From a931b44811f91da38ca339f7f48555083e26f692 Mon Sep 17 00:00:00 2001 From: David Sheffer Date: Thu, 23 Jul 2026 16:21:07 +0300 Subject: [PATCH] fix(release): accept verified Sigstore versions --- .github/workflows/release.yml | 2 +- README.md | 6 +++--- docs/cookbook.md | 10 +++++----- package-lock.json | 4 ++-- package.json | 2 +- site/ar/changelog/index.html | 1 + site/blog/posts.js | 2 +- site/changelog.html | 1 + site/changelog/index.html | 1 + site/cookbook.html | 10 +++++----- site/docs.html | 8 ++++---- site/es/changelog/index.html | 1 + site/he/changelog/index.html | 1 + site/ru/changelog/index.html | 1 + test/workflow-release-contract.test.ts | 4 ++++ tooling/changelog-locales.mjs | 8 ++++---- 16 files changed, 36 insertions(+), 26 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 093f33f..35a5ab2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -493,7 +493,7 @@ jobs: throw new Error(`exact Sigstore bundle verification failed: ${`${verified.stderr}\n${verified.stdout}`.trim()}`); } const result = parseJson(verified.stdout, "exact Sigstore bundle verification"); - if (!/^\\d+\\.\\d+\\.\\d+/.test(result.sigstore_version ?? "")) { + if (!/^\d+\.\d+\.\d+/.test(result.sigstore_version ?? "")) { throw new Error("exact Sigstore bundle verification did not identify its verifier"); } return result; diff --git a/README.md b/README.md index 944276f..7344b07 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ strict enforcement. **Memory is the input. The product boundary is the receipt:** relevant evidence before an edit, then a deterministic check of the change against the rules your team has explicitly trusted. -> **New in v1.9.2:** Matrix mode gives the whole team one live, private Git memory across fresh +> **New in v1.9.3:** Matrix mode gives the whole team one live, private Git memory across fresh > clones, worktrees, CLI checks, and MCP assistants. npm publishes with short-lived OIDC > credentials, while the editor companion ships as one immutable, publicly verified Open VSX > artifact. @@ -82,7 +82,7 @@ Git repo that every teammate can access, install the Matrix release on team mach have one maintainer run: ```bash -npm i -g @davesheffer/hunch@1.9.2 +npm i -g @davesheffer/hunch@1.9.3 hunch shared --repo git@github.com:acme/project-hunch-memory.git git add .gitignore .hunch/team.json git commit -m "chore: connect shared Hunch memory" @@ -97,7 +97,7 @@ printed by Hunch. Omit `--migrate` for a new setup. After the pointer commit lands, teammates need Hunch installed and Git access to the memory repo: ```bash -npm i -g @davesheffer/hunch@1.9.2 +npm i -g @davesheffer/hunch@1.9.3 git pull hunch init hunch doctor diff --git a/docs/cookbook.md b/docs/cookbook.md index 02c0382..b877e13 100644 --- a/docs/cookbook.md +++ b/docs/cookbook.md @@ -161,7 +161,7 @@ remote, and the URL committed into the code repository must not contain credenti On one maintainer machine: ```bash -npm i -g @davesheffer/hunch@1.9.2 +npm i -g @davesheffer/hunch@1.9.3 hunch shared --repo git@github.com:acme/project-hunch-memory.git git add .gitignore .hunch/team.json git commit -m "chore: connect shared Hunch memory" @@ -173,7 +173,7 @@ into the dedicated store. Review the reported untrack/ignore changes and follow Hunch prints. On every teammate machine: ```bash -npm i -g @davesheffer/hunch@1.9.2 +npm i -g @davesheffer/hunch@1.9.3 git pull hunch init hunch doctor @@ -271,10 +271,10 @@ Matrix memory home as the CLI; it never writes Hunch JSON directly. For a release audit, start with the exact tags and public registry metadata: ```bash -npm view @davesheffer/hunch@1.9.2 version dist.integrity dist.attestations --json -git tag --list v1.9.2 vscode-v0.17.3 +npm view @davesheffer/hunch@1.9.3 version dist.integrity dist.attestations --json +git tag --list v1.9.3 vscode-v0.17.3 ``` -**Observe:** npm reports `1.9.2`, an integrity digest, and provenance metadata. Open VSX reports +**Observe:** npm reports `1.9.3`, an integrity digest, and provenance metadata. Open VSX reports `0.17.3`. The GitHub Actions run for each tag shows a credential-free validation job followed by publication and public byte verification of the same content-addressed artifact. diff --git a/package-lock.json b/package-lock.json index 1d1dec6..b33337f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@davesheffer/hunch", - "version": "1.9.2", + "version": "1.9.3", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@davesheffer/hunch", - "version": "1.9.2", + "version": "1.9.3", "license": "Apache-2.0", "dependencies": { "@modelcontextprotocol/sdk": "^1.29.0", diff --git a/package.json b/package.json index 64f39fb..435cef2 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@davesheffer/hunch", - "version": "1.9.2", + "version": "1.9.3", "license": "Apache-2.0", "author": "Dave Sheffer ", "description": "Engineering memory and a deterministic Change Gate for AI-assisted codebases: decisions, rejected approaches, constraints, and bug lineage become portable context and opt-in enforcement for every MCP assistant.", diff --git a/site/ar/changelog/index.html b/site/ar/changelog/index.html index 3057894..e238c54 100644 --- a/site/ar/changelog/index.html +++ b/site/ar/changelog/index.html @@ -108,6 +108,7 @@

