Close out the v0.6.0 publication - #243
Merged
Merged
Conversation
v0.6.0 is live on all six surfaces. This moves the repository from describing 0.5.0 as published to describing 0.6.0, and applies the wording packet approved on 2026-07-31 for exactly this moment. Every claim was verified against the live registries before landing: three crates on crates.io (none yanked), the wheel and sdist on PyPI byte-identical to the local build, the npm tarball downloaded and its vendored binaries confirmed byte-identical to the release archives with the darwin binary reporting `ethos 0.6.0`, and the GitHub Release marked latest with 16 assets whose checksums match the promotion record. Corrects a live public surface. The release body still read "This release prepares:", "The intended v0.6.0 release surfaces are:", and listed both checksums as "pending — recorded here from the approved archives before publication". docs/releases/v0.6.0.md is the canonical body, so it is rewritten to published tense with the four real digests and pushed to the release. This CHANGELOG already records the identical defect at v0.5.0, whose body read "release candidate" until it was retrofitted; it recurred because release notes are written before publication and nothing rereads them at publication time. The notes now also state that the eight published *.inventory.json sidecars still read draft_not_release_ready. write_release_artifact_inventory.py hard-codes that and cannot describe an approved artifact, so without the caveat the machine-readable evidence attached to the release contradicts the release. Retires test_v0_6_0_version_activation.py for test_version_activation_lockstep.py, which reads the activated and published versions from the ledger. It was the sixth hand-written generation of one gate and its premise is now false. Both durable assertions survive: core metadata in lockstep, and the npm payload's four version fields moving as one set with a recorded boundary exception — the guard that forced 1d23604's revert, which retiring without replacement would have reopened. test_public_surface_posture.py and test_execution_status.py now derive every version literal from the ledger instead of transcribing it, and the posture gate gains exact-set assertions that no install command in README.md names any version but the published one. The retired module held the only negative assertions against stale install strings. The published GitHub Action pin follows the ledger to v0.6.0. actions/verify/README.md claimed the Action downloads "the fixed v0.4.0 Linux x64 release archive" — three releases stale, asserted by nothing — and is now version-neutral. The closeout record corrects a prior false claim rather than repeating it: the ledger declared ethos-package-*-0.4.0 and -0.5.0 closed out against a record that never mentions package tags, and those six tags do not exist on either side. check_release_state.py string-matches declared names against release.rust_crates and never consults git, which is how it survived two releases. The 0.6.0 triple is created here. The record also binds two source commits rather than one, because the npm payload landed two commits after the tag, and states plainly that consumer acceptance is bound to 0.5.0 bytes and that release-prep §5.1 was removed rather than satisfied. make release-gates exits 0, including release-live-state-check against the real registry. npm test and the Action contract pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: docushell-dev <hello@docushell.com>
Moving the Action pin to v0.6.0 broke it, and CI caught it because `released-cli-action-dogfood` executes the Action for real rather than only asserting on its yaml. `run_verify.py` read `checks` at the top level of the verification report. Since 0.6.0 every verdict-bearing command emits an in-toto Statement and the report the Action parses is its `predicate`; README.md documents exactly this under "Upgrading from 0.5". So the Action failed with `verification report must contain a checks array` against the very CLI it pins. It now unwraps the statement when `predicate` is present and no top-level `checks` is, and reads the bare report otherwise. Detected by shape rather than by version, because the Action only knows which binary it downloaded. Verified against a real 0.6.0 report: the CLI emits `_type`, `predicate`, `predicateType`, `subject` with no top-level `checks`, and run_verify.py now exits 0. No test covered the report shape, which is why a documented breaking change reached the published Action unnoticed. The dogfood job is what caught it. Also derives test_npm_binary_package_scaffold.py's published-npm assertion from the ledger and its vendored-CLI assertion from the payload manifest. The two differ during a refresh window, and transcribing either made the gate need a hand edit every release. make release-gates, the Action contract, the Action unit tests, and npm test all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: docushell-dev <hello@docushell.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.6.0 is live on all six surfaces. This moves the repository from describing 0.5.0 as published to describing 0.6.0, and applies the wording packet approved 2026-07-31 for exactly this moment.
Every claim verified against the live registries before landing — not asserted from the tree.
A live public surface was wrong
The release body still read
This release prepares:,The intended v0.6.0 release surfaces are:, and listed both checksums aspending.docs/releases/v0.6.0.mdis the canonical body, so it is rewritten to published tense with the four real digests and pushed to the release.This CHANGELOG already records the identical defect at v0.5.0, whose body read "release candidate" until retrofitted. It recurred because release notes are written before publication and nothing rereads them at publication.
A prior false claim, corrected rather than repeated
The ledger declared
ethos-package-*-0.4.0and-0.5.0closed out against a record that never mentions package tags — and those six tags do not exist, locally or remotely. Only the 0.1.0, 0.1.2 and 0.3.0 triples were ever created.check_release_state.pystring-matches declared names againstrelease.rust_cratesand never consults git, which is how it survived two releases.The 0.6.0 triple is created here, and the closeout record states the gap rather than inheriting it.
Gates stop being hand-pinned
test_v0_6_0_version_activation.pytest_version_activation_lockstep.py, reading the ledgertest_public_surface_posture.pytest_execution_status.pyactions/verify/README.mdBoth durable assertions from the retired module survive — core metadata in lockstep, and the npm payload's four version fields moving as one set with a recorded boundary exception. That second one is the guard that forced
1d23604's revert; retiring it without replacement would have reopened the defect.Honest limitations recorded, not smoothed over
*.inventory.jsonsidecars still readdraft_not_release_ready— the writer hard-codes it and cannot describe an approved artifactVerification
make release-gatesexits 0, includingrelease-live-state-checkagainst the real registry.npm testand the Action contract pass.🤖 Generated with Claude Code