diff --git a/CHANGELOG.md b/CHANGELOG.md index e57088f..98766f3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,14 @@ All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [Unreleased] + +### Changed + +- Recorded the independent inspection of npm `@augmentworks/cli@0.3.9`. + The published tarball is unchanged and still embeds the prior 0.3.8 + `LAST_VERIFIED` snapshot. + ## [0.3.9] - 2026-10-13 Immutable patch. Customers can install the hosted run-scope lookup hardening diff --git a/docs/discovery-handoff.md b/docs/discovery-handoff.md index 7ae457f..5fcbda3 100644 --- a/docs/discovery-handoff.md +++ b/docs/discovery-handoff.md @@ -15,7 +15,7 @@ constants. Packaged identity versus post-publication inspection is defined in | `capabilities.localDemo` | `true` | | Demo invocation | `node dist/index.js demo` | | Provenance | `sourceCommit: null`, `verifiedAt: null` | -| Last independently inspected npm | `@augmentworks/cli@0.3.8` (tag `v0.3.8` commit `f36d9086bad1ac109a7670e8acc9bf14a5d15047`, published 2026-10-08T01:42:45.969Z, integrity `sha512-T+e1VWQ8plx0jJMdkOHxocpH8SjCr9BSeRLMsCnCHAO0Z3z9bhgIf0um9x6eyWJfwPz01YOL7CZvM6sLTiSLIA==`, tarball SHA-256 `2849ceb6c3c9b18d02a4cb2aa7f0ad470ec74cb7846a8eadf91d83147965f36e`, 74 files). The registry document omitted `gitHead`. That artifact stays `lastIndependentlyInspected`. `thisPackageIdentity` for this 0.3.9 checkout is `pending-protected-publish`. The published 0.3.8 tarball still embeds the prior `LAST_VERIFIED` 0.3.7 snapshot; that inspection commit is not inside that artifact. | +| Last independently inspected npm | `@augmentworks/cli@0.3.9` (tag `v0.3.9` commit `9e7919cbfe583cc15701904580be9d36da3bcaf4`, published 2026-10-13T20:31:53.099Z, integrity `sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==`, tarball SHA-256 `176e0b6e1ae6e68b98e1ee363568241ac6534ceb5317ebd9f618980ef0efe72b`, 74 files). The registry document omitted `gitHead`. `thisPackageIdentity` is `independently-inspected`. The published 0.3.9 tarball still embeds the prior `LAST_VERIFIED` 0.3.8 snapshot; this inspection commit is not inside that artifact. | | Immutable prior npm | `@augmentworks/cli@0.3.8`, `@augmentworks/cli@0.3.7`, `@augmentworks/cli@0.3.6`, `@augmentworks/cli@0.3.5`, `@augmentworks/cli@0.3.4`, and `@augmentworks/cli@0.3.3` (gitHead `4a08ea0d352f2515e725cb9ca946807112422436`). Do not overwrite or relabel. | The committed discovery manifest stays `development` for a source checkout. A @@ -31,9 +31,9 @@ node scripts/verify-published-discovery.mjs --version 0.3.7 ``` `verify-published-discovery` emits metadata and does not replace executable -inspection. Independently inspected 0.3.8 registry evidence stays -`lastIndependentlyInspected`. `thisPackageIdentity` for this checkout is -`0.3.9` / `pending-protected-publish` in +inspection. Independently inspected 0.3.9 registry evidence is +`lastIndependentlyInspected` and `thisPackageIdentity` +(`independently-inspected`) in `docs/feature-readiness/published-registry-evidence.json`. Independently inspected 0.3.6 remains historical (capabilities, no saved-suite `/2`). Independently inspected 0.3.5 remains historical (it omits suite-selection @@ -91,8 +91,7 @@ npm test ## Changed resources in this source revision -- `lastIndependentlyInspected` remains independently inspected `@augmentworks/cli@0.3.8` -- `thisPackageIdentity` is `@augmentworks/cli@0.3.9` with status `pending-protected-publish` +- `lastIndependentlyInspected` and `thisPackageIdentity` record independently inspected `@augmentworks/cli@0.3.9` - Immutable 0.3.8, 0.3.7, 0.3.6, 0.3.5, 0.3.4, and 0.3.3 records stay unchanged - Source discovery stays `development` diff --git a/docs/distribution-runbook.md b/docs/distribution-runbook.md index 6b4fc28..b98288d 100644 --- a/docs/distribution-runbook.md +++ b/docs/distribution-runbook.md @@ -28,17 +28,15 @@ accurate extra term. ## npm -Do not run `npm publish` ad hoc. `@augmentworks/cli@0.3.8` is published from -GitHub tag `v0.3.8` (`f36d9086bad1ac109a7670e8acc9bf14a5d15047`) and +Do not run `npm publish` ad hoc. `@augmentworks/cli@0.3.9` is published from +GitHub tag `v0.3.9` (`9e7919cbfe583cc15701904580be9d36da3bcaf4`) and independently inspected. The trusted workflow's OIDC publish returned 404 after the repository moved to `augmentworks-org`; the same tag bytes were published by the