From 7a9a8be16a5d64fa2adb9ba675973435b3ba3398 Mon Sep 17 00:00:00 2001 From: Tan Date: Thu, 20 Aug 2026 15:49:42 +0700 Subject: [PATCH] release: prepare arcready 0.4.0 package --- docs/exec-plans/active/R01.md | 53 +++++++---- docs/npm-publishing.md | 28 +++--- docs/releases/v0.4.0-npm-checklist.md | 102 +++++++++++++++++++++ docs/releases/v0.4.0.md | 55 +++++++++++ docs/roadmap.md | 7 +- packages/arcready/README.md | 21 +++++ packages/arcready/package.json | 2 +- packages/arcready/test/cli-json-v2.test.ts | 2 +- 8 files changed, 235 insertions(+), 35 deletions(-) create mode 100644 docs/releases/v0.4.0-npm-checklist.md create mode 100644 docs/releases/v0.4.0.md diff --git a/docs/exec-plans/active/R01.md b/docs/exec-plans/active/R01.md index 702e37f..d3b8724 100644 --- a/docs/exec-plans/active/R01.md +++ b/docs/exec-plans/active/R01.md @@ -1,6 +1,6 @@ # R01 — Coordinated ArcReady v0.4.0 Release -Status: Approved — E1 implementation not started +Status: Validated — E1 candidate pending commit and PR approval Risk class: R3 distribution and external contract @@ -8,7 +8,7 @@ Owner: ArcReady maintainers Base branch: `main` -Base SHA: `24321a570f842d66ea9b86e7620caced1a3afdee` +Base SHA: `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620` Last reviewed: 2026-08-20 @@ -74,11 +74,11 @@ Verified on 2026-08-20: | npm latest | `arcready@0.3.0`, published 2026-06-13T17:07:22.227Z | | npm package source | `gitHead` `108759757d047236cab19272c3246bacc3261f1a` | | Git release tag | `v0.3.0` resolves to `e4a1244e5363bafee2dcf7446467e7f6fabe921e` | -| Current main | `24321a570f842d66ea9b86e7620caced1a3afdee` | -| Change size | 181 files, 60,385 insertions, 1,150 deletions from tag to main | +| Frozen E1 base | `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620` | +| Change size | 184 files, 61,169 insertions, 1,162 deletions from tag to base | | File deletion | no deleted path in the tag-to-main diff | | Published package | 7 entries, 18,109-byte tarball, 79,982 bytes unpacked | -| Current built package | 10 entries, 91,643-byte tarball, 435,733 bytes unpacked | +| E1 candidate package | 10 entries, 92,141-byte tarball, 436,925 bytes unpacked | | Runtime dependencies | `@solidity-parser/parser@0.20.2`, `typescript@5.9.3` | | Dependency licenses | parser MIT with no declared dependency; TypeScript Apache-2.0 | | Dependency Node floor | TypeScript >=14.17; ArcReady >=22 | @@ -88,14 +88,18 @@ The size comparison is evidence, not a budget. The release review must explain the added private PREVRANDAO entry and external parser/compiler dependencies and must verify package licenses, integrity, installation, and lazy loading. -Remaining before implementation: +Resolved before E1 implementation: + +- the A02/A03 documentation prerequisite merged cleanly in PR #74 at + `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620`; +- the E1 base is frozen at that exact merge SHA, and later runtime changes are + excluded unless the cumulative release inventory is reset. + +Remaining before E1 publication: -- confirmation that the A02/A03 documentation prerequisite is merged cleanly; - npm authentication and package-owner authorization; - exact GitHub release permissions and tag protection state; -- a complete public declaration/API comparison of packed v0.3.0 and the v0.4.0 - candidate; -- whether any main change after the base SHA should be included or deferred. +- exact candidate review, full gate, merge, and registry dry-run evidence. Any new runtime-affecting main change resets the release base and requires a new cumulative inventory. @@ -419,13 +423,13 @@ Progress: - [x] product brief drafted - [x] registry/tag premise verified - [x] release spike completed -- [ ] A02/A03 prerequisite merged +- [x] A02/A03 prerequisite merged - [x] architecture reviewed -- [ ] E1 package vertical slice working at version 0.4.0 -- [ ] v0.3/v0.4 API and package comparison complete -- [ ] targeted validation passed -- [ ] E1 final independent review passed -- [ ] E1 full validation passed +- [x] E1 package vertical slice working at version 0.4.0 +- [x] v0.3/v0.4 API and package comparison complete +- [x] targeted validation passed +- [x] E1 final independent review passed +- [x] E1 full validation passed - [ ] E1 exact-head CI passed and merged - [ ] npm 0.4.0 explicitly approved, published, and verified - [ ] E2A Action candidate reviewed, validated, and merged @@ -496,4 +500,19 @@ Pending. input set and extracted package-entry hashes; package subtree equality alone is insufficient because Action structural tests live under that subtree. - 2026-08-20: Independent architecture review approved corrected v3 with - `0 blocker / 0 major / 0 minor`; E1 remains unstarted and separately gated. + `0 blocker / 0 major / 0 minor`; E1 remains separately gated. +- 2026-08-20: Froze E1 at the merged A02/A03 prerequisite SHA + `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620` and began the package-only + vertical slice without changing the Action default or tagged smoke reference. +- 2026-08-20: The E1 package vertical slice passed 2,703 package tests, build, + installed-tarball smoke, dry-run shape, dependency metadata/integrity, packed + API comparison, and the eight-repository A02 corpus. Final review, full gate, + exact-head CI, merge, and publication remain pending. +- 2026-08-20: Final independent review approved the exact 19,350-byte staged + bundle with SHA-256 + `1a2e3633f8f1c258f9fc606f2afb5e7c826e6015327e5ed8dba14b875eab5434` + at `0 blocker / 0 major / 0 minor`. +- 2026-08-20: `corepack pnpm verify:full` passed fixture validation, 2,703 + package tests, six workflow tests, lint, build, and installed-package smoke. + Ignored local adoption artifacts were quarantined outside the repository for + lint and restored afterward; they are not candidate inputs. diff --git a/docs/npm-publishing.md b/docs/npm-publishing.md index c1e62ef..72600b4 100644 --- a/docs/npm-publishing.md +++ b/docs/npm-publishing.md @@ -1,19 +1,21 @@ # npm Publishing ArcReady is published on npm as an installable CLI package. The current public -version is `arcready@0.3.0`. The architecture-approved R01 plan selects `0.4.0`, -but E1 implementation has not started and no publishable candidate exists yet. +version is `arcready@0.3.0`. The architecture-approved R01 E1 candidate selects +`0.4.0` from frozen base `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620`. +The candidate is not published, and its exact operational commit remains +pending final validation and review. ## Current Package -| Field | Value | -| --------------------- | ----------------------------- | -| Package name | `arcready` | -| Published version | `0.3.0` | -| Selected next version | `0.4.0` (R01; E1 not started) | -| License | MIT | -| Node.js | `>=22` | -| CLI bin | `arcready` | +| Field | Value | +| --------------------- | -------------------------- | +| Package name | `arcready` | +| Published version | `0.3.0` | +| Selected next version | `0.4.0` (R01 E1 candidate) | +| License | MIT | +| Node.js | `>=22` | +| CLI bin | `arcready` | The npm package should include only: @@ -52,9 +54,9 @@ Inspect the output before release. The dry run must show the separately approved unpublished candidate version and only the expected package files. Do not try to publish `arcready@0.3.0` again. -During E1, after the exact operational candidate and selected release SHA exist, -replace the pre-implementation language in this guide before any publish command -is authorized. +Use the versioned +[v0.4.0 npm checklist](releases/v0.4.0-npm-checklist.md) for E1 evidence. Record +the exact merged package commit there before any publish command is authorized. ## Before Real Publish diff --git a/docs/releases/v0.4.0-npm-checklist.md b/docs/releases/v0.4.0-npm-checklist.md new file mode 100644 index 0000000..a03daaa --- /dev/null +++ b/docs/releases/v0.4.0-npm-checklist.md @@ -0,0 +1,102 @@ +# ArcReady v0.4.0 npm checklist + +Status: E1 candidate — not published + +This checklist owns the package-publication evidence for R01 E1. The GitHub +Action, Git tag, tagged smoke, and GitHub Release are later checkpoints and must +not be created from this checklist. + +## Frozen provenance + +- Version: `0.4.0` +- E1 base: `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620` +- Exact reviewed candidate commit: pending +- Exact merged package commit: pending +- Reviewed staged bundle SHA-256: + `1a2e3633f8f1c258f9fc606f2afb5e7c826e6015327e5ed8dba14b875eab5434` +- npm registry `gitHead`: pending publication +- Working tree at selected candidate: pending clean-tree verification + +Any runtime-affecting change after the frozen base requires a new cumulative +inventory and review decision. Release-only metadata and documentation must be +included in the exact reviewed candidate. + +## Package contract + +- [x] Manifest version and terminal version are `0.4.0`. +- [x] Node engine remains `>=22` and license remains MIT. +- [x] Runtime dependencies are exactly `@solidity-parser/parser@0.20.2` and + `typescript@5.9.3`; their licenses and lockfile integrity are verified. +- [x] Packed paths are only `dist/`, `README.md`, and `package.json`; source maps + and repository files are absent. +- [x] Sorted packed entry paths, sizes, and SHA-256 values are recorded from the + exact candidate artifact. +- [x] Packed v0.3.0 and candidate declarations are compared; existing public + exports remain and the intended addition is documented. +- [x] Inventory remains 19 known, 15 default, seven known wallet, six default + wallet, and four canonical rules. +- [x] Legacy output/configuration/reporters/scoring/exits remain compatible. +- [x] `scan --json-v2` remains opt-in with `contractVersion: "2.0"`. +- [x] `action.yml`, the external tagged smoke, and current v0.3 Action examples + remain on `0.3.0` during E1. + +Dry-run artifact: 10 entries, 92,141 bytes packed, 436,925 bytes unpacked, +SHA-1 `936ed9a88a47273690782072488ee52e761c37c1`, integrity +`sha512-X8FumZlkylSwXYHNOQhGtXj1o9Ljbh4XFJD7i/JsN5fm45amIokidantNPL7wtDGG/NyVt8gLK8zSTRdDhMLfw==`. + +| Packed path | SHA-256 | +| ------------------------------- | ------------------------------------------------------------------ | +| `README.md` | `747236a631af06979bafd8ea31a5ee6cee092b897d0936fd77f7c5c8c26e7426` | +| `dist/bin.d.ts` | `a59c47872b71f12589942892464e764c0db350c20b72228645615cc36e0a0725` | +| `dist/bin.js` | `e5802b62ab9d00bd27eeee7725caa7766af9f78cb4d2ee47841e2acb379c6387` | +| `dist/chunk-SVC4FMEK.js` | `34143ad65033386ea15db32d076f30864f58919ade7c9783b1ae04a3d4cb9495` | +| `dist/chunk-W7XUSBJX.js` | `27f5c93ce5c1883c1a62fedfd1aeb28950a39580ae0894734990a176e5d8206e` | +| `dist/index.d.ts` | `2cf4842d1e05f800a59b84b5e052b0bff3be6afb9ce80247351de1d7be9632fc` | +| `dist/index.js` | `a990746addb778bd28af5e083d2c7146cddf8ccf82b7838359757183b966e6c0` | +| `dist/prevrandao-analysis.d.ts` | `ac79b93b7d046c2d66305c2399e2afba7b3fdd9bad71d4d70ce81096eec5c3e1` | +| `dist/prevrandao-analysis.js` | `bdc6335d9a80f867489850e4e284dc6be2a6f58027ee7fa7cb595a1cdf0276a6` | +| `package.json` | `b6c4785694e5a79bc95c11e818d8303acca0e215773405f059f5731cc0ea629e` | + +Packed declaration comparison found 70 v0.3.0 exports and 71 candidate +exports: no removal and only `arcUsdcAmountConversionRule` added. The existing +`getRulesForScan` declaration gains one optional configured-rules parameter. + +## Candidate validation + +- [x] `corepack pnpm exec prettier --check ` +- [x] `git diff --check` +- [x] targeted package tests: 42 files and 2,703 tests passed +- [x] `corepack pnpm build` +- [x] `corepack pnpm smoke:package` +- [x] `npm publish --dry-run --json` from `packages/arcready` +- [x] clean tarball install under supported Node with terminal, legacy JSON, and + canonical JSON probes +- [x] A02 pinned corpus rerun: eight clean pinned repositories, 545 files, + score 100/pass/zero findings in every repository +- [x] `corepack pnpm verify:full`: fixtures, 