From d15a8cddadc9b222c78893121950d01bb8f30322 Mon Sep 17 00:00:00 2001 From: Deathcharge Date: Mon, 10 Aug 2026 22:14:28 -0400 Subject: [PATCH] docs: record v2.0.0a6 release evidence --- CHANGELOG.md | 5 +++++ README.md | 8 ++++---- ROADMAP.md | 2 +- docs/ADOPTION.md | 10 +++++----- docs/PRODUCTIZATION.md | 6 +++--- docs/RELEASING.md | 39 +++++++++++++++++++++++++++++++++++++++ 6 files changed, 57 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 54dcc0f..ad7988b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ ## Unreleased +### Changed + +- recorded immutable `v2.0.0a6` release checksums, provenance, and clean installed-wheel + rate-limit recovery evidence. + ## 2.0.0a6 - 2026-08-10 ### Added diff --git a/README.md b/README.md index d712703..3afec48 100644 --- a/README.md +++ b/README.md @@ -42,15 +42,15 @@ accounts, no API keys, no external service, and no hosted operating cost. Python 3.10 or newer is required. The latest published immutable prerelease is -[`v2.0.0a5`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a5), +[`v2.0.0a6`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a6), with an installable wheel, source distribution, SHA-256 manifest, and verifiable GitHub Actions build provenance. A compact verified-wheel path is: ```bash -gh release download v2.0.0a5 --repo Deathcharge/samsarix-core --pattern "*.whl" -gh attestation verify samsarix_core-2.0.0a5-py3-none-any.whl \ +gh release download v2.0.0a6 --repo Deathcharge/samsarix-core --pattern "*.whl" +gh attestation verify samsarix_core-2.0.0a6-py3-none-any.whl \ --repo Deathcharge/samsarix-core -python -m pip install samsarix_core-2.0.0a5-py3-none-any.whl +python -m pip install samsarix_core-2.0.0a6-py3-none-any.whl ``` For a source checkout instead: diff --git a/ROADMAP.md b/ROADMAP.md index f848787..d2bf693 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -82,7 +82,7 @@ remain separate decisions. - [x] Publish immutable GitHub prerelease `v2.0.0a5` with privacy-safe lifecycle observability, independent consumer, clean-install, checksum, and SLSA provenance evidence. -- [ ] Publish immutable GitHub prerelease `v2.0.0a6` with per-tool rate limiting, +- [x] Publish immutable GitHub prerelease `v2.0.0a6` with per-tool rate limiting, independent consumer, clean-install, checksum, and SLSA provenance evidence. ## Samsarix adoption diff --git a/docs/ADOPTION.md b/docs/ADOPTION.md index 81b68ea..2e99e7f 100644 --- a/docs/ADOPTION.md +++ b/docs/ADOPTION.md @@ -5,11 +5,11 @@ claims. Samsarix Core has a merged independent repository consumer; it does not yet have a documented third-party production deployment, paid customer, usage volume, or service-level commitment. -The latest published `2.0.0a5` prerelease has independently verified artifacts and -installed-wheel lifecycle behavior. The repository consumer below pins the merged -per-tool rate-limit commit after that release, so its exact Git installation reports -package metadata `2.0.0a5`. The `2.0.0a6` candidate incorporates that contract; release -verification is tracked separately and is not presented as consumer-adoption evidence. +The latest published `2.0.0a6` prerelease has independently verified artifacts and +installed-wheel rate-limit recovery behavior. The repository consumer below pins the +merged per-tool rate-limit commit immediately before the release metadata commits, so +its exact Git installation reports package metadata `2.0.0a5`. Release verification is +tracked separately and is not presented as consumer-adoption evidence. ## Privacy-first redaction MCP consumer diff --git a/docs/PRODUCTIZATION.md b/docs/PRODUCTIZATION.md index 6d7f9ce..6f64d16 100644 --- a/docs/PRODUCTIZATION.md +++ b/docs/PRODUCTIZATION.md @@ -306,9 +306,9 @@ clean-wheel behavioral evidence is recorded separately in `docs/ADOPTION.md`. ## Owner-, credential-, or production-blocked tasks -The immutable GitHub prerelease `v2.0.0a5` is published from commit -`60fa5554d8ef4625dc803751cc4bd34cf757e094` with verified checksums, GitHub Actions -build provenance, and a clean installed-wheel lifecycle probe. The exact assets, +The immutable GitHub prerelease `v2.0.0a6` is published from commit +`f09e77877b04500aa7d23504ba21123577138543` with verified checksums, GitHub Actions +build provenance, and a clean installed-wheel rate-limit recovery probe. The exact assets, workflow runs, verification, installation evidence, and recovery model are recorded in `docs/RELEASING.md`. This passes the GitHub release gate only; it does not pass the PyPI, stable API, or third-party production-adoption gates. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index aee0e94..9272c90 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -86,6 +86,45 @@ contract is wrong, document the issue, prepare a new version, rerun the complete and publish a new tag. Consumers can roll back by installing a previously verified release asset or exact commit. Core stores no remote runtime state. +## Published evidence: v2.0.0a6 + +The per-tool rate-limit alpha was published on 2026-08-10 as an immutable GitHub +prerelease: + +| Evidence | Value | +| --- | --- | +| Release | [`v2.0.0a6`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a6) | +| Tagged commit | `f09e77877b04500aa7d23504ba21123577138543` | +| Annotated tag object | `e38fa58fcf94fac6b0525027967194f9c6d8fb64` | +| Release workflow | [run `31451329609`](https://github.com/Deathcharge/samsarix-core/actions/runs/31451329609) | +| Build-only dry run | [run `31451018128`](https://github.com/Deathcharge/samsarix-core/actions/runs/31451018128) | +| Exact-main CI | [run `31450834231`](https://github.com/Deathcharge/samsarix-core/actions/runs/31450834231) | +| Release state | published, prerelease, immutable | + +Published assets are: + +| Artifact | Bytes | SHA-256 | +| --- | ---: | --- | +| `samsarix_core-2.0.0a6-py3-none-any.whl` | 48,503 | `4e0b52c0bd72d143e8ab5cc28180f86b12fc004ef3a056d854a275d1654c7d22` | +| `samsarix_core-2.0.0a6.tar.gz` | 124,908 | `61cce7d16c659916b0fb36887c5cadd9e48f697c46f41d6f7d7f6efa42d716fe` | +| `SHA256SUMS` | 200 | `b8d701365b30f258e014aa3a46f2e491eff908598d746c04c01ac453ad84c433` | + +`gh release verify` confirmed the immutable release, and `gh release verify-asset` +confirmed all three freshly downloaded assets. The downloaded manifest independently +matched both distribution digests. `gh attestation verify` validated SLSA provenance +for the wheel and source distribution while explicitly requiring this public repository, +`.github/workflows/release.yml`, tag ref `refs/tags/v2.0.0a6`, source commit +`f09e77877b04500aa7d23504ba21123577138543`, and a GitHub-hosted runner. + +A fresh Python 3.11.9 environment installed the downloaded wheel without dependencies +and reported no broken requirements. Both public namespaces reported `2.0.0a6`, exposed +the same `ToolRateLimit`, and resolved from the fresh environment's `site-packages`. The +installed public example completed one call, rejected an immediate second call as +`rate_limited` with a numeric retry delay, and succeeded again after that delay. This is +GitHub distribution, provenance, and clean-wheel behavior evidence, not PyPI +publication, a stable-API declaration, a security audit, third-party production +adoption, or an SLA. + ## Published evidence: v2.0.0a5 The lifecycle-observability alpha was published on 2026-08-02 as an immutable GitHub