package owner and have no SLSA provenance attestation. Do not -republish 0.3.8. `@augmentworks/cli@0.3.9` is the next immutable artifact: -publish it only from GitHub release `v0.3.9` through -`.github/workflows/release.yml`, then inspect that new tarball. Do not -overwrite or relabel `@augmentworks/cli@0.3.8`, `0.3.7`, `0.3.6`, `0.3.5`, -`0.3.4`, or `0.3.3`. The npm trusted publisher must allow -`augmentworks-org/augmentworks-cli`. +republish 0.3.9. Do not overwrite or relabel `@augmentworks/cli@0.3.8`, +`0.3.7`, `0.3.6`, `0.3.5`, `0.3.4`, or `0.3.3`. The next release still needs a +new tag and `.github/workflows/release.yml`, after the npm trusted publisher +allows `augmentworks-org/augmentworks-cli`. ## Website diff --git a/docs/feature-readiness/published-registry-evidence.json b/docs/feature-readiness/published-registry-evidence.json index fa974eb..f39eeb9 100644 --- a/docs/feature-readiness/published-registry-evidence.json +++ b/docs/feature-readiness/published-registry-evidence.json @@ -1,34 +1,37 @@ { "schemaVersion": "aw-cli-registry-evidence/1", - "semantics": "Post-publication independent inspection of npm tarballs. Packaged cli-release.json is this artifact's identity, not a live registry probe of this version. Do not overwrite or relabel existing npm versions. The published 0.3.8 tarball embeds the prior LAST_VERIFIED 0.3.7 snapshot; this file records the later inspection and is not inside that tarball. thisPackageIdentity for 0.3.9 stays pending-protected-publish until the trusted publish is inspected.", + "semantics": "Post-publication independent inspection of npm tarballs. Packaged cli-release.json is this artifact's identity, not a live registry probe of this version. Do not overwrite or relabel existing npm versions. The published 0.3.9 tarball embeds the prior LAST_VERIFIED 0.3.8 snapshot; this file records the later inspection and is not inside that tarball.", "lastIndependentlyInspected": { "packageName": "@augmentworks/cli", - "version": "0.3.8", - "gitHead": "f36d9086bad1ac109a7670e8acc9bf14a5d15047", - "integrity": "sha512-T+e1VWQ8plx0jJMdkOHxocpH8SjCr9BSeRLMsCnCHAO0Z3z9bhgIf0um9x6eyWJfwPz01YOL7CZvM6sLTiSLIA==", - "verifiedAt": "2026-10-08T01:42:45.969Z", - "githubRelease": "v0.3.8", - "githubReleasePublishedAt": "2026-10-08T01:28:38Z", - "githubReleaseUrl": "https://github.com/augmentworks-org/augmentworks-cli/releases/tag/v0.3.8", - "registryUrl": "https://registry.npmjs.org/@augmentworks/cli/0.3.8", - "tarballUrl": "https://registry.npmjs.org/@augmentworks/cli/-/cli-0.3.8.tgz", - "shasum": "009bc1739654c704b75967214ef9604374bd9a92", - "tarballSha256": "2849ceb6c3c9b18d02a4cb2aa7f0ad470ec74cb7846a8eadf91d83147965f36e", + "version": "0.3.9", + "gitHead": "9e7919cbfe583cc15701904580be9d36da3bcaf4", + "integrity": "sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==", + "verifiedAt": "2026-10-13T20:31:53.099Z", + "githubRelease": "v0.3.9", + "githubReleasePublishedAt": "2026-10-13T20:16:25Z", + "githubReleaseUrl": "https://github.com/augmentworks-org/augmentworks-cli/releases/tag/v0.3.9", + "registryUrl": "https://registry.npmjs.org/@augmentworks/cli/0.3.9", + "tarballUrl": "https://registry.npmjs.org/@augmentworks/cli/-/cli-0.3.9.tgz", + "shasum": "196d1c0eaa59a6c7a89166cdd0991ff1debbb82d", + "tarballSha256": "176e0b6e1ae6e68b98e1ee363568241ac6534ceb5317ebd9f618980ef0efe72b", "fileCount": 74, - "notes": "Downloaded registry tarball. GitHub tag v0.3.8 is f36d9086bad1ac109a7670e8acc9bf14a5d15047. The npm version document omitted gitHead. The tarball shasum matches the pack of that tag. No SLSA provenance attestation: trusted publishing from augmentworks-org returned 404 because the publisher was still bound to jeffskafi/augmentworks-cli. The same bytes were published by the package owner. Installed binary passed the AUG-272 packed report fixture, including exit 11 for a claimed pass with a required fail. Do not republish 0.3.8 or 0.3.7. Do not use @latest." + "notes": "Downloaded registry tarball. GitHub tag v0.3.9 is 9e7919cbfe583cc15701904580be9d36da3bcaf4. The npm version document omitted gitHead. The tarball shasum matches the pack of that tag. No SLSA provenance attestation: the trusted workflow's OIDC publish returned 404 after the repository moved to augmentworks-org, and the registry version document has no attestations. The same tag bytes were