From b841a4287d409c7d9a226bdb4be304bde267db3f Mon Sep 17 00:00:00 2001 From: CometAPI Date: Wed, 29 Jul 2026 15:42:05 +0800 Subject: [PATCH] docs: record 0.1.1 release evidence --- AGENTS.md | 27 ++++++++++++----- ARCHITECTURE.md | 10 +++++++ CHANGELOG.md | 5 ++++ README.md | 7 ++--- RELEASING.md | 51 ++++++++++++++++++++++++++++++-- ROADMAP.md | 78 ++++++++++++++++++++++++++++++++++++++++++------- 6 files changed, 154 insertions(+), 24 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 806d9c3..896b528 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -50,9 +50,10 @@ proves only its own evidence layer. Never invent or mock missing evidence. ## Current milestone: Stable 0.1 -Stable 0.1 is complete: `cometapi==0.1.0` is publicly available and its release -and registry trust chain has been verified. Do not begin 0.2 provider adapters -without a separate maintainer request that authorizes that milestone. +Stable 0.1 is complete: `cometapi==0.1.1` is the latest publicly available +maintenance release, and its release and registry trust chain has been +verified. Do not begin 0.2 provider adapters without a separate maintainer +request that authorizes that milestone. Private Remote Validation, the sanitized first history, private initialization, pre-visibility closeout, public visibility configuration, Public Preview, @@ -62,7 +63,19 @@ and version-tag rules, Private Vulnerability Reporting, immutable releases, protected environments, public default-branch CI, and protected release and registry evidence. -The accepted stable release evidence is: +The accepted `0.1.1` maintenance release evidence is: + +| Field | Value | +| --- | --- | +| Release commit and tag target | `576e7503a0a8c1103faca5143e4b8d576f8e8b44` | +| Release tag | `v0.1.1` | +| GitHub release | `https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.1` | +| Release workflow | `https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821548` | +| PyPI release | `https://pypi.org/project/cometapi/0.1.1/` | +| Wheel SHA256 | `27e7904542f82fbbcd60e0de23a4a62c042420b6d004d00286d1f37d2ec4c5e5` | +| Source SHA256 | `64c7cb87745032703b3374cc562ea00b979416c54908862dbcebd116b2dc44c8` | + +The accepted `0.1.0` stable release evidence is: | Field | Value | | --- | --- | @@ -154,9 +167,9 @@ Post-stable invariants: ## Product contract -The PyPI package name is `cometapi`. Version `0.1.0` exports only the public -clients `CometAPI` and `AsyncCometAPI`; `CometClient` and `AsyncCometClient` -must not exist as aliases. +The PyPI package name is `cometapi`. The supported 0.1 line exports only the +public clients `CometAPI` and `AsyncCometAPI`; `CometClient` and +`AsyncCometClient` must not exist as aliases. The supported 0.1 operations are: diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 228cce3..c834ac5 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -144,6 +144,16 @@ top-level OIDC publication, public digest and provenance comparison, and clean registry install all passed. The selector-descendant conditions were therefore verified in GitHub's hosted scheduler, not only by local static checks. +The same trust chain completed for maintenance release `0.1.1` in +[release workflow run 30429821548](https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821548). +The immutable `v0.1.1` tag resolves to release commit +`576e7503a0a8c1103faca5143e4b8d576f8e8b44`; exact-release live smoke, direct +top-level OIDC publication, public digest and provenance comparison, and clean +registry installation all passed. The public wheel SHA256 is +`27e7904542f82fbbcd60e0de23a4a62c042420b6d004d00286d1f37d2ec4c5e5`, and the +source-distribution SHA256 is +`64c7cb87745032703b3374cc562ea00b979416c54908862dbcebd116b2dc44c8`. + The scheduled/manual default-branch smoke is an operational canary only; it does not prove the release commit. `COMETAPI_KEY` is exposed only to the protected exact-release live job. OIDC permission is exposed only to the diff --git a/CHANGELOG.md b/CHANGELOG.md index c09bf93..89457a2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,11 @@ automation. ## [Unreleased] +### Documentation + +- Record completed `0.1.1` publication, live, provenance, digest, and + public-registry verification evidence. + ## [0.1.1] - 2026-07-29 ### Bug Fixes diff --git a/README.md b/README.md index 17c7c9a..d5f387b 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # CometAPI Python SDK -> **Stable release:** `0.1.1` is approved for PyPI publication. +> **Stable release:** `0.1.1` is available from PyPI. `cometapi` is a thin Python adapter over the official OpenAI SDK for the OpenAI-compatible CometAPI endpoint. It changes the default API key and base @@ -29,14 +29,13 @@ Project links: [CometAPI](https://www.cometapi.com), ## Installation -After the protected publication workflow and public-registry verification -succeed, install the stable release from PyPI with: +Install the independently verified stable release from PyPI with: ```bash python -m pip install 'cometapi==0.1.1' ``` -After those gates succeed, the immutable +The immutable [GitHub release](https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.1) and exact [PyPI release](https://pypi.org/project/cometapi/0.1.1/) record the published artifact. diff --git a/RELEASING.md b/RELEASING.md index d3b82bd..a98d0ad 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -413,7 +413,7 @@ and requires all of its direct dependencies to succeed. A further recovery remained blocked until that fix reached `main` and a new recovery was explicitly authorized. -### Completed stable release evidence +### Completed `0.1.0` stable release evidence - The immutable non-draft [GitHub release](https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.0) and lightweight tag `v0.1.0` resolve to release commit @@ -439,5 +439,50 @@ authorized. installed `cometapi==0.1.0`, verified the public imports and version, and passed all README mocked-call examples. - `RELEASE_RECOVERY_TAG` and `RELEASE_RECOVERY_SHA` were deleted immediately - after recovery identity verification. `LIVE_SMOKE_ENABLED=false` is the only - remaining release-related repository variable. + after recovery identity verification. At that closeout, + `LIVE_SMOKE_ENABLED=false` was the only remaining release-related repository + variable. + +### Completed `0.1.1` maintenance release evidence + +- Configuration fix [PR #25](https://github.com/cometapi-dev/cometapi-python/pull/25) + passed [pull-request CI run 30419881169](https://github.com/cometapi-dev/cometapi-python/actions/runs/30419881169) + and squash-merged as `d02b1dba277ac72229b772d29ea1870b569edd88`. +- The first + [Release Please run 30420057230](https://github.com/cometapi-dev/cometapi-python/actions/runs/30420057230) + failed before creating a pull request because the repository had not enabled + GitHub Actions pull-request creation. It created no tag, release, live + request, or PyPI file. The repository-level permission was restored without + changing the read-only default workflow permission, and + [PR #26](https://github.com/cometapi-dev/cometapi-python/pull/26) + recorded the required preflight as + `18de120c79b5a4fde5d125d56238f7f3b28e69bf`. +- Fresh [Release Please run 30423490399](https://github.com/cometapi-dev/cometapi-python/actions/runs/30423490399) + created [release PR #27](https://github.com/cometapi-dev/cometapi-python/pull/27). + Its final head `7d24b4079b232c6c5e9b09b3d182ded230840ea8` passed + [all required CI in run 30424732041](https://github.com/cometapi-dev/cometapi-python/actions/runs/30424732041), + received human owner approval at that exact head, and squash-merged as + `576e7503a0a8c1103faca5143e4b8d576f8e8b44`. The release commit passed + [default-branch CI run 30429821579](https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821579). +- First-attempt [release run 30429821548](https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821548) + created and verified immutable non-draft release + [v0.1.1](https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.1) + at the exact release commit, rebuilt and clean-installed both artifacts, + passed the four-request exact-release live suite, received protected `pypi` + approval, published directly from top-level `publish.yml` by OIDC with + attestations, and passed public registry verification. +- The exact [PyPI release](https://pypi.org/project/cometapi/0.1.1/) has wheel + SHA256 `27e7904542f82fbbcd60e0de23a4a62c042420b6d004d00286d1f37d2ec4c5e5` + and source-distribution SHA256 + `64c7cb87745032703b3374cc562ea00b979416c54908862dbcebd116b2dc44c8`. + Both files match the retained pre-publication digest record. PyPI Integrity + API provenance identifies repository `cometapi-dev/cometapi-python`, workflow + `publish.yml`, environment `pypi`, release commit `576e7503`, and release + [run attempt 1](https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821548/attempts/1). +- An independent post-workflow verification downloaded both public files, + verified both provenance records with `pypi-attestations==0.0.29`, installed + `cometapi==0.1.1` from `https://pypi.org/simple/`, verified the public version + and imports, and passed supported mocked calls plus all README examples. +- `RELEASE_PLEASE_ENABLED=false` and `LIVE_SMOKE_ENABLED=false`. + `RELEASE_RECOVERY_TAG` and `RELEASE_RECOVERY_SHA` are absent; no recovery tag + or recovery workflow was used for `0.1.1`. diff --git a/ROADMAP.md b/ROADMAP.md index 1815c6d..a2bf1f3 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -1,7 +1,7 @@ # CometAPI Python SDK Roadmap -Status: `0.1.0` stable released -Last updated: 2026-07-28 +Status: `0.1.1` stable maintenance released +Last updated: 2026-07-29 Repository contract: this roadmap is self-contained. Current gate: maintain the verified stable 0.1 surface. Begin 0.2 only after a separate maintainer request authorizes its provider schemas and live contracts. @@ -13,12 +13,12 @@ to CometAPI while preserving official request, response, error, retry, timeout, sync, async, and streaming behavior. Private Remote Validation, Public Preview, the functional `0.1.0a1` Registry -Alpha, and stable `0.1.0` are complete for the sanitized public repository. -Protected repository configuration, public default-branch CI, exact-release -live smoke, PyPI OIDC publication, provenance, digest comparison, and -public-registry smoke provide separate evidence layers. Support and release -claims remain limited to the evidence defined in this roadmap and -`COMPATIBILITY.md`. +Alpha, stable `0.1.0`, and maintenance release `0.1.1` are complete for the +sanitized public repository. Protected repository configuration, public +default-branch CI, exact-release live smoke, PyPI OIDC