2,703 package tests, six workflow + tests, lint, build, and installed-package smoke passed +- [x] final independent adversarial review: APPROVE with zero blocker, major, + or minor findings +- [ ] exact-head required CI: pending + +## Pre-publish authorization + +- [ ] E1 candidate merged with explicit approval. +- [ ] `npm view arcready@0.4.0` confirms the version is absent. +- [ ] `npm whoami` and package-owner permission are confirmed immediately before + publication. +- [ ] Dry-run contents and integrity match the reviewed candidate. +- [ ] Maintainer gives a separate explicit approval for `npm publish`. + +Do not run `npm publish` merely because the candidate passes validation. If the +version appears in the registry unexpectedly, integrity differs, or any package +boundary changes, stop the release and resolve the conflict without overwriting +or unpublishing an immutable release. + +## Post-publish evidence + +- [ ] Registry version, integrity, tarball contents, and `gitHead` recorded. +- [ ] Clean install from the registry passes version, default C12 behavior, + legacy output, and canonical opt-in probes. +- [ ] Exact E1 package SHA and registry evidence copied to the R01 completion + record for E2 input-equality and package-entry hash comparison. diff --git a/docs/releases/v0.4.0.md b/docs/releases/v0.4.0.md new file mode 100644 index 0000000..99ce5c7 --- /dev/null +++ b/docs/releases/v0.4.0.md @@ -0,0 +1,55 @@ +# ArcReady v0.4.0 + +ArcReady v0.4.0 publishes the cumulative precision, compatibility, and reporting +work merged after v0.3.0 as an installable npm package. It does not broaden the +approved analyzer surface as part of the release process. + +## Highlights + +- Publishes 19 known rules with 15 selected by default, including six default + wallet rules and four rules in the opt-in canonical JSON runtime. +- Adds the public `arcUsdcAmountConversionRule` export. +- Adds experimental `arcready scan --json-v2` output while retaining canonical + `contractVersion: "2.0"` and keeping the legacy output mode and schema as the + default CLI surface. +- Publishes the reviewed Arc-specific precision work for CCTP domains, wrapped + USDC, relayer gas, chain metadata, USDC amount interpretation, bounded + ethers/viem blob ownership, and PREVRANDAO source/artifact flows. +- Corrects Arc Testnet hexadecimal chain identity to `0x4CEF52`. +- Keeps four deprecated rules public and default-excluded. The attestation and + gas-label advice rules support explicit non-off configuration; the two legacy + App Kit rule objects remain available only for direct API compatibility. +- Includes pinned `@solidity-parser/parser@0.20.2` and `typescript@5.9.3` + runtime dependencies. + +## Compatibility and migration + +Legacy configuration, terminal/JSON/Markdown/HTML reporters, scoring, and exit +behavior remain supported. Existing consumers do not need to adopt JSON v2. +Users who intentionally relied on the attestation or gas-label advice rule must +select it explicitly in configuration. Consumers that directly invoke either +deprecated App Kit export may continue doing so, but preset/config selection +does not re-enable those legacy detectors. +The library's `getRulesForScan` declaration adds an optional configured-rules +parameter; all 70 exports packed in v0.3.0 remain, with +`arcUsdcAmountConversionRule` as the sole new exported symbol. + +ArcReady remains a narrow, local-first static compatibility gate. It does not +perform live RPC or API verification, compile or simulate transactions, prove +deployment state, inspect rendered UI, or certify a repository as compatible. +Imported/cross-file values, JSX/TSX, HTML, generated code, and runtime behavior +remain outside the supported evidence boundary unless a specific rule says +otherwise. + +## Coordinated Action release + +This E1 release publishes only `arcready@0.4.0` on npm. The repository Action +default and external tagged smoke remain on v0.3.0 until the separately reviewed +R01 