published by the package owner. Do not republish 0.3.9 or 0.3.8. Do not use @latest." }, "thisPackageIdentity": { "packageName": "@augmentworks/cli", "version": "0.3.9", "publishedPackageVerifiedMeaning": "published-line identity, not inspection of this tarball", - "gitHead": null, - "integrity": null, - "verifiedAt": null, - "status": "pending-protected-publish", - "githubRelease": null, - "githubReleasePublishedAt": null, + "gitHead": "9e7919cbfe583cc15701904580be9d36da3bcaf4", + "integrity": "sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==", + "verifiedAt": "2026-10-13T20:31:53.099Z", + "status": "independently-inspected", + "githubRelease": "v0.3.9", + "githubReleasePublishedAt": "2026-10-13T20:16:25Z", "registryUrl": "https://registry.npmjs.org/@augmentworks/cli/0.3.9", - "notes": "Source 0.3.9 ships the AUG-335 hosted run-scope lookup hardening. Fill gitHead, integrity, and verifiedAt after the protected v0.3.9 GitHub release and npm trusted publish. Do not overwrite 0.3.8, 0.3.7, 0.3.6, 0.3.5, 0.3.4, or 0.3.3." + "shasum": "196d1c0eaa59a6c7a89166cdd0991ff1debbb82d", + "tarballSha256": "176e0b6e1ae6e68b98e1ee363568241ac6534ceb5317ebd9f618980ef0efe72b", + "fileCount": 74, + "notes": "Same immutable artifact as lastIndependentlyInspected. The inspection commit is later than the tag and is not inside the tarball. The registry document omitted gitHead. Do not overwrite 0.3.9, 0.3.8, 0.3.7, 0.3.6, 0.3.5, 0.3.4, or 0.3.3." }, "immutableArtifacts": [ { @@ -84,6 +87,16 @@ "tarballSha256": "2849ceb6c3c9b18d02a4cb2aa7f0ad470ec74cb7846a8eadf91d83147965f36e", "fileCount": 74, "notes": "Independently inspected report-consistency patch. Registry metadata omitted gitHead. No SLSA provenance attestation. Do not republish or relabel." + }, + { + "version": "0.3.9", + "gitHead": "9e7919cbfe583cc15701904580be9d36da3bcaf4", + "integrity": "sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==", + "verifiedAt": "2026-10-13T20:31:53.099Z", + "shasum": "196d1c0eaa59a6c7a89166cdd0991ff1debbb82d", + "tarballSha256": "176e0b6e1ae6e68b98e1ee363568241ac6534ceb5317ebd9f618980ef0efe72b", + "fileCount": 74, + "notes": "Independently inspected hosted run-scope lookup patch. Registry metadata omitted gitHead. No SLSA provenance attestation. Do not republish or relabel." } ] } diff --git a/docs/feature-readiness/release-state.md b/docs/feature-readiness/release-state.md index c82f872..c992303 100644 --- a/docs/feature-readiness/release-state.md +++ b/docs/feature-readiness/release-state.md @@ -12,7 +12,7 @@ honestly live inside that same tarball. | Package identity | `package.json`, `src/version.ts`, `CLI_RELEASE` / `schemas/v1/cli-release.json` | This artifact's version, protocol, and whether it is a **published-line release** versus a candidate snapshot. | | Source discovery | `contracts/discovery-manifest.json` | This git checkout. Stays `releaseStatus: development` with `node dist/index.js` commands. Not a live registry status. | | Independently inspected tarball | `LAST_VERIFIED_*` and `docs/feature-readiness/published-registry-evidence.json` | A **prior** (or separately inspected) registry version, keyed by version, gitHead, integrity, and `verifiedAt`. | -| Website pin | Main repository discovery snapshot | Adopted only after independent review of **this** patch. This CLI does not self-adopt. Independently inspected 0.3.8 remains the website pin until 0.3.9 is inspected. Website adoption of that pin is separate. Independently inspected 0.3.7 remains historical and omits the AUG-272 consistency check. Independently inspected 0.3.6 remains historical (capabilities, no saved-suite `/2`). Independently inspected 0.3.5 remains historical and omits suite-selection `capabilities`. Source 0.3.9 is not a registry probe until the protected `v0.3.9` release. Do not fetch `latest`. | +| Website pin | Main repository discovery snapshot | Adopted only after independent review of **this** patch. This CLI does not self-adopt. Independently inspected 0.3.9 is the current registry pin. Website adoption of that pin is separate. Independently inspected 0.3.8 remains historical and includes the AUG-272 consistency check. Independently inspected 0.3.7 remains historical and omits the AUG-272 consistency check. Independently inspected 0.3.6 remains historical (capabilities, no saved-suite `/2`). Independently