[doublewhy]

Summary

The Pack distribution rehearsal workflow declares a pack dispatch input (default packs/techvault), but its run step never passed it on and tests_integration/distribution_rehearsal.py hard-coded TechVault, so every dispatch rehearsed TechVault. The step now hands the input to the script through a step-level env: entry (REHEARSAL_PACK: ${{ inputs.pack }}), so the dispatch value is never pasted into the generated shell script, following GitHub's "Use an intermediate environment variable" guidance (https://docs.github.com/en/actions/reference/security/secure-use). The script rehearses that directory (repo-relative or absolute; unset or empty means packs/techvault) and names its consumer directories after the built pack's name. The registry repository already used that name since #453.

Before anything is built, the script runs validation.validate_pack() on the directory, the one static-validation authority (ADR 0013), applied before any publish effect (ADR 0037). A directory it rejects stops the run with exit 1 and rehearsal stopped: <dir as given> (<resolved path>) is not a pack: <diagnostic codes>.

Naming the consumer directories after the pack is required: static validation requires an installed pack's directory to carry its name (see Verification).

Related issues

Closes #451

Builds on #453 (release paths from the pack version), already on dev.

Known limit, tracked in #470: a pack: packs/ai-escape-lab dispatch currently publishes, then stops at install with [failed] content-binding, because 12 members of that pack's associated-artifacts.json no longer match their bytes on dev since #431, and no CI gate byte-binds it. That is pack content, so it is not fixed here.

Done-when (verbatim)	Change	Test that fails without it	CI lane
The run step passes inputs.pack to the script through an environment variable, and the script rehearses that pack directory (default packs/techvault). Its consumer directories and registry repository are named after the pack's name.	pack-distribution.yml step env: REHEARSAL_PACK; distribution_rehearsal.py:_pack_root, pack_root parameter on _publish/offline_rehearsal/registry_rehearsal, consumer/<name> and installed/<name>	test_rehearsal_step_passes_the_pack_input_through_env, test_offline_rehearsal_rehearses_the_pack_the_dispatch_names, test_registry_rehearsal_names_the_repository_and_consumers_after_the_pack	CI tests
A directory that is not a pack stops the rehearsal, before anything is published, with a message that names the directory.	distribution_rehearsal.py:_require_pack, called first in main()	test_a_directory_that_is_not_a_pack_stops_before_publishing (docs, packs/no-such-pack, a directory whose pack.yaml name differs)	CI tests
tests/test_pack_distribution_workflow.py checks that the run step passes the input through env:, and a test drives the rehearsal with a pack other than TechVault. Both fail on dev.	the tests above, plus test_no_run_body_interpolates_an_expression (no run: in the workflow contains ${{)	see Verification	CI tests

Verification

• python -m unittest discover -s tests
• raes-pack-validate --repo .
• raes-pack-release check --all
• raes-pack-validate --packs-root packs
• raes-pack-release check --packs-root packs
• Docs changed: built docs/public/ warning-free (sphinx-build -W).

Run locally on Linux, Python 3.12.3, in a venv with requirements/runtime.txt, coverage.txt and build.txt installed by hash, as the CI tests job does, and the package editable:

• python -m unittest discover -s tests: 978 tests. The first run lacked coverage.txt, so one test_techvault_pack test could not import bcrypt; with it installed, that module's 72 tests pass.
• python -m unittest tests.test_distribution_rehearsal tests.test_pack_distribution_workflow tests.test_workflow_permissions: 26 tests, OK (123 s; four end-to-end rehearsals).
• With the script and the workflow stashed back to dev, the new tests fail: the env test (None != '${{ inputs.pack }}'), the participant-study offline test (it published TechVault), all three not-a-pack cases (the run ignored the variable and passed), and both registry tests (registry_rehearsal has no pack_root parameter on dev).
• With only the consumer directory names put back to the literal techvault, the participant-study offline test fails with install plan not applicable and the registry test with pulled release failed verification: accepted=False authenticated=True.
• Real transport: against a registry:2 container on 127.0.0.1, with oras 1.3.3 (the workflow's version, checksum-verified) and a cosign stub that exits 0, REHEARSAL_PACK=packs/techvault-participant-study REHEARSAL_REGISTRY=localhost:15451 python tests_integration/distribution_rehearsal.py exited 0, pushed localhost:15451/techvault-participant-study:0.1.2, and printed OFFLINE REHEARSAL PASSED and REGISTRY REHEARSAL PASSED. The container, image and oras download were removed afterwards.
• The four pack gates, python -m compileall src tests tests_integration, python -m sphinx -W -b html docs/public <out> and tools/check_docs_publication_boundary.py all exit 0.

Checklist

• Keeps RAES semantics in RAES; hosted pack content stays under packs/.
• PR title is a Conventional Commit (a required check enforces it).
• Did not edit the version or CHANGELOG.md — release-please owns them.