **For Hermes:** Execute this plan step-by-step. Prefer concrete repository inspection over assumptions, and verify the wiki remote after each major write.
+
+**Goal:** Verify the IdentityDB wiki repository state, create or clone it as needed, and publish concrete wiki documentation covering the project's purpose, usage, and extractor choices including `NaiveExtractor`.
+
+**Architecture:** Treat the Gitea wiki as a separate Git repository. First verify whether the wiki feature is enabled and whether the `.wiki.git` remote already exists. If the remote does not exist yet, bootstrap it with a minimal `Home.md`, then clone the wiki repo into a local working directory and author Markdown pages there. Keep the documentation practical, using the package README and current source files as the canonical content source.
+
+**Tech Stack:** Gitea, tea CLI, Git, Markdown, Bun/TypeScript project docs.
+
+---
+
+## Execution plan
+
+### Task 1: Inspect wiki availability and remote state
+
+**Objective:** Confirm that the repository has wiki support enabled and determine whether the Git-backed wiki repo already exists.
+
+**Files:**
+- Inspect: `https://git.psw.kr/p-sw/IdentityDB`
+- Read: `/home/hermes-agent/IdentityDB/README.md`
+- Read: `/home/hermes-agent/IdentityDB/src/ingestion/naive-extractor.ts`
+- Read: `/home/hermes-agent/IdentityDB/src/ingestion/llm-extractor.ts`
+
+**Verification:**
+- Check Gitea repo metadata for `has_wiki=true`.
+- Check whether `https://git.psw.kr/p-sw/IdentityDB.wiki.git` is readable.
+
+### Task 2: Bootstrap the wiki repo if missing
+
+**Objective:** Create the Git-backed wiki repository if it has not been materialized yet.
+
+**Files:**
+- Create temporarily: `/home/hermes-agent/IdentityDB-wiki-bootstrap/Home.md`
+
+**Verification:**
+- Push a first commit to `https://git.psw.kr/p-sw/IdentityDB.wiki.git`.
+- Confirm the remote becomes cloneable afterward.
+
+### Task 3: Clone the wiki repo and author concrete pages
+
+**Objective:** Write practical docs explaining why IdentityDB exists, how to use it, and where `NaiveExtractor` fits.
+
+**Files:**
+- Clone to: `/home/hermes-agent/IdentityDB.wiki`
+- Create/modify: `/home/hermes-agent/IdentityDB.wiki/Home.md`
+- Create/modify: `/home/hermes-agent/IdentityDB.wiki/Getting-Started.md`
+- Create/modify: `/home/hermes-agent/IdentityDB.wiki/Extractors.md`
+- Create/modify: `/home/hermes-agent/IdentityDB.wiki/_Sidebar.md`
+
+**Verification:**
+- Review the generated Markdown files locally.
+- Ensure internal wiki links resolve by page name.
+
+### Task 4: Commit, push, and verify the published wiki state
+
+**Objective:** Publish the wiki docs and verify the remote history reflects the changes.
+
+**Files:**
+- Commit within: `/home/hermes-agent/IdentityDB.wiki`
+
+**Verification:**
+- Run `git status --short` and `git log --oneline -n 3` in the wiki repo.
+- Push to the remote wiki repo.
+- Confirm the wiki is cloneable and the latest commit is visible remotely.