inspected 0.3.5 remains historical and omits suite-selection `capabilities`. Do not fetch `latest`. | ## `published_package_verified` (`aw-cli-release/0.1`) @@ -20,18 +20,17 @@ honestly live inside that same tarball. candidate. It is **not** proof that this exact tarball was downloaded from npm and inspected. -Independent inspection of `@augmentworks/cli@0.3.8` remains -`lastIndependentlyInspected`. Packaged `LAST_VERIFIED_*` in this checkout names -that artifact (tag `v0.3.8` commit `f36d9086bad1ac109a7670e8acc9bf14a5d15047`, -published `2026-10-08T01:42:45.969Z`). The registry version document omitted -`gitHead`. `thisPackageIdentity` for 0.3.9 stays -`pending-protected-publish` until the trusted npm workflow runs and a later -commit records the downloaded tarball. The immutable 0.3.8 tarball still embeds -the prior 0.3.7 `LAST_VERIFIED_*` snapshot. Do not republish 0.3.8 to bake a -newer receipt in. - -Do not overwrite or relabel existing npm versions, including 0.3.8, 0.3.7, and -0.3.6. +Independent inspection of `@augmentworks/cli@0.3.9` is +`lastIndependentlyInspected` and `thisPackageIdentity` +(`independently-inspected`). Packaged `LAST_VERIFIED_*` in this checkout names +that artifact (tag `v0.3.9` commit `9e7919cbfe583cc15701904580be9d36da3bcaf4`, +published `2026-10-13T20:31:53.099Z`). The registry version document omitted +`gitHead`. The immutable 0.3.9 tarball still embeds the prior 0.3.8 +`LAST_VERIFIED_*` snapshot; this inspection commit is not inside that tarball. +Do not republish 0.3.9 to bake the receipt in. + +Do not overwrite or relabel existing npm versions, including 0.3.9, 0.3.8, and +0.3.7. ## Help and documented pins diff --git a/docs/qa/README.md b/docs/qa/README.md index 77922dc..c365774 100644 --- a/docs/qa/README.md +++ b/docs/qa/README.md @@ -24,9 +24,9 @@ coordinator) should link here. This file does not replace Package identity of a checkout is `package.json` (currently `0.3.9`). That version string alone is not registry proof. The last independently inspected -npm tarball recorded in-tree is `@augmentworks/cli@0.3.8` in -`docs/feature-readiness/published-registry-evidence.json` (tag `v0.3.8` -commit `f36d9086bad1ac109a7670e8acc9bf14a5d15047`; the registry document +npm tarball recorded in-tree is `@augmentworks/cli@0.3.9` in +`docs/feature-readiness/published-registry-evidence.json` (tag `v0.3.9` +commit `9e7919cbfe583cc15701904580be9d36da3bcaf4`; the registry document omitted `gitHead`). Confirm with `npm view` before treating a pin as installed. Never run `npx @augmentworks/cli@latest`. `npx --yes` only skips the npm prompt; it is not a spending ceiling. @@ -196,10 +196,9 @@ is not a normal offline check). Independently inspect registry identity with `npm view` and compare `gitHead` / `dist.integrity` / tarball SHA-256 to -`docs/feature-readiness/published-registry-evidence.json`. npm `0.3.8` -is independently inspected. Source `0.3.9` stays `pending-protected-publish` -until the `v0.3.9` tarball is inspected. That gap is not a local-runner -pass, and the 0.3.8 receipt is not inside the published tarball. +`docs/feature-readiness/published-registry-evidence.json`. npm `0.3.9` +is independently inspected. That receipt is not a substitute for a local-runner +pass, and it is not inside the published tarball. Customer-facing `init` next steps on an npm install must not tell the user to run `node dist/index.js` from an empty project. diff --git a/schemas/v1/cli-release.json b/schemas/v1/cli-release.json index 4da9a58..673473b 100644 --- a/schemas/v1/cli-release.json +++ b/schemas/v1/cli-release.json @@ -15,5 +15,5 @@ "protocol_version": "aw-relay/0.1", "target_protocol_version": "aw-target/0.1", "config_version": 1, - "notes": "Published-line 0.3.9 hardens hosted run-scope lookup: synthetic runs do not request an execution scope, looked-up scopes use the same usability checks as the pinned path, and non-JSON error pages keep their HTTP status instead of crashing as invalid JSON (AUG-335). It keeps the 0.3.8 report consistency check (AUG-272) and the dev-only source-map-js audit refresh (AUG-273), plus the saved-suite customer path: native aw-customer-suite/1 upload translation, saved-suite v2 binding, authoritative v2 whole-suite gate receipts, durable execution IDs, cross-shard quote/run uniqueness, and non-destructive generated .env