كل إصدار، منذ v0.1.

23 يوليو 2026
+
v1.9.3إيصالات إصدار npm موثّقة
v1.9.2وصول OIDC الخاص بـnpm إلى السجل
v1.9.1نشر الإضافة عبر Open VSX فقط
diff --git a/site/blog/posts.js b/site/blog/posts.js index c436a58..54a26ac 100644 --- a/site/blog/posts.js +++ b/site/blog/posts.js @@ -12,7 +12,7 @@ window.POSTS = [

Connect once; keep the graph live

A maintainer connects the codebase to a dedicated private Git repository with hunch shared --repo …. Hunch commits only a credential-free .hunch/team.json pointer to the code repo. Every teammate then runs hunch init; authentication remains in SSH or the normal Git credential helper.

-
npm i -g @davesheffer/hunch@1.9.2
+
npm i -g @davesheffer/hunch@1.9.3
 hunch shared --repo git@github.com:acme/project-hunch-memory.git
 git add .gitignore .hunch/team.json

 
CLI operations refresh the memory at startup, long-lived MCP servers refresh at request boundaries, and captures synchronize automatically. Concurrent structured records merge by identity. A failed push remains safe locally and is retried by the next capture or hunch shared --sync.

diff --git a/site/changelog.html b/site/changelog.html
index 9e591b4..ea69308 100644
--- a/site/changelog.html
+++ b/site/changelog.html
@@ -107,6 +107,7 @@ 
Every release, since v0.1.

     

       

         
Jul 23, 2026

+        
v1.9.3Verified npm release receipts — fixes the executable semantic-version guard used after successful Sigstore bundle verification, so the immutable npm release closes with a content-addressed publication receipt instead of rejecting its own verifier metadata.

         
v1.9.2npm OIDC reaches the registry — trusted publishing keeps setup-node's required npm registry configuration, permits only its exact fixed non-secret sentinel, and still rejects every real long-lived npm credential. Open VSX verification also allows the public index a bounded three-minute visibility window. The immutable candidate, provenance, digest, and public-registry verification gates remain unchanged.

         
v1.9.1Open VSX-only editor publishing — the editor companion now has one explicit public home: Open VSX. Its immutable release gate validates one credential-free VSIX, publishes only those bytes, and verifies the public download digest. The accompanying npm hardening exposed setup-node's required sentinel as a follow-up release issue before npm publication.

       

diff --git a/site/changelog/index.html b/site/changelog/index.html
index 9e591b4..ea69308 100644
--- a/site/changelog/index.html
+++ b/site/changelog/index.html
@@ -107,6 +107,7 @@ 
Every release, since v0.1.