publication, provenance, +digest comparison, and public-registry smoke provide separate evidence layers. +Support and release claims remain limited to the evidence defined in this +roadmap and `COMPATIBILITY.md`. ## Milestones @@ -29,6 +29,7 @@ claims remain limited to the evidence defined in this roadmap and | Public Preview | Complete | The public repository has blocking CI, repository rules, security reporting, protected environments, immutable releases, and authorized live-smoke evidence. | | `0.1.0a1` Registry Alpha | Complete | Early adopters can install the functional prerelease from PyPI; every release and registry gate passed. | | `0.1.0` stable | Complete | Complete runtime, release-PR, example, provenance, and registry gates passed. | +| `0.1.1` maintenance | Complete | Configuration validation and every stable release, live, provenance, and registry gate passed. | | `0.2.0` provider-native text | Planned | Optional official Anthropic and Gemini adapters. | | `0.3.0` CometAPI resources | Planned | First schema-backed typed CometAPI-specific resource. | | Media and task APIs | Planned | Coherent task lifecycle precedes individual media helpers. | @@ -505,8 +506,65 @@ and source-distribution SHA256 `e9308b44f6091200b5121e24d1a0e1b9ea3e6bcccc109d6de87554b1ab2a8bca`. Both files matched retained pre-publication evidence and independently verified Trusted Publisher provenance. Recovery variables were removed immediately -after identity verification; `LIVE_SMOKE_ENABLED=false` is the only remaining -release-related repository variable. +after identity verification. At that closeout, `LIVE_SMOKE_ENABLED=false` was +the only remaining release-related repository variable. + +## `0.1.1`: Configuration validation maintenance + +Maintenance release `0.1.1` rejects explicitly blank API keys and base URLs, +treats a blank environment key as missing, and uses the default CometAPI URL +for a blank environment base URL. It trims surrounding string whitespace, +including the Node-compatible byte-order mark boundary, without changing +callable keys or `httpx.URL` values. Inherited copy helpers remain fail-closed +against provider routing, workload identity, and private-option injection. + +[Fix PR #25](https://github.com/cometapi-dev/cometapi-python/pull/25) passed +[pull-request CI run 30419881169](https://github.com/cometapi-dev/cometapi-python/actions/runs/30419881169) +and squash-merged as `d02b1dba277ac72229b772d29ea1870b569edd88`. +The first authorized +[Release Please run 30420057230](https://github.com/cometapi-dev/cometapi-python/actions/runs/30420057230) +failed before creating a pull request because GitHub Actions lacked permission +to create pull requests; it created no tag, release, live request, or PyPI file. +The permission was restored while default workflow permissions remained +read-only, and +[PR #26](https://github.com/cometapi-dev/cometapi-python/pull/26) recorded the +preflight as `18de120c79b5a4fde5d125d56238f7f3b28e69bf`. + +Fresh [Release Please run 30423490399](https://github.com/cometapi-dev/cometapi-python/actions/runs/30423490399) +created [release PR #27](https://github.com/cometapi-dev/cometapi-python/pull/27). +Its final head `7d24b4079b232c6c5e9b09b3d182ded230840ea8` passed all nine +required checks in +[run 30424732041](https://github.com/cometapi-dev/cometapi-python/actions/runs/30424732041) +and received an exact-head human owner approval. It squash-merged as release +commit `576e7503a0a8c1103faca5143e4b8d576f8e8b44`, which passed +[default-branch CI run 30429821579](https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821579). + +First-attempt +[release run 30429821548](https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821548) +created and verified the immutable non-draft +[GitHub release](https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.1) +and lightweight tag `v0.1.1` at that exact release commit. The run selected the +verified release identity, rebuilt and independently installed both artifacts, +and passed the exact-release live suite with four serial requests, at most 16 +output tokens per request, a 30-second request timeout, and stop-on-first-failure. +After protected `pypi` approval, the same top-level `publish.yml` published by +OIDC with attestations and passed public registry verification. + +The exact [PyPI release](https://pypi.org/project/cometapi/0.1.1/) has wheel +SHA256 `27e7904542f82fbbcd60e0de23a4a62c042420b6d004d00286d1f37d2ec4c5e5` +and source-distribution SHA256 +`64c7cb87745032703b3374cc562ea00b979416c54908862dbcebd116b2dc44c8`. +Both files matched the retained pre-publication digest record. Their PyPI +Integrity API provenance names repository `cometapi-dev/cometapi-python`, +workflow `publish.yml`, environment `pypi`, release commit `576e7503`, and +[run attempt 1](https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821548/attempts/1). +An independent post-workflow verification downloaded both public files, +verified their provenance with `pypi-attestations==0.0.29`, installed +`cometapi==0.1.1` from the public simple index, checked version and public +imports, and passed every supported mocked call and README example. + +`RELEASE_PLEASE_ENABLED=false` and `LIVE_SMOKE_ENABLED=false`. Recovery +variables are absent. No recovery tag or recovery workflow was used. ## `0.2.0`: Provider-native text adapters