guidance. Generated and documented npx commands pin this package version (0.3.9). published_package_verified is published-line identity (not a candidate), not a live registry probe of this exact tarball. Independent inspection of npm @augmentworks/cli@0.3.8 (tag v0.3.8 commit f36d9086bad1ac109a7670e8acc9bf14a5d15047, integrity sha512-T+e1VWQ8plx0jJMdkOHxocpH8SjCr9BSeRLMsCnCHAO0Z3z9bhgIf0um9x6eyWJfwPz01YOL7CZvM6sLTiSLIA==, shasum 009bc1739654c704b75967214ef9604374bd9a92, published 2026-10-08T01:42:45.969Z, tarball SHA-256 2849ceb6c3c9b18d02a4cb2aa7f0ad470ec74cb7846a8eadf91d83147965f36e) is recorded in docs/feature-readiness/published-registry-evidence.json. The registry version document omitted gitHead. The published 0.3.8 tarball still embeds the prior LAST_VERIFIED 0.3.7 snapshot; this 0.3.9 artifact does not overwrite it. Do not overwrite or relabel immutable npm 0.3.8, 0.3.7 (gitHead 876454878a31a897aec1d722fa838c9c0ecea2aa), 0.3.6 (gitHead a9b927a2413305003f817c20e9c5df277512f83e), 0.3.5, 0.3.4, or 0.3.3. Website adoption of the inspected 0.3.8 pin remains separate until a later inspection of this patch. Do not fetch latest. Vendors aw-billing/1 from main 650472d91442a6866a7b6ef18e6dacc23a2a9260 including subscriptions_v1. The CLI does not subscribe, cancel, or collect payment methods. Live subscription sales stay gated on the server. Catalog list/show and selection compile consume aw-coverage-catalog/1 and aw-suite-selection/1 without a local compiler or pricing engine. Saved-suite compiles request aw-suite-selection/2. Do not run @latest." + "notes": "Published-line 0.3.9 hardens hosted run-scope lookup: synthetic runs do not request an execution scope, looked-up scopes use the same usability checks as the pinned path, and non-JSON error pages keep their HTTP status instead of crashing as invalid JSON (AUG-335). It keeps the 0.3.8 report consistency check (AUG-272) and the dev-only source-map-js audit refresh (AUG-273), plus the saved-suite customer path: native aw-customer-suite/1 upload translation, saved-suite v2 binding, authoritative v2 whole-suite gate receipts, durable execution IDs, cross-shard quote/run uniqueness, and non-destructive generated .env guidance. Generated and documented npx commands pin this package version (0.3.9). published_package_verified is published-line identity (not a candidate), not a live registry probe of this exact tarball. Independent inspection of npm @augmentworks/cli@0.3.9 (tag v0.3.9 commit 9e7919cbfe583cc15701904580be9d36da3bcaf4, integrity sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==, shasum 196d1c0eaa59a6c7a89166cdd0991ff1debbb82d, published 2026-10-13T20:31:53.099Z, tarball SHA-256 176e0b6e1ae6e68b98e1ee363568241ac6534ceb5317ebd9f618980ef0efe72b) is recorded in docs/feature-readiness/published-registry-evidence.json. The registry version document omitted gitHead. The published 0.3.9 tarball still embeds the prior LAST_VERIFIED 0.3.8 snapshot; this inspection commit is not inside that immutable artifact. Do not overwrite or relabel immutable npm 0.3.9, 0.3.8 (gitHead f36d9086bad1ac109a7670e8acc9bf14a5d15047), 0.3.7 (gitHead 876454878a31a897aec1d722fa838c9c0ecea2aa), 0.3.6 (gitHead a9b927a2413305003f817c20e9c5df277512f83e), 0.3.5, 0.3.4, or 0.3.3. Website adoption remains a separate pin. Do not fetch latest. Vendors aw-billing/1 from main 650472d91442a6866a7b6ef18e6dacc23a2a9260 including subscriptions_v1. The CLI does not subscribe, cancel, or collect payment methods. Live subscription sales stay gated on the server. Catalog list/show and selection compile consume aw-coverage-catalog/1 and aw-suite-selection/1 without a local compiler or pricing engine. Saved-suite compiles request aw-suite-selection/2. Do not run @latest." } diff --git a/scripts/check-discovery-manifest.mjs b/scripts/check-discovery-manifest.mjs index 40f988e..f27745e 100644 --- a/scripts/check-discovery-manifest.mjs +++ b/scripts/check-discovery-manifest.mjs @@ -29,9 +29,9 @@ if (!published.ok) { if (!LAST_VERIFIED_PUBLISHED_DISCOVERY.capabilities.localDemo) { throw new Error("The last independently inspected published snapshot must advertise localDemo."); } -if (LAST_VERIFIED_PUBLISHED_DISCOVERY.package.version !== "0.3.8") { +if (LAST_VERIFIED_PUBLISHED_DISCOVERY.package.version !