     

       

         
Jul 23, 2026

+        
v1.9.3Verified npm release receipts — fixes the executable semantic-version guard used after successful Sigstore bundle verification, so the immutable npm release closes with a content-addressed publication receipt instead of rejecting its own verifier metadata.

         
v1.9.2npm OIDC reaches the registry — trusted publishing keeps setup-node's required npm registry configuration, permits only its exact fixed non-secret sentinel, and still rejects every real long-lived npm credential. Open VSX verification also allows the public index a bounded three-minute visibility window. The immutable candidate, provenance, digest, and public-registry verification gates remain unchanged.

         
v1.9.1Open VSX-only editor publishing — the editor companion now has one explicit public home: Open VSX. Its immutable release gate validates one credential-free VSIX, publishes only those bytes, and verifies the public download digest. The accompanying npm hardening exposed setup-node's required sentinel as a follow-up release issue before npm publication.

       

diff --git a/site/cookbook.html b/site/cookbook.html
index b61ccf8..1bf16c1 100644
--- a/site/cookbook.html
+++ b/site/cookbook.html
@@ -318,13 +318,13 @@ 
9 · Benchmark your own setup#

     

       
10 · Connect the team-memory Matrix#

       
Create a dedicated private Git repository for memory. It must differ from every code-repo remote, and its committed URL must not contain credentials. On one maintainer machine:

-      
terminal
npm i -g @davesheffer/hunch@1.9.2
+      
terminal
npm i -g @davesheffer/hunch@1.9.3
 hunch shared --repo git@github.com:acme/project-hunch-memory.git
 git add .gitignore .hunch/team.json
 git commit -m "chore: connect shared Hunch memory"
 git push

       
Add --migrate only when moving existing public .hunch/ memory into the dedicated store. On every teammate machine:

-      
terminal
npm i -g @davesheffer/hunch@1.9.2
+      
terminal
npm i -g @davesheffer/hunch@1.9.3
 git pull
 hunch init
 hunch doctor

@@ -376,9 +376,9 @@ 
13 · Use a local or self-hosted model
       
14 · Install the editor companion and verify a release#

       
Install Hunch from Open VSX, then open a repository initialized with the Hunch CLI. The extension reads the same public, private, or Matrix memory home and never writes Hunch JSON directly.

-      
audit
npm view @davesheffer/hunch@1.9.2 version dist.integrity dist.attestations --json
-git tag --list v1.9.2 vscode-v0.17.3

-      
Observe: npm reports version 1.9.2, an integrity digest, and provenance metadata; Open VSX reports 0.17.3. Each tag’s GitHub Actions run validates the exact content-addressed artifact before isolated publishing begins and verifies the same public bytes afterward.

+      
audit
npm view @davesheffer/hunch@1.9.3 version dist.integrity dist.attestations --json
+git tag --list v1.9.3 vscode-v0.17.3

+      
Observe: npm reports version 1.9.3, an integrity digest, and provenance metadata; Open VSX reports 0.17.3. Each tag’s GitHub Actions run validates the exact content-addressed artifact before isolated publishing begins and verifies the same public bytes afterward.

     

 
 
diff --git a/site/docs.html b/site/docs.html
index 8c0c88a..c541af1 100644
--- a/site/docs.html
+++ b/site/docs.html
@@ -722,13 +722,13 @@ 
Doctor & troubleshooting#

       
Working as a team — the Matrix v1.9#

       
Matrix mode gives a project one living engineering-memory spine across teammates, branches, worktrees, agents, and operating systems. The source of truth is a separate private Git repository you control; Hunch hosts nothing and never places credentials in the code repository.

