Document topic branch lifecycle

[tensornull]

Summary

• Document the required short-lived topic branch workflow.
• Define fail-closed fast-forward cleanup back to a clean dev branch.
• Keep the repository lifecycle instructions standalone and aligned with the Public Preview authorization boundary.

Verification

• git diff --check passed.
• npx prettier --check AGENTS.md passed.
• npm run format:check passed.
• npm run lint passed.
• npm run typecheck passed.
• npm test passed: 11 files, 177 tests.
• npm run test:secrets passed.
• npm run check:standalone-content passed.
• npm run check:public-preview passed.
• npm run check:self-contained passed from clean committed HEAD, including isolated offline verification, package and fixture checks, locked compatibility, and actionlint 1.7.12.

Checklist

• The change is within the current roadmap milestone.
• Public behavior, compatibility claims, and examples are documented or unaffected.
• Unit, mocked contract, type, lint, format, build, and package checks pass as applicable.
• Packed ESM, CommonJS, and compatible-OpenAI host fixtures pass as applicable.
• No credential, private prompt, customer data, generated build output, or local dependency directory is included.
• Workflow edits pass the repository-pinned actionlint version; no workflows changed.
• Remote Actions, live API, and registry evidence are not claimed from local validation.

[tensornull]

Final private pre-visibility evidence - 2026-07-23

Scope: Public Preview pre-visibility closeout only. This evidence was collected while the repository remained private. It does not claim Public Preview readiness. No public-only configuration, live CometAPI request, release, or registry action was authorized or performed.

Exact final state

• Merged private PR: Document topic branch lifecycle #14
• PR head: d95088c2156fe3c441089719ae983cbe0539151c
• Squash-merged final private main: d9eabf3fef7746c252a4ff437373d0837b860c52
• After fetching origin, local main was fast-forwarded to origin/main, local dev was fast-forwarded to main, and the checkout finished on a clean dev.
• Local HEAD, main, dev, and origin/main all resolved to d9eabf3fef7746c252a4ff437373d0837b860c52.

Local verification on exact final commit

Environment: Node.js v24.15.0, npm 11.12.1, macOS 27.0.

All required commands passed: npm ci, npm run build, npm test, npm run typecheck, npm run lint, npm run format:check, npm run test:secrets, npm run test:package, npm run test:live-contract, npm run test:fixtures, npm run test:compat, npm run check:standalone-content, npm run check:self-contained, npm run check:public-preview, npm run actionlint, and npm run verify.

• Vitest: 11 files and 177 tests passed.
• Secret scanning passed without printing candidate values; standalone content passed for every reachable Git tree.
• The Public Preview content and identity gate and the mocked live-smoke semantic contract passed.
• Package validation passed publint and Are the Types Wrong; the local packed 0.1.0-alpha.1 tarball was reported as 5,820 bytes and had the expected ESM, CommonJS, and declaration exports.
• Clean packed-artifact fixtures passed for ESM, CommonJS, and a compatible OpenAI host with one effective OpenAI installation and preserved error identity.
• Compatibility passed OpenAI 6.47.0 minimum, 6.47.0 locked, and 6.48.0 latest within major.
• actionlint 1.7.12 validated all four workflows.
• The exact raw HEAD tree passed isolated npm ci, offline verification, package and fixture checks, locked compatibility, and actionlint in an empty temporary parent.
• Aggregate npm run verify exited 0.
• npm audit --omit=dev reported zero production vulnerabilities.
• The full development audit reported one low-severity transitive esbuild@0.27.7 Windows development-server advisory, GHSA-g7r4-m6w7-qqqr. npm reported fixAvailable: true, while npm audit fix --dry-run --json proposed zero added, changed, or removed packages and still reported the advisory. A tracked scripts and source search found no esbuild serve path, so this remains a low-severity non-production residual risk rather than a claim about every possible external environment.