== "0.3.9") { throw new Error( - "The last independently inspected published snapshot must remain 0.3.8 until a later registry tarball is inspected. Do not relabel 0.3.8, 0.3.7, 0.3.6, 0.3.5, 0.3.4, or 0.3.3 provenance." + "The last independently inspected published snapshot must remain 0.3.9. Do not relabel 0.3.9, 0.3.8, 0.3.7, 0.3.6, 0.3.5, 0.3.4, or 0.3.3 provenance." ); } if (committed.package.releaseStatus === "published") { diff --git a/src/release.ts b/src/release.ts index f127847..a4386ed 100644 --- a/src/release.ts +++ b/src/release.ts @@ -31,11 +31,11 @@ export const PUBLISHED_PACKAGE_VERIFIED = true; * registry artifact, not a live probe baked into that same tarball. * Do not relabel 0.3.7, 0.3.6, 0.3.5, 0.3.4, 0.3.3, or 0.3.2 provenance. */ -export const LAST_VERIFIED_PUBLISHED_PACKAGE_VERSION = "0.3.8"; -export const LAST_VERIFIED_PUBLISHED_GIT_HEAD = "f36d9086bad1ac109a7670e8acc9bf14a5d15047"; -export const LAST_VERIFIED_PUBLISHED_AT = "2026-10-08T01:42:45.969Z"; +export const LAST_VERIFIED_PUBLISHED_PACKAGE_VERSION = "0.3.9"; +export const LAST_VERIFIED_PUBLISHED_GIT_HEAD = "9e7919cbfe583cc15701904580be9d36da3bcaf4"; +export const LAST_VERIFIED_PUBLISHED_AT = "2026-10-13T20:31:53.099Z"; export const LAST_VERIFIED_PUBLISHED_INTEGRITY = - "sha512-T+e1VWQ8plx0jJMdkOHxocpH8SjCr9BSeRLMsCnCHAO0Z3z9bhgIf0um9x6eyWJfwPz01YOL7CZvM6sLTiSLIA=="; + "sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA=="; /** Immutable npm 0.3.3 (not this release). Do not overwrite or relabel. */ export const REGISTRY_0_3_3_GIT_HEAD = "4a08ea0d352f2515e725cb9ca946807112422436"; /** Immutable npm 0.3.4 (not this release). Do not overwrite or relabel. */ @@ -94,7 +94,7 @@ export const CLI_RELEASE: CliReleaseFixture = { target_protocol_version: TARGET_PROTOCOL_VERSION, config_version: CONFIG_VERSION, notes: - "Published-line 0.3.9 hardens hosted run-scope lookup: synthetic runs do not request an execution scope, looked-up scopes use the same usability checks as the pinned path, and non-JSON error pages keep their HTTP status instead of crashing as invalid JSON (AUG-335). It keeps the 0.3.8 report consistency check (AUG-272) and the dev-only source-map-js audit refresh (AUG-273), plus the saved-suite customer path: native aw-customer-suite/1 upload translation, saved-suite v2 binding, authoritative v2 whole-suite gate receipts, durable execution IDs, cross-shard quote/run uniqueness, and non-destructive generated .env guidance. Generated and documented npx commands pin this package version (0.3.9). published_package_verified is published-line identity (not a candidate), not a live registry probe of this exact tarball. Independent inspection of npm @augmentworks/cli@0.3.8 (tag v0.3.8 commit f36d9086bad1ac109a7670e8acc9bf14a5d15047, integrity sha512-T+e1VWQ8plx0jJMdkOHxocpH8SjCr9BSeRLMsCnCHAO0Z3z9bhgIf0um9x6eyWJfwPz01YOL7CZvM6sLTiSLIA==, shasum 009bc1739654c704b75967214ef9604374bd9a92, published 2026-10-08T01:42:45.969Z, tarball SHA-256 2849ceb6c3c9b18d02a4cb2aa7f0ad470ec74cb7846a8eadf91d83147965f36e) is recorded in docs/feature-readiness/published-registry-evidence.json. The registry version document omitted gitHead. The published 0.3.8 tarball still embeds the prior LAST_VERIFIED 0.3.7 snapshot; this 0.3.9 artifact does not overwrite it. Do not overwrite or relabel immutable npm 0.3.8, 0.3.7 (gitHead 876454878a31a897aec1d722fa838c9c0ecea2aa), 0.3.6 (gitHead a9b927a2413305003f817c20e9c5df277512f83e), 0.3.5, 0.3.4, or 0.3.3. Website adoption of the inspected 0.3.8 pin remains separate until a later inspection of this patch. Do not fetch latest. Vendors aw-billing/1 from main 650472d91442a6866a7b6ef18e6dacc23a2a9260 including subscriptions_v1. The CLI does not subscribe, cancel, or collect payment methods. Live subscription sales stay gated on the server. Catalog list/show and selection compile consume aw-coverage-catalog/1 and aw-suite-selection/1 without a local compiler or pricing engine. Saved-suite compiles request aw-suite-selection/2. Do not run @latest." + "Published-line 0.3.9 hardens hosted run-scope lookup: synthetic runs do not request an execution scope, looked-up scopes use the same usability checks as the pinned path, and non-JSON error pages keep their HTTP status instead of crashing as invalid JSON (AUG-335). It keeps the 0.3.8 report consistency check (AUG-272) and the dev-only source-map-js audit refresh (AUG-273), plus the saved-suite customer path: native aw-customer-suite/1 upload translation, saved-suite v2 binding, authoritative v2 whole-suite gate receipts, durable execution IDs, cross-shard quote/run uniqueness, and non-destructive generated .env guidance. Generated and documented npx commands pin this package version (0.3.9). published_package_verified is published-line identity (not a candidate), not a live registry probe of this exact tarball. Independent inspection of npm @augmentworks/cli@0.3.9 (tag v0.3.9 commit 9e7919cbfe583cc15701904580be9d36da3bcaf4, integrity sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==, shasum 196d1c0eaa59a6c7a89166cdd0991ff1debbb82d, published 2026-10-13T20:31:53.099Z, tarball SHA-256 176e0b6e1ae6e68b98e1ee363568241ac6534ceb5317ebd9f618980ef0efe72b) is recorded in docs/feature-readiness/published-registry-evidence.json. The registry version document omitted gitHead. The published 0.3.9 tarball still embeds the prior LAST_VERIFIED 0.3.8 snapshot; this inspection commit is not inside that immutable artifact. Do not overwrite or relabel immutable npm 0.3.9, 0.3.8 (gitHead f36d9086bad1ac109a7670e8acc9bf14a5d15047), 0.3.7 (gitHead 876454878a31a897aec1d722fa838c9c0ecea2aa), 0.3.6 (gitHead a9b927a2413305003f817c20e9c5df277512f83e), 0.3.5, 0.3.4, or 0.3.3. Website adoption remains a separate pin. Do not fetch latest. Vendors aw-billing/1 from main 650472d91442a6866a7b6ef18e6dacc23a2a9260 including subscriptions_v1. The CLI does not subscribe, cancel, or collect payment methods. Live subscription sales stay gated on the server. Catalog list/show and selection compile consume aw-coverage-catalog/1 and aw-suite-selection/1 without a local compiler or pricing engine. Saved-suite compiles request aw-suite-selection/2. Do not run @latest." }; export function formatNpx(pin: string, argv: readonly string[]): string { diff --git a/test/discovery/manifest.test.ts b/test/discovery/manifest.test.ts index 030be7f..4bb3b10 100644 --- a/test/discovery/manifest.test.ts +++ b/test/discovery/manifest.test.ts @@ -31,23 +31,23 @@ describe("discovery manifest", () => { } }); - it("keeps the last independently inspected published 0.3.8 snapshot with demo", () => { + it("keeps the last independently inspected published 0.3.9 snapshot with demo", () => { const parsed = parseDiscoveryManifest(LAST_VERIFIED_PUBLISHED_DISCOVERY); expect(parsed.ok).toBe(true); - expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.package.version).toBe("0.3.8"); + expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.package.version).toBe("0.3.9"); expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.package.releaseStatus).toBe("published"); expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.capabilities.localDemo).toBe(true); expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.commands.localDemo).toEqual([ "npx", "--yes", - "@augmentworks/cli@0.3.8", + "@augmentworks/cli@0.3.9", "demo" ]); expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.provenance.verifiedAt).toBe( - "2026-10-08T01:42:45.969Z" + "2026-10-13T20:31:53.099Z" ); expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.provenance.sourceCommit).toBe( - "f36d9086bad1ac109a7670e8acc9bf14a5d15047" + "9e7919cbfe583cc15701904580be9d36da3bcaf4" ); }); @@ -101,7 +101,7 @@ describe("discovery manifest", () => { expect(source.package.releaseStatus).toBe("development"); expect(source.provenance.verifiedAt).toBeNull(); expect(source.provenance.sourceCommit).toBeNull(); - expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.package.version).toBe("0.3.8"); + expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.package.version).toBe("0.3.9"); expect(LAST_VERIFIED_PUBLISHED_DISCOVERY.capabilities.localDemo).toBe(true); expect(source.capabilities.localDemo).toBe(true); }); diff --git a/test/first-dollar-registry-acceptance.test.ts b/test/first-dollar-registry-acceptance.test.ts index ae2be7b..20c5022 100644 --- a/test/first-dollar-registry-acceptance.test.ts +++ b/test/first-dollar-registry-acceptance.test.ts @@ -105,14 +105,14 @@ describe("first-dollar registry acceptance