From 08b24db4ab750cf02efbc00e402fe61d0d7ef488 Mon Sep 17 00:00:00 2001 From: YEONGUK LEE Date: Sun, 18 Oct 2026 08:12:19 +0900 Subject: [PATCH] docs: record verified 0.4.0 publication --- PARITY.md | 11 +++ RELEASING.md | 23 ++++++ VALIDATION.md | 76 +++++++++++++++++++ docs/design/typescript-skill-compatibility.md | 22 ++++++ 4 files changed, 132 insertions(+) diff --git a/PARITY.md b/PARITY.md index dbbd803..486784c 100644 --- a/PARITY.md +++ b/PARITY.md @@ -1,5 +1,16 @@ # Python compatibility and npm migration +## Public 0.4.0 checkpoint — 2026-10-18 KST + +[Version 0.4.0](https://github.com/abruption/session-peer-ts/releases/tag/v0.4.0) +is public from source `dde3923efe116f87f38b1639b29b889d2b832e44`. +The [dated verification](VALIDATION.md#public-040--2026-10-18-kst) records identical +reviewed/Actions/staged/public bytes, signature/provenance checks and isolated +installation/removal. The release includes the approved limited macOS Codex +observation and explicit operator-confirmed receipt scope below; #130–#132 +remain separate platform/collector extensions. Published skill 0.2.1 remains +the installation pin; runtime publication is not companion-skill publication. + ## Current comparison — Python 1.1.0 / TypeScript 0.4.0 Updated 2026-10-18 KST. TypeScript 0.4.0 uses published diff --git a/RELEASING.md b/RELEASING.md index 92f2de9..a7bcd2c 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -9,6 +9,29 @@ the historical 0.3.2 settings-read exception is recorded below. The workflow uses OIDC and no npm token. The protected GitHub environment requires a reviewer and permits deployments from `main` only. +## Public release checkpoint — 0.4.0 (2026-10-18 KST) + +`session-peer@0.4.0` is public with latest=0.4.0 and unchanged +preview=0.1.0-preview.1. Publication source is +`dde3923efe116f87f38b1639b29b889d2b832e44`; stage-only workflow +[39077096491](https://github.com/abruption/session-peer-ts/actions/runs/39077096491) +completed once after exact-source approval, protected GitHub npm environment +approval and final user npm approval. Reviewed, merged-source, retained Actions, +staged and public archives are byte-identical. Public signature/provenance and +isolated installation/removal checks passed; see the +[public validation record](VALIDATION.md#public-040--2026-10-18-kst). +[GitHub v0.4.0](https://github.com/abruption/session-peer-ts/releases/tag/v0.4.0) +and its annotated tag point to that same immutable source. + +The Trusted Publisher mapping was freshly checked as stage-only. The user +explicitly skipped the separate web package publish-2FA policy read for this +publication; that policy is not freshly audited. Actual environment and final +npm approvals were completed. This exception applies only to the completed +0.4.0 release. The procedure below is historical: do not replay its approvals, +repeat its stage or republish this immutable version. Future releases require +their own baseline, reviewed source and approvals. Runtime publication does not +publish or install the separately managed companion skill. + ## 0.4.0 scoped release preparation — 2026-10-18 KST This candidate includes #106–#109: the frozen design, private sender fencing, diff --git a/VALIDATION.md b/VALIDATION.md index 82864bb..c96b1ac 100644 --- a/VALIDATION.md +++ b/VALIDATION.md @@ -1,5 +1,81 @@ # Validation record — updated 2026-10-18 KST + +## Public 0.4.0 — 2026-10-18 KST + +`session-peer@0.4.0` is public. Registry checks confirmed `latest=0.4.0` and +unchanged `preview=0.1.0-preview.1`. The publication source is +`dde3923efe116f87f38b1639b29b889d2b832e44`, merged from +[PR #151](https://github.com/abruption/session-peer-ts/pull/151). Its complete tree +matched reviewed head `bfbadfa42513791899fc8d2b5441238bbe5b2c4e`. +Exact-main [CLI run 39076708873](https://github.com/abruption/session-peer-ts/actions/runs/39076708873) +and [CodeQL run 39076708830](https://github.com/abruption/session-peer-ts/actions/runs/39076708830) +passed. + +[Publication workflow 39077096491](https://github.com/abruption/session-peer-ts/actions/runs/39077096491) +completed successfully on attempt 1 for that exact source. Its Ubuntu preparation +job passed **383 total / 355 passed / 0 failed / 28 skipped**; these are the +actual platform-scoped counts, not the macOS preparation counts below. Build, +types, repository checks, reproducible package smoke, isolated installation and +removal, and npm audit passed. The uploaded artifact ID was `12117507059`, with +ZIP SHA-256 `b4eb62a6c68be0319d5d7013f11d11e9b438866f3a63359cc1808c91cbe61494`. +The ZIP digest identifies the artifact container, not the package tarball. + +The reviewed, local, Actions, staged and public `session-peer-0.4.0.tgz` bytes +matched. The public tarball is 321,256 bytes and contains the exact 71-file +allowlist. All 18 packaged Markdown documents matched the publication source. +The release helper validated the exact downloaded artifact rather than a later +rebuild. Package hashes are: + +- SHA-256: `84adc8b50ef8f03a2c2170e3c36a97b573f28a6bcbeb7dbc965e16c3b37a57c9`. +- npm integrity: `sha512-mMNJ118atoflhpFTkf2+DtO7MRf7FQnPK3lKWbq/vd8Xvb5DsjUtAgydIBOcd3Xj9BCYGqM50aFhzUr4dDGHSw==`. + +Registry signature audit passed. Public attestation subjects matched the exact +tarball SHA-512, and the SLSA payload bound the repository, `refs/heads/main`, +`.github/workflows/publish.yml`, source `dde3923efe116f87f38b1639b29b889d2b832e44`, +`workflow_dispatch`, and run `39077096491/attempts/1`. This was also verified +cryptographically with npm 11.15.0's bundled Sigstore verifier, including the +certificate/transparency material and the exact workflow identity +`https://github.com/abruption/session-peer-ts/.github/workflows/publish.yml@refs/heads/main` +with issuer `https://token.actions.githubusercontent.com`. These cryptographic +checks are distinct from merely decoding and comparing the payload. A separate +fresh isolated package installation, CLI/list check and removal passed; no user +installation was replaced. + +Fresh authenticated checks confirmed no conflicting pending stage and the +Trusted Publisher's stage-only permission. The user explicitly waived this +release's separate web **publish 2FA policy inspection**; that policy was not +freshly audited. The protected GitHub `npm` environment required reviewer +`abruption`, disallowed administrator bypass, and allowed only `main`; environment +and repository Actions secret counts were both zero. The environment approval +and final npm 2FA approval were completed by the user. The approved stage was +`414547b1-1b55-45dc-a0a4-9ca40407beec`. OIDC staging used no token fallback or +protection bypass. Staging success was not treated as publication before registry +verification. + +The annotated `v0.4.0` tag object is +`7aad7bc6400499fbc1c323bd62f2210b3507fc9a`, peeled to the exact publication source +`dde3923efe116f87f38b1639b29b889d2b832e44`. +[GitHub release v0.4.0](https://github.com/abruption/session-peer-ts/releases/tag/v0.4.0) +was published as the latest release. No replacement source was assigned to the +published package or tag. + +Publication added no new native/model, remote-host delivery or ACK qualification. +Native observation retains the previously recorded exact Codex 0.160.1/0.162.1 +and macOS arm64 scope; explicit `operator_confirmed` receipts on supported POSIX +ledgers remain separate from automatic ACK collection. Linux observation, +Windows observation/private storage, and authenticated automatic receipt +producer/collector bootstrap remain