Skip to content

docs: record verified 0.4.0 publication #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abruption merged 1 commit into from
Oct 17, 2026
Merged

docs: record verified 0.4.0 publication #152

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions PARITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,16 @@
# Python compatibility and npm migration

## Public 0.4.0 checkpoint — 2026-10-18 KST

[Version 0.4.0](https://github.com/abruption/session-peer-ts/releases/tag/v0.4.0)
is public from source `dde3923efe116f87f38b1639b29b889d2b832e44`.
The [dated verification](VALIDATION.md#public-040--2026-10-18-kst) records identical
reviewed/Actions/staged/public bytes, signature/provenance checks and isolated
installation/removal. The release includes the approved limited macOS Codex
observation and explicit operator-confirmed receipt scope below; #130–#132
remain separate platform/collector extensions. Published skill 0.2.1 remains
the installation pin; runtime publication is not companion-skill publication.

## Current comparison — Python 1.1.0 / TypeScript 0.4.0

Updated 2026-10-18 KST. TypeScript 0.4.0 uses published
Expand Down
23 changes: 23 additions & 0 deletions RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,29 @@ the historical 0.3.2 settings-read exception is recorded below. The workflow
uses OIDC and no npm token. The protected GitHub environment requires a reviewer
and permits deployments from `main` only.

## Public release checkpoint — 0.4.0 (2026-10-18 KST)

`session-peer@0.4.0` is public with latest=0.4.0 and unchanged
preview=0.1.0-preview.1. Publication source is
`dde3923efe116f87f38b1639b29b889d2b832e44`; stage-only workflow
[39077096491](https://github.com/abruption/session-peer-ts/actions/runs/39077096491)
completed once after exact-source approval, protected GitHub npm environment
approval and final user npm approval. Reviewed, merged-source, retained Actions,
staged and public archives are byte-identical. Public signature/provenance and
isolated installation/removal checks passed; see the
[public validation record](VALIDATION.md#public-040--2026-10-18-kst).
[GitHub v0.4.0](https://github.com/abruption/session-peer-ts/releases/tag/v0.4.0)
and its annotated tag point to that same immutable source.

The Trusted Publisher mapping was freshly checked as stage-only. The user
explicitly skipped the separate web package publish-2FA policy read for this
publication; that policy is not freshly audited. Actual environment and final
npm approvals were completed. This exception applies only to the completed
0.4.0 release. The procedure below is historical: do not replay its approvals,
repeat its stage or republish this immutable version. Future releases require
their own baseline, reviewed source and approvals. Runtime publication does not
publish or install the separately managed companion skill.

## 0.4.0 scoped release preparation — 2026-10-18 KST

This candidate includes #106–#109: the frozen design, private sender fencing,
Expand Down
76 changes: 76 additions & 0 deletions VALIDATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,81 @@
# Validation record — updated 2026-10-18 KST


## Public 0.4.0 — 2026-10-18 KST

`session-peer@0.4.0` is public. Registry checks confirmed `latest=0.4.0` and
unchanged `preview=0.1.0-preview.1`. The publication source is
`dde3923efe116f87f38b1639b29b889d2b832e44`, merged from
[PR #151](https://github.com/abruption/session-peer-ts/pull/151). Its complete tree
matched reviewed head `bfbadfa42513791899fc8d2b5441238bbe5b2c4e`.
Exact-main [CLI run 39076708873](https://github.com/abruption/session-peer-ts/actions/runs/39076708873)
and [CodeQL run 39076708830](https://github.com/abruption/session-peer-ts/actions/runs/39076708830)
passed.

[Publication workflow 39077096491](https://github.com/abruption/session-peer-ts/actions/runs/39077096491)
completed successfully on attempt 1 for that exact source. Its Ubuntu preparation
job passed **383 total / 355 passed / 0 failed / 28 skipped**; these are the
actual platform-scoped counts, not the macOS preparation counts below. Build,
types, repository checks, reproducible package smoke, isolated installation and
removal, and npm audit passed. The uploaded artifact ID was `12117507059`, with
ZIP SHA-256 `b4eb62a6c68be0319d5d7013f11d11e9b438866f3a63359cc1808c91cbe61494`.
The ZIP digest identifies the artifact container, not the package tarball.

The reviewed, local, Actions, staged and public `session-peer-0.4.0.tgz` bytes
matched. The public tarball is 321,256 bytes and contains the exact 71-file
allowlist. All 18 packaged Markdown documents matched the publication source.
The release helper validated the exact downloaded artifact rather than a later
rebuild. Package hashes are:

- SHA-256: `84adc8b50ef8f03a2c2170e3c36a97b573f28a6bcbeb7dbc965e16c3b37a57c9`.
- npm integrity: `sha512-mMNJ118atoflhpFTkf2+DtO7MRf7FQnPK3lKWbq/vd8Xvb5DsjUtAgydIBOcd3Xj9BCYGqM50aFhzUr4dDGHSw==`.

Registry signature audit passed. Public attestation subjects matched the exact
tarball SHA-512, and the SLSA payload bound the repository, `refs/heads/main`,
`.github/workflows/publish.yml`, source `dde3923efe116f87f38b1639b29b889d2b832e44`,
`workflow_dispatch`, and run `39077096491/attempts/1`. This was also verified
cryptographically with npm 11.15.0's bundled Sigstore verifier, including the
certificate/transparency material and the exact workflow identity
`https://github.com/abruption/session-peer-ts/.github/workflows/publish.yml@refs/heads/main`
with issuer `https://token.actions.githubusercontent.com`. These cryptographic
checks are distinct from merely decoding and comparing the payload. A separate
fresh isolated package installation, CLI/list check and removal passed; no user
installation was replaced.

