Repository navigation
docs(release): align 0.3.5 artifact with merged source - #145
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6dd52e794c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ## 0.3.5 source support and successor rollout — #139 | ||
|
|
||
| | Candidate inspecting runtime | Skill version | Implementation | Minimum | Full | Policy | Proposed verdict | | ||
| [#139](https://github.com/abruption/session-peer-ts/issues/139) tracks the separate successor profile and rollout for updated TS skill documentation. The 0.3.5 source/package adds exactly the skill 0.2.1 profile below while retaining legacy 0.1.0 and published 0.2.0. Its complete candidate bytes/profile were reviewed for guard preparation as recorded below; final skill publication wording, immutable release and installation pin remain separate. Source/package support does not itself establish npm or skill publication. |
There was a problem hiding this comment.
When this tree is packed and published as 0.3.5, this same packaged document will still say at lines 9 and 22 that 0.3.5 is a “preparation,” its compiled default is a “candidate,” and Draft #140 merely adds a proposal; PARITY.md:5 likewise calls the current 0.3.5 contract a candidate. Those undated descriptions contradict this new current-source section and leave the release artifact with the stale status this commit is intended to remove. Update the current introductions while retaining the explicitly dated historical checkpoints.
Useful? React with 👍 / 👎.
|
|
||
| Merged source `5409d0acd4b559c09920a63c5fd7f11fd10f5737` has the same tree as reviewed `6fdf9d65fb0b62cca3801a3733af07add5fb6553`. Exact-main CLI38370116243 and CodeQL38370116569 passed. PR #144 automatic Code/Security reviews completed for the matching source tree. Code Review reported a P2 finding on the current unmerged README label; this correction addresses that finding across all four READMEs/guides. No Security Review finding was reported, and no extra review mention was posted. The #140 implementation is included through #144 rather than a separate #140 merge. | ||
|
|
||
| Artifact-document review found current, undated README/guide lines calling 0.3.5 unmerged and current skill descriptions still referring to unagreed source proposals. This document-only correction removes those lines, states implemented 0.3.5 source/profile support without claiming registry publication, and preserves historical preparation records, skill publication/pin boundaries, exact-version SSH, Python reference and runtime behavior. Corrected-source/artifact and current-head checks are recorded in the linked correction PR. No staging, publication, native delivery/ACK or operations change is performed by this checkpoint. |
There was a problem hiding this comment.
The new validation checkpoint says the corrected-source, artifact, and current-head checks are in a “linked correction PR,” but this section contains no link or even an identifier for that correction PR; the only PR mentioned is #144, which is the already-merged preparation whose stale artifact triggered this correction. Consequently, a release operator cannot follow this record to verify the checks required before staging. Add the exact correction PR and run/source links rather than referring to a nonexistent link.
Useful? React with 👍 / 👎.
Latest corrected-head checkpoint
Head 4d918dc: all12checks SUCCESS, CLI38373803616, CodeQL38373799031, GitGuardian; no reruns.
Codex Code/Security review completed at initial6dd52e7. Security reported no findings; Code reported2P2 (remaining undated design/PARITY candidate descriptions and missing correction PR/evidence link). Both are fixed in4d918dc and independently re-audited. Current-head CI/CodeQL is green; a new automatic Codex review of4d918dc has not been submitted, so do not claim a fresh automated review passed. Human current-head review is still required. No manual review mentions.
Current local exact-source artifact supersedes earlier6dd52e7archive:
46f4a01f9570034fca49cfa5fad620f3f45b5f33b1a6714f29ea0a3c1e751ac0sha512-EJc2B5tcruzHXiHDd7tyJjv2DBLYE7IHJiPVHBzLY9fSVasEQRdwx+ZZmiyBF8WHpQ7+pI3SO2VXwsQTgOWP+Q==-57files; all18MarkdownfilesstrictUTF8/byte-identical to exactsource; independent artifact-document gate PASS.
Summary
Refs #143. Address the Codex P2 finding on merged #144 at6fdf9d6: the npm archive must not describe its own preparation as unmerged. Documentation only; ready for human review. No merge, staging or publication.
Runtime/package/lock/version/dependencies/parser/reader/allowlist/workflows/tests, published skill8482cf6pin and Python reference unchanged. No0.4/SideSession/Steer inclusion. Base main5409d0acd4b559c09920a63c5fd7f11fd10f5737 passed exact-main CLI/CodeQL and is tree-identical to the reviewed preparation.
Validation
Local macOSarm64, Node24.16.0/npm11.15.0:
Current local artifact (later merged-main/Actions artifact must be independently validated):
6dd52e794c1fa2a092bf56b644a49aa01a95aa2a4f2d91fcf5c0a26b9d0e62e5fcabc2242581a7c09fff032db8c70827d4fb9c12sha512-EIQAk232QtbHjIXWvFb/mwr8hpWya2gvrnqH2qYRd/KjWM9AwhgvFN9RcEl2L0+CA2/0qK51mRd4vk4/Ts40Jg==Publication checkpoint
CLI authentication matches sole maintainer abruption; package public; npm stage list empty. TrustedPublisher/MFApolicy fresh reads skipped by explicit currentuserinstructions, not falsely marked verified. GitHub npm environment requires abruption, mainonly, admin bypassfalse, secrets0. Registry latest0.3.4/preview0.1.0-preview.1 and0.3.5absence remain preconditions. No dispatch/publish/environment approval/2FA/tag/GitHubRelease or operations change.
Human review/merge first, then exact newmain CI/source/artifact, exact SHA/0.3.5/stable-stage/latest approval. No archive patched in place.