       
Create that repository first, grant the team normal Git access, and have one maintainer connect it:

-      
maintainer
npm i -g @davesheffer/hunch@1.9.2
+      
maintainer
npm i -g @davesheffer/hunch@1.9.3
 hunch shared --repo git@github.com:acme/project-hunch-memory.git
 git add .gitignore .hunch/team.json
 git commit -m "chore: connect shared Hunch memory"
 git push

       
Use a credential-free HTTPS or SSH URL and leave authentication in SSH or the Git credential helper. Add --migrate only when moving existing public .hunch/ records into the dedicated store.

-      
After the pointer commit lands, each teammate installs v1.9.2, pulls, and runs hunch init. Hunch validates .hunch/team.json, creates an ignored .hunch-private/ clone, and merges the local path and preferences into ignored .hunch/local.json. An unparseable local config is never overwritten.

+      
After the pointer commit lands, each teammate installs v1.9.3, pulls, and runs hunch init. Hunch validates .hunch/team.json, creates an ignored .hunch-private/ clone, and merges the local path and preferences into ignored .hunch/local.json. An unparseable local config is never overwritten.

       
Always pumping. CLI operations attempt a bounded pull at startup; long-lived MCP servers refresh at tool-request boundaries. Captures commit and synchronize the memory-only repository by default, concurrent JSON records merge by identity, and a failed push stays local for hunch shared --sync to retry.

       
Authority stays fail-closed. Captures become advisory memory immediately. Blocking policy authority still requires an explicit audited human action, and public receipts should use --public-only so the shared graph never appears on a public surface.

       
Pause or roll back without deleting memory

@@ -749,8 +749,8 @@ 
Maintenance#

     

       
Release integrity#

       
Hunch tests release artifacts before publication credentials are available. The immutable npm tarball and VSIX are then passed to isolated publishers, which verify the public registries converged on the expected version. npm publishes with GitHub Actions provenance; one tested VSIX goes unchanged to Open VSX and is downloaded again for byte verification.

-      
audit
npm view @davesheffer/hunch@1.9.2 version dist.integrity dist.attestations --json
-git tag --list v1.9.2 vscode-v0.17.3

+      
audit
npm view @davesheffer/hunch@1.9.3 version dist.integrity dist.attestations --json
+git tag --list v1.9.3 vscode-v0.17.3

       
Inspect GitHub Actions, npm, and Open VSX for the public receipts.

     

 
diff --git a/site/es/changelog/index.html b/site/es/changelog/index.html
index 6197953..b0a014c 100644
--- a/site/es/changelog/index.html
+++ b/site/es/changelog/index.html
@@ -108,6 +108,7 @@ 
Cada versión, desde v0.1.

     

       

         
23 de julio de 2026

+        
v1.9.3Recibos de publicación npm verificados

         
v1.9.2OIDC de npm llega al registro

         
v1.9.1Publicación de la extensión solo mediante Open VSX

       

diff --git a/site/he/changelog/index.html b/site/he/changelog/index.html
index d81976e..78ec733 100644
--- a/site/he/changelog/index.html
+++ b/site/he/changelog/index.html
@@ -108,6 +108,7 @@ 
כל גרסה, מאז v0.1.

     

       

         
23 ביולי 2026

+        
v1.9.3קבלות מהדורת npm מאומתות

         
v1.9.2OIDC של npm מגיע לרישום

         
v1.9.1פרסום תוסף דרך Open VSX בלבד

       

diff --git a/site/ru/changelog/index.html b/site/ru/changelog/index.html
index 7ab630c..27c518c 100644
--- a/site/ru/changelog/index.html
+++ b/site/ru/changelog/index.html
@@ -108,6 +108,7 @@ 
Все выпуски, начиная с v0.1.

     

       

         
23 июля 2026 г.

