Problem

The publish-next CI job failed on main after the v2026.3.11 sync (run 24567594577) during the "Validate release artifacts" step. scripts/release-check.ts reports dependency-mirror drift across 6 bundled extensions. This blocks next-tag publishing to npm.

Failures

release-check: bundled extension root dependency mirror validation failed:
  - bundled extension 'googlechat' root dependency mirror drift
    | missing in root package: (none)
    | remove stale allowlist entries: google-auth-library
  - bundled extension 'matrix' root dependency mirror drift
    | missing in root package: @mariozechner/pi-agent-core
    | new gaps: @mariozechner/pi-agent-core
    | remove stale allowlist entries: @matrix-org/matrix-sdk-crypto-nodejs, @vector-im/matrix-bot-sdk, music-metadata
  - bundled extension 'msteams' root dependency mirror drift
    | missing in root package: (none)
    | remove stale allowlist entries: @microsoft/agents-hosting
  - bundled extension 'nostr' root dependency mirror drift
    | missing in root package: (none)
    | remove stale allowlist entries: nostr-tools
  - bundled extension 'tlon' root dependency mirror drift
    | missing in root package: (none)
    | remove stale allowlist entries: @tloncorp/api, @tloncorp/tlon-skill, @urbit/aura
  - bundled extension 'zalouser' root dependency mirror drift
    | missing in root package: (none)
    | remove stale allowlist entries: zca-js

Two categories

Stale allowlist entries (5 extensions: googlechat, msteams, nostr, tlon, zalouser)

The release-check allowlist lists dependencies that the extension formerly declared. The sync removed these from the extension's package.json but the root allowlist wasn't updated. Safe cleanup.

Genuine concern: matrix (@mariozechner/pi-agent-core)

@mariozechner/pi-agent-core is a gutted package in this fork (the whole Pi-embedded execution engine was removed). The release-check reports it as a new gap — meaning the matrix extension is now declaring it as a dependency. This should have been caught during the sync.

Possible root causes:

• matrix extension's package.json has @mariozechner/pi-agent-core in deps/peer deps
• Something imports it transitively in a way that the extension's bundle tooling surfaces to the mirror check

Scope

1. Identify and remove the 5 stale allowlist entries
2. Investigate the matrix / @mariozechner/pi-agent-core case:
   • Grep extensions/matrix/ for pi-agent-core references (direct imports, package.json deps)
   • Determine whether the reference is real (remove it, it's gutted) or a false positive in the check
   • Fix the root cause, not just the mirror check
3. Re-run pnpm release-check locally to verify publish-next will succeed next time

Acceptance criteria

• publish-next CI job passes on main
• 5 stale allowlist entries cleaned up
• @mariozechner/pi-agent-core reference from matrix extension either removed or documented with explicit rationale
• Run pnpm release-check locally and verify exit code 0

Non-goals

• Not rolling back the v2026.3.11 sync — the sync itself is sound (all gates passed)
• Not changing the release-check script's logic (unless the matrix finding turns out to be a false positive from a script bug)

References

• Failed CI run: https://github.com/remoteclaw/remoteclaw/actions/runs/24567594577
• Sync PR: sync: upstream to v2026.3.11 (235 commits) #2379