E2 checkpoints complete. Do not use these notes to create a `v0.4.0` Git tag +or GitHub Release during E1. + +## Publication status + +Release candidate only. npm publication requires final independent review, the +full repository gate, exact-head CI, merge approval, package-owner verification, +and a separate explicit publish approval. diff --git a/docs/roadmap.md b/docs/roadmap.md index accf01f..3fe3683 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -325,9 +325,10 @@ A03 performs none of those distribution mutations. The [R01 release plan](exec-plans/active/R01.md) selects a staged v0.4.0 candidate: npm package first, then the Action default, exact-SHA external proof, immutable tag, tagged external smoke, and finally the GitHub Release. Its -architecture review passed with `0 blocker / 0 major / 0 minor`; E1 has not -started, and explicit approval remains required at every merge, publish, tag, -and GitHub Release checkpoint. +architecture review passed with `0 blocker / 0 major / 0 minor`. E1 package +candidate implementation is in progress from frozen base `4b7ee02`; explicit +approval remains required at every merge, publish, tag, and GitHub Release +checkpoint. Core milestones must not silently change an already selected release commit. diff --git a/packages/arcready/README.md b/packages/arcready/README.md index 0af506b..d379b04 100644 --- a/packages/arcready/README.md +++ b/packages/arcready/README.md @@ -4,6 +4,27 @@ ArcReady is an Arc-specific CI quality gate and integration validator for wallet > ArcReady is an independent open-source project. It is not an official Circle or Arc product. +## v0.4.0 package boundary + +The `arcready@0.4.0` npm package publishes the precision and compatibility work +already reviewed on the selected release base. It contains 19 known rules, 15 +rules in the default scan, six default wallet rules, and four rules in the +opt-in canonical JSON runtime. Four deprecated rules remain public and +default-excluded: the attestation and gas-label advice rules support explicit +non-off configuration, while the two legacy App Kit rule objects remain +available only for direct API compatibility. + +This package also includes the additive `arcUsdcAmountConversionRule` library +export, the experimental opt-in `scan --json-v2` command, and the pinned +`@solidity-parser/parser@0.20.2` and `typescript@5.9.3` runtime dependencies. +Legacy reports, configuration, scoring, and normal CLI exit behavior remain +available. ArcReady still performs local static analysis only; it does not make +live RPC, API, simulation, deployment, or compatibility-certification claims. + +The coordinated GitHub Action `v0.4.0` is a later release checkpoint. Until +that checkpoint is completed, `tanka420/arcready@v0.3.0` continues to select +the published v0.3 Action and CLI by default. + ## Install Run without installing: diff --git a/packages/arcready/package.json b/packages/arcready/package.json index d107230..4a4138a 100644 --- a/packages/arcready/package.json +++ b/packages/arcready/package.json @@ -1,6 +1,6 @@ { "name": "arcready", - "version": "0.3.0", + "version": "0.4.0", "description": "Arc-specific CI quality gate and integration validator for wallets, bridges, App Kit integrations, and dApps.", "license": "MIT", "type": "module", diff --git a/packages/arcready/test/cli-json-v2.test.ts b/packages/arcready/test/cli-json-v2.test.ts index 907e02c..abf3aab 100644 --- a/packages/arcready/test/cli-json-v2.test.ts +++ b/packages/arcready/test/cli-json-v2.test.ts @@ -472,7 +472,7 @@ describe("legacy CLI regression", () => { const { report } = await runScan(legacyJson.cwd); expect(terminal.code).toBe(0); - expect(terminal.stdout).toContain("ArcReady v0.3.0"); + expect(terminal.stdout).toContain(`ArcReady v${publicApi.PACKAGE_VERSION}`); expect(terminal.stdout).not.toContain('"contractVersion"'); expect(terminal.stdout).not.toContain('"selectedOccurrences"'); expect(legacyJson.stdout).toBe(jsonReporter.render(report));