+        
v1.9.3Проверенные квитанции выпуска npm

         
v1.9.2npm OIDC достигает реестра

         
v1.9.1Публикация расширения только через Open VSX

       

diff --git a/test/workflow-release-contract.test.ts b/test/workflow-release-contract.test.ts
index d6dac99..c725b5c 100644
--- a/test/workflow-release-contract.test.ts
+++ b/test/workflow-release-contract.test.ts
@@ -210,6 +210,10 @@ test("npm publication isolates OIDC from repository code and publishes only vali
   assert.match(publish, /cryptographic_attestation_verified/);
   assert.match(publish, /raw_and_cryptographic_bundle_match/);
   assert.match(publish, /cryptographic_attestation_bundle_sha256/);
+  const sigstoreVersionGuard = /if \(!\/\^(.+?)\/\.test\(result\.sigstore_version/.exec(publish)?.[1];
+  assert.ok(sigstoreVersionGuard, "the Sigstore verifier version guard must remain executable workflow code");
+  assert.equal(new RegExp(sigstoreVersionGuard).test("4.0.0"), true,
+    "the Sigstore verifier version guard must recognize a real semantic version");
   assert.match(publish, /attestation_bundle_sha256/);
   assert.match(publish, /signature_audit_sha256/);
   assert.match(publish, /dependency\.uri === expectedDependencyUri/,
diff --git a/tooling/changelog-locales.mjs b/tooling/changelog-locales.mjs
index 786a250..934d8fd 100644
--- a/tooling/changelog-locales.mjs
+++ b/tooling/changelog-locales.mjs
@@ -8,7 +8,7 @@ export const changelogLocales = {
       footer: "© Hunch — התאמה ארכיטקטונית לקוד AI.", home: "בית", githubReleases: "גרסאות ב-GitHub"
     },
     titles: [
-      "OIDC של npm מגיע לרישום", "פרסום תוסף דרך Open VSX בלבד", "זיכרון הנדסי חי אחד לכל הצוות", "פרסום npm שלא פג תוקף", "CI מחמיר שנשאר זמין", "ניסויים שעברו בדיקת סוקרים וגבול שוק ברור יותר",
+      "קבלות מהדורת npm מאומתות", "OIDC של npm מגיע לרישום", "פרסום תוסף דרך Open VSX בלבד", "זיכרון הנדסי חי אחד לכל הצוות", "פרסום npm שלא פג תוקף", "CI מחמיר שנשאר זמין", "ניסויים שעברו בדיקת סוקרים וגבול שוק ברור יותר",
       "מסלול קצר יותר מהתקנה לזיכרון שימושי", "תמיכה ב-Python", "זיכרון שפועל בעצמו", "בחירת מנוי בלי להינעל לספק",
       "צינור האימות — המסירה נאכפת, לא רק מקווים לה", "היכרות ראשונה ידידותית יותר", "אחזור שעוקב אחרי הגרף, לא רק מילות מפתח", "ה-wiki יודעת מה קורה ומה הלאה", "לולאת סוכן שקטה ומדויקת יותר",
       "ה-wiki מאמצת את התיעוד — עם שער drift", "תשתית אמינה ושקופה", "hunch structure — המבנה לפני grep", "תוסף Claude Code והמאגר מדגים את עצמו", "AGENTS.md כמשטח drift", "hunch impact + hunch path — רואים את ההשפעה והמסלול", "1.0 — אינדקס בלי תלויות native",
@@ -28,7 +28,7 @@ export const changelogLocales = {
       footer: "© Hunch — архитектурное соответствие для ИИ-кода.", home: "Главная", githubReleases: "Релизы на GitHub"
     },
     titles: [
-      "npm OIDC достигает реестра", "Публикация расширения только через Open VSX", "Единая живая инженерная память для всей команды", "Публикация npm без истекающих учётных данных", "Строгий CI, который остаётся доступным", "Эксперименты с независимой оценкой и более ясная граница рынка",
+      "Проверенные квитанции выпуска npm", "npm OIDC достигает реестра", "Публикация расширения только через Open VSX", "Единая живая инженерная память для всей команды", "Публикация npm без истекающих учётных данных", "Строгий CI, который остаётся доступным", "Эксперименты с независимой оценкой и более ясная граница рынка",
       "Более короткий путь от установки к полезной памяти", "Поддержка Python", "Память, которая работает сама", "Выбор подписки без привязки к поставщику",