Credential-free GitHub Actions evidence

• PR run: https://github.com/cometapi-dev/cometapi-node/actions/runs/29978222639
• PR Node.js 22: https://github.com/cometapi-dev/cometapi-node/actions/runs/29978222639/job/89114400736
• PR Node.js 24: https://github.com/cometapi-dev/cometapi-node/actions/runs/29978222639/job/89114400694
• Final main run: https://github.com/cometapi-dev/cometapi-node/actions/runs/29978293416
• Final main Node.js 22: https://github.com/cometapi-dev/cometapi-node/actions/runs/29978293416/job/89114614450
• Final main Node.js 24: https://github.com/cometapi-dev/cometapi-node/actions/runs/29978293416/job/89114614455

Both runs passed static workflow validation, blocking Node.js 22 and 24, minimum OpenAI, Node.js 26 advisory, and standalone-repository jobs. The latest-OpenAI canary was correctly skipped for these non-Dependabot runs; local compatibility separately verified OpenAI 6.48.0.

Dependency-update dispositions

• PR build(deps): bump openai from 6.47.0 to 6.48.0 in the production-dependencies group #6 was closed unmerged because it raised the supported OpenAI lower-bound contract from ^6.47.0 to ^6.48.0; the branch-specific failures and disposition are recorded at build(deps): bump openai from 6.47.0 to 6.48.0 in the production-dependencies group #6 (comment).
• PR build(deps-dev): bump the development-dependencies group with 5 updates #7 was closed unmerged because TypeScript 7 conflicted with the current typescript-eslint peer range and the grouped Node 26 and tooling majors require separate compatibility review; the branch-specific failures and disposition are recorded at build(deps-dev): bump the development-dependencies group with 5 updates #7 (comment).
• No open failing dependency-update PR remained at audit time. PRs chore(deps): bump googleapis/release-please-action from 4.3.0 to 5.0.0 #1 through chore(deps): bump actions/checkout from 6.0.3 to 7.0.1 #5 were open, mergeable and clean, and had green check rollups; their branch checks predate this final main. PRs chore(deps): bump googleapis/release-please-action from 4.3.0 to 5.0.0 #1, chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 #3, and chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 #4 affect release or publish paths that have not executed remotely, so their green credential-free CI is not treated as full release-path compatibility evidence. They remain open and are not Public Preview pre-visibility blockers.

Read-only remote audit

• Repository: PRIVATE; default branch main at d9eabf3fef7746c252a4ff437373d0837b860c52.
• main reports unprotected; GraphQL and REST inspection found zero branch-protection rules and zero repository rulesets.
• Repository environments: 0. Repository Actions secrets: 0. Repository Actions variables: 0. Repository Dependabot secrets: 0.
• Immutable releases reported disabled. Tags: 0. GitHub releases: 0. Publish workflow runs: 0.
• Live smoke has only two retained scheduled runs, both skipped with no steps. Release Please was skipped for the final-main push because its enable condition was false or missing.
• Public npm registry lookup for cometapi returned 404. This is only evidence that no public package was observable through that lookup.

Skipped, unknown, and unchanged boundaries

• Protected live smoke was not authorized, configured, or run. No COMETAPI_KEY was used and no live CometAPI request was made.
• npm Trusted Publisher configuration is not publicly enumerable and remains unknown; workflow OIDC wiring alone is not evidence of registration.
• Organization-level inherited Actions or Dependabot secrets and variables remain unknown because the available GitHub access cannot enumerate all inherited organization state.
• Private Vulnerability Reporting returned 404. This records no readable enabled evidence, not a definitive disabled-state claim.
• Retained API state cannot rule out deleted historical tags, releases, or workflow runs without organization audit-log access.
• No repository visibility, branch or tag rule, environment, secret, live API, tag, release, npm publication, dist-tag, provenance, or registry state was changed. Only the authorized private topic branch, pull request, credential-free CI, squash merge, and this evidence comment were performed.

All currently executable pre-visibility work is complete at this evidence boundary. Stop before repository visibility changes or any public-only, protected-live, release, or registry action pending explicit maintainer authorization.