handoff", () => { ); expect(PUBLISHED_PACKAGE_VERIFIED).toBe(true); - expect(LAST_VERIFIED_PUBLISHED_PACKAGE_VERSION).toBe("0.3.8"); + expect(LAST_VERIFIED_PUBLISHED_PACKAGE_VERSION).toBe("0.3.9"); expect(LAST_VERIFIED_PUBLISHED_GIT_HEAD).toBe( - "f36d9086bad1ac109a7670e8acc9bf14a5d15047" + "9e7919cbfe583cc15701904580be9d36da3bcaf4" ); expect(LAST_VERIFIED_PUBLISHED_INTEGRITY).toBe( - "sha512-T+e1VWQ8plx0jJMdkOHxocpH8SjCr9BSeRLMsCnCHAO0Z3z9bhgIf0um9x6eyWJfwPz01YOL7CZvM6sLTiSLIA==" + "sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==" ); - expect(LAST_VERIFIED_PUBLISHED_AT).toBe("2026-10-08T01:42:45.969Z"); + expect(LAST_VERIFIED_PUBLISHED_AT).toBe("2026-10-13T20:31:53.099Z"); expect(REGISTRY_0_3_3_GIT_HEAD).toBe("4a08ea0d352f2515e725cb9ca946807112422436"); expect(registryIdentity?.status).toBe("pass"); expect(evidence.cli.gitHead).not.toBeNull(); @@ -126,27 +126,32 @@ describe("first-dollar registry acceptance handoff", () => { }); describe("published registry evidence record", () => { - it("keeps this package identity separate from last independently inspected 0.3.8", async () => { + it("records independently inspected 0.3.9 without relabeling 0.3.8", async () => { const record = JSON.parse(await readFile(registryEvidenceUrl, "utf8")) as PublishedRegistryEvidence & { immutableArtifacts: Array<{ version: string; gitHead: string }>; }; expect(record.schemaVersion).toBe("aw-cli-registry-evidence/1"); - expect(record.lastIndependentlyInspected.version).toBe("0.3.8"); + expect(record.lastIndependentlyInspected.version).toBe("0.3.9"); expect(record.lastIndependentlyInspected.gitHead).toBe( - "f36d9086bad1ac109a7670e8acc9bf14a5d15047" + "9e7919cbfe583cc15701904580be9d36da3bcaf4" ); expect(record.lastIndependentlyInspected.integrity).toBe( - "sha512-T+e1VWQ8plx0jJMdkOHxocpH8SjCr9BSeRLMsCnCHAO0Z3z9bhgIf0um9x6eyWJfwPz01YOL7CZvM6sLTiSLIA==" + "sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==" ); - expect(record.lastIndependentlyInspected.verifiedAt).toBe("2026-10-08T01:42:45.969Z"); + expect(record.lastIndependentlyInspected.verifiedAt).toBe("2026-10-13T20:31:53.099Z"); expect(record.thisPackageIdentity.version).toBe(SOURCE_PACKAGE_VERSION); expect(record.thisPackageIdentity.version).toBe("0.3.9"); - expect(record.thisPackageIdentity.gitHead).toBeNull(); - expect(record.thisPackageIdentity.integrity).toBeNull(); - expect(record.thisPackageIdentity.verifiedAt).toBeNull(); - expect(record.thisPackageIdentity.status).toBe("pending-protected-publish"); - expect(record.thisPackageIdentity.version).not.toBe(record.lastIndependentlyInspected.version); + expect(record.thisPackageIdentity.gitHead).toBe("9e7919cbfe583cc15701904580be9d36da3bcaf4"); + expect(record.thisPackageIdentity.integrity).toBe( + "sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==" + ); + expect(record.thisPackageIdentity.verifiedAt).toBe("2026-10-13T20:31:53.099Z"); + expect(record.thisPackageIdentity.status).toBe("independently-inspected"); + expect(record.thisPackageIdentity.version).toBe(record.lastIndependentlyInspected.version); + expect(record.immutableArtifacts.find((artifact) => artifact.version === "0.3.9")?.gitHead).toBe( + "9e7919cbfe583cc15701904580be9d36da3bcaf4" + ); expect(record.immutableArtifacts.find((artifact) => artifact.version === "0.3.8")?.gitHead).toBe( "f36d9086bad1ac109a7670e8acc9bf14a5d15047" ); diff --git a/test/release.test.ts b/test/release.test.ts index ce925ef..7f0be34 100644 --- a/test/release.test.ts +++ b/test/release.test.ts @@ -67,11 +67,11 @@ describe("CLI release metadata", () => { it("exposes published-line identity without baking a stale last-verified 0.3.2 result", () => { expect(PUBLISHED_PACKAGE_VERIFIED).toBe(true); expect(CLI_RELEASE.published_package_verified).toBe(true); - expect(LAST_VERIFIED_PUBLISHED_PACKAGE_VERSION).toBe("0.3.8"); - expect(LAST_VERIFIED_PUBLISHED_GIT_HEAD).toBe("f36d9086bad1ac109a7670e8acc9bf14a5d15047"); - expect(LAST_VERIFIED_PUBLISHED_AT).toBe("2026-10-08T01:42:45.969Z"); + expect(LAST_VERIFIED_PUBLISHED_PACKAGE_VERSION).toBe("0.3.9"); + expect(LAST_VERIFIED_PUBLISHED_GIT_HEAD).toBe("9e7919cbfe583cc15701904580be9d36da3bcaf4"); + expect(LAST_VERIFIED_PUBLISHED_AT).toBe("2026-10-13T20:31:53.099Z"); expect(LAST_VERIFIED_PUBLISHED_INTEGRITY).toBe( - "sha512-T+e1VWQ8plx0jJMdkOHxocpH8SjCr9BSeRLMsCnCHAO0Z3z9bhgIf0um9x6eyWJfwPz01YOL7CZvM6sLTiSLIA==" + "sha512-ZDXMg5etb3UNGGrakJ5Iz+oYAkAOHqOt2DIVn41MvFnLjmlz/AIUL05pYGJHnDISo1At5Cik6Kjkses4hB4CYA==" ); expect(REGISTRY_0_3_3_GIT_HEAD).toBe("4a08ea0d352f2515e725cb9ca946807112422436"); expect(REGISTRY_0_3_6_GIT_HEAD).toBe("a9b927a2413305003f817c20e9c5df277512f83e");