       "Конвейер проверки — доставка гарантирована", "Более дружелюбное первое знакомство", "Поиск следует графу, а не только ключевым словам", "Wiki знает, что происходит и что дальше", "Более тихий и точный цикл агента",
       "Wiki принимает ваши документы под контроль дрейфа", "Честная и надёжная инфраструктура", "hunch structure — структура до grep", "Плагин Claude Code и самодемонстрирующийся репозиторий", "AGENTS.md как поверхность дрейфа", "hunch impact + hunch path — влияние и путь", "1.0 — индекс без нативных зависимостей",
@@ -48,7 +48,7 @@ export const changelogLocales = {
       footer: "© Hunch — التوافق المعماري لكود الذكاء الاصطناعي.", home: "الرئيسية", githubReleases: "الإصدارات على GitHub"
     },
     titles: [
-      "وصول OIDC الخاص بـnpm إلى السجل", "نشر الإضافة عبر Open VSX فقط", "ذاكرة هندسية حية واحدة للفريق كله", "نشر npm بلا بيانات اعتماد منتهية الصلاحية", "تكامل مستمر صارم يبقى متاحًا", "تجارب مؤهلة بالمراجعة وحدود سوق أوضح",
+      "إيصالات إصدار npm موثّقة", "وصول OIDC الخاص بـnpm إلى السجل", "نشر الإضافة عبر Open VSX فقط", "ذاكرة هندسية حية واحدة للفريق كله", "نشر npm بلا بيانات اعتماد منتهية الصلاحية", "تكامل مستمر صارم يبقى متاحًا", "تجارب مؤهلة بالمراجعة وحدود سوق أوضح",
       "طريق أقصر من التثبيت إلى ذاكرة مفيدة", "دعم Python", "ذاكرة تعمل بنفسها", "اختيار الاشتراك من دون ارتهان لمزوّد",
       "مسار التحقق — تسليم مضمون لا مجرد أمل", "ترحيب أول أكثر وضوحاً", "استرجاع يتبع الرسم البياني لا الكلمات فقط", "الـwiki تعرف ما يحدث وما التالي", "حلقة وكيل أهدأ وأكثر دقة",
       "الـwiki تتولى توثيقك تحت بوابة الانحراف", "بنية تحتية صادقة وموثوقة", "hunch structure — البنية قبل grep", "إضافة Claude Code والمستودع يشرح نفسه", "AGENTS.md كسطح للانحراف", "hunch impact + hunch path — الأثر والمسار", "1.0 — فهرس بلا تبعيات native",
@@ -68,7 +68,7 @@ export const changelogLocales = {
       footer: "© Hunch — conformidad arquitectónica para código de IA.", home: "Inicio", githubReleases: "Versiones en GitHub"
     },
     titles: [
-      "OIDC de npm llega al registro", "Publicación de la extensión solo mediante Open VSX", "Una memoria de ingeniería viva para todo el equipo", "Publicación en npm sin credenciales que caduquen", "CI estricto que permanece disponible", "Experimentos validados por revisores y un límite de mercado más claro",
+      "Recibos de publicación npm verificados", "OIDC de npm llega al registro", "Publicación de la extensión solo mediante Open VSX", "Una memoria de ingeniería viva para todo el equipo", "Publicación en npm sin credenciales que caduquen", "CI estricto que permanece disponible", "Experimentos validados por revisores y un límite de mercado más claro",
       "Un camino más corto desde la instalación hasta una memoria útil", "Compatibilidad con Python", "Memoria que funciona sola", "Elegir suscripción sin quedar atado a un proveedor",
       "La canalización de verificación: entrega garantizada", "Una primera bienvenida más amable", "La recuperación sigue el grafo, no solo las palabras", "La wiki sabe qué ocurre y qué viene después", "Un ciclo de agente más silencioso y preciso",
       "La wiki adopta tus documentos bajo una barrera de deriva", "Infraestructura honesta y fiable", "hunch structure: la estructura antes de grep", "Plugin de Claude Code y un repositorio que se demuestra a sí mismo", "AGENTS.md como superficie de deriva", "hunch impact + hunch path: impacto y recorrido", "1.0: índice sin dependencias nativas",