follow-ups #130, #131 and #132. Queue +acceptance, injection, turn completion and plain replies do not automatically +establish receipt ACK; unknown outcomes never authorize a resend. + +The published TS skill remains 0.2.1 at immutable source +`0f494cabd05901c03161dc91792dcf89f8e96631`, with SKILL SHA-256 +`8c3520f95e0d6807303be96bfa06df69887ddaf76be05f1905505d0a956820c3`. +The separate skill 0.3.0 candidate and finite runtime/profile review do not +publish, install or adopt a new skill pin. Skill finalization and publication +require their separate approval and exact artifact checks. + ## 0.4.0 preparation checks — 2026-10-18 KST Preparation source checkpoint `2fc936fa1557fd59ce561446d5239c7030df3d56` diff --git a/docs/design/typescript-skill-compatibility.md b/docs/design/typescript-skill-compatibility.md index f4b9831..9cc9bb8 100644 --- a/docs/design/typescript-skill-compatibility.md +++ b/docs/design/typescript-skill-compatibility.md @@ -2,6 +2,28 @@ This document retains the original TS source proposal and dated design review for [#118](https://github.com/abruption/session-peer-ts/issues/118), based on the companion [Draft #20 at `963c3d7`](https://github.com/abruption/session-peer-skill/blob/963c3d748a11b1164013ee26c9c0ef285c52b285/docs/typescript-compatibility.md). Companion [design acceptance at `699a325`](https://github.com/abruption/session-peer-skill/blob/699a3251830c30c62d0f812363faf4d0eb0c8e0c/docs/typescript-compatibility.md) records the full static review of the exact candidates below on 2026-10-09. This design-only acceptance does not authorize runtime merge/release, successor skill metadata/publication, installation or pin changes, content authenticity, or live delivery support. +## Public 0.4.0 guard verification — 2026-10-18 KST + +The public 0.4.0 tarball from source +`dde3923efe116f87f38b1639b29b889d2b832e44` has verified registry integrity +`sha512-mMNJ118atoflhpFTkf2+DtO7MRf7FQnPK3lKWbq/vd8Xvb5DsjUtAgydIBOcd3Xj9BCYGqM50aFhzUr4dDGHSw==`. +An isolated, version-specific npm installation ran its actual bundled pure +validator against published skill 0.2.1 and the complete companion Draft #37 +candidate at `a969260cd511b7b81631884ff856edaf0d0d457b` (22,973 raw UTF-8 bytes, +SHA-256 `7571c79fb7ac164002daf0bf3aa7c5ba40ca8d99f5610a04d7860eee7b27df68`). +Compiled default, explicit undefined, explicit 0.4.0 and outer `inspectSkill` +returned exactly compatible/skill_contract_compatible/metadata_only. Historical +0.3.2–0.3.6 identities rejected the new profile, and unreviewed 0.3.7/0.4.1 +identities remained incompatible. Supplying a historical identity to this new +helper is not execution of a historical CLI. + +These are bounded metadata checks: candidate instructions were not executed, +and no native delivery, model or ACK test was added. The isolated installation +was removed. The candidate remains a separately approved skill-publication +step, not an installed skill or adopted pin. Existing published 0.2.1 source +and hash remain unchanged. The earlier fixture/checkpoint records below retain +their original exact bytes and scope. + ## 0.4.0 finite row TS source/package 0.4.0 preserves the three reviewed profiles accepted by public 0.3.6 (skill 0.1.0, 0.2.0 and published 0.2.1) and adds exactly `0.3.0 / typescript / min 0.1.0 / full 0.4.0 / probe-help` for runtime 0.4.0 only. Compiled default, explicit `undefined`, explicit 0.4.0 and outer `inspectSkill` use this finite row. All historical runtime/profile verdicts remain unchanged; old runtime identities reject the new profile, and 0.3.7, 0.4.1 and other unreviewed runtime identities remain incompatible. Parser/reader behavior and malformed/unsupported envelopes are unchanged. This is a finite row, not a SemVer range or a skill publication.