Fresh authenticated checks confirmed no conflicting pending stage and the
Trusted Publisher's stage-only permission. The user explicitly waived this
release's separate web **publish 2FA policy inspection**; that policy was not
freshly audited. The protected GitHub `npm` environment required reviewer
`abruption`, disallowed administrator bypass, and allowed only `main`; environment
and repository Actions secret counts were both zero. The environment approval
and final npm 2FA approval were completed by the user. The approved stage was
`414547b1-1b55-45dc-a0a4-9ca40407beec`. OIDC staging used no token fallback or
protection bypass. Staging success was not treated as publication before registry
verification.

The annotated `v0.4.0` tag object is
`7aad7bc6400499fbc1c323bd62f2210b3507fc9a`, peeled to the exact publication source
`dde3923efe116f87f38b1639b29b889d2b832e44`.
[GitHub release v0.4.0](https://github.com/abruption/session-peer-ts/releases/tag/v0.4.0)
was published as the latest release. No replacement source was assigned to the
published package or tag.

Publication added no new native/model, remote-host delivery or ACK qualification.
Native observation retains the previously recorded exact Codex 0.160.1/0.162.1
and macOS arm64 scope; explicit `operator_confirmed` receipts on supported POSIX
ledgers remain separate from automatic ACK collection. Linux observation,
Windows observation/private storage, and authenticated automatic receipt
producer/collector bootstrap remain follow-ups #130, #131 and #132. Queue
acceptance, injection, turn completion and plain replies do not automatically
establish receipt ACK; unknown outcomes never authorize a resend.

The published TS skill remains 0.2.1 at immutable source
`0f494cabd05901c03161dc91792dcf89f8e96631`, with SKILL SHA-256
`8c3520f95e0d6807303be96bfa06df69887ddaf76be05f1905505d0a956820c3`.
The separate skill 0.3.0 candidate and finite runtime/profile review do not
publish, install or adopt a new skill pin. Skill finalization and publication
require their separate approval and exact artifact checks.

## 0.4.0 preparation checks — 2026-10-18 KST

Preparation source checkpoint `2fc936fa1557fd59ce561446d5239c7030df3d56`
Expand Down
22 changes: 22 additions & 0 deletions docs/design/typescript-skill-compatibility.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,28 @@

This document retains the original TS source proposal and dated design review for [#118](https://github.com/abruption/session-peer-ts/issues/118), based on the companion [Draft #20 at `963c3d7`](https://github.com/abruption/session-peer-skill/blob/963c3d748a11b1164013ee26c9c0ef285c52b285/docs/typescript-compatibility.md). Companion [design acceptance at `699a325`](https://github.com/abruption/session-peer-skill/blob/699a3251830c30c62d0f812363faf4d0eb0c8e0c/docs/typescript-compatibility.md) records the full static review of the exact candidates below on 2026-10-09. This design-only acceptance does not authorize runtime merge/release, successor skill metadata/publication, installation or pin changes, content authenticity, or live delivery support.

## Public 0.4.0 guard verification — 2026-10-18 KST

The public 0.4.0 tarball from source
`dde3923efe116f87f38b1639b29b889d2b832e44` has verified registry integrity
`sha512-mMNJ118atoflhpFTkf2+DtO7MRf7FQnPK3lKWbq/vd8Xvb5DsjUtAgydIBOcd3Xj9BCYGqM50aFhzUr4dDGHSw==`.
An isolated, version-specific npm installation ran its actual bundled pure
validator against published skill 0.2.1 and the complete companion Draft #37
candidate at `a969260cd511b7b81631884ff856edaf0d0d457b` (22,973 raw UTF-8 bytes,
SHA-256 `7571c79fb7ac164002daf0bf3aa7c5ba40ca8d99f5610a04d7860eee7b27df68`).
Compiled default, explicit undefined, explicit 0.4.0 and outer `inspectSkill`
returned exactly compatible/skill_contract_compatible/metadata_only. Historical
0.3.2–0.3.6 identities rejected the new profile, and unreviewed 0.3.7/0.4.1
identities remained incompatible. Supplying a historical identity to this new
helper is not execution of a historical CLI.

These are bounded metadata checks: candidate instructions were not executed,
and no native delivery, model or ACK test was added. The isolated installation
was removed. The candidate remains a separately approved skill-publication
step, not an installed skill or adopted pin. Existing published 0.2.1 source
and hash remain unchanged. The earlier fixture/checkpoint records below retain
their original exact bytes and scope.

## 0.4.0 finite row

TS source/package 0.4.0 preserves the three reviewed profiles accepted by public 0.3.6 (skill 0.1.0, 0.2.0 and published 0.2.1) and adds exactly `0.3.0 / typescript / min 0.1.0 / full 0.4.0 / probe-help` for runtime 0.4.0 only. Compiled default, explicit `undefined`, explicit 0.4.0 and outer `inspectSkill` use this finite row. All historical runtime/profile verdicts remain unchanged; old runtime identities reject the new profile, and 0.3.7, 0.4.1 and other unreviewed runtime identities remain incompatible. Parser/reader behavior and malformed/unsupported envelopes are unchanged. This is a finite row, not a SemVer range or a skill publication.
Expand Down
Loading