Skip to content

docs: record v2.0.0a6 release evidence #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Deathcharge merged 1 commit into from
Aug 11, 2026
Merged

docs: record v2.0.0a6 release evidence #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,11 @@

## Unreleased

### Changed

- recorded immutable `v2.0.0a6` release checksums, provenance, and clean installed-wheel
rate-limit recovery evidence.

## 2.0.0a6 - 2026-08-10

### Added
Expand Down
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,15 +42,15 @@ accounts, no API keys, no external service, and no hosted operating cost.
Python 3.10 or newer is required.

The latest published immutable prerelease is
[`v2.0.0a5`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a5),
[`v2.0.0a6`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a6),
with an installable wheel, source distribution, SHA-256 manifest, and verifiable
GitHub Actions build provenance. A compact verified-wheel path is:

```bash
gh release download v2.0.0a5 --repo Deathcharge/samsarix-core --pattern "*.whl"
gh attestation verify samsarix_core-2.0.0a5-py3-none-any.whl \
gh release download v2.0.0a6 --repo Deathcharge/samsarix-core --pattern "*.whl"
gh attestation verify samsarix_core-2.0.0a6-py3-none-any.whl \
--repo Deathcharge/samsarix-core
python -m pip install samsarix_core-2.0.0a5-py3-none-any.whl
python -m pip install samsarix_core-2.0.0a6-py3-none-any.whl
```

For a source checkout instead:
Expand Down
2 changes: 1 addition & 1 deletion ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ remain separate decisions.
- [x] Publish immutable GitHub prerelease `v2.0.0a5` with privacy-safe lifecycle
observability, independent consumer, clean-install, checksum, and SLSA provenance
evidence.
- [ ] Publish immutable GitHub prerelease `v2.0.0a6` with per-tool rate limiting,
- [x] Publish immutable GitHub prerelease `v2.0.0a6` with per-tool rate limiting,
independent consumer, clean-install, checksum, and SLSA provenance evidence.

## Samsarix adoption
Expand Down
10 changes: 5 additions & 5 deletions docs/ADOPTION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@ claims. Samsarix Core has a merged independent repository consumer; it does not
yet have a documented third-party production deployment, paid customer, usage
volume, or service-level commitment.

The latest published `2.0.0a5` prerelease has independently verified artifacts and
installed-wheel lifecycle behavior. The repository consumer below pins the merged
per-tool rate-limit commit after that release, so its exact Git installation reports
package metadata `2.0.0a5`. The `2.0.0a6` candidate incorporates that contract; release
verification is tracked separately and is not presented as consumer-adoption evidence.
The latest published `2.0.0a6` prerelease has independently verified artifacts and
installed-wheel rate-limit recovery behavior. The repository consumer below pins the
merged per-tool rate-limit commit immediately before the release metadata commits, so
its exact Git installation reports package metadata `2.0.0a5`. Release verification is
tracked separately and is not presented as consumer-adoption evidence.

## Privacy-first redaction MCP consumer

Expand Down
6 changes: 3 additions & 3 deletions docs/PRODUCTIZATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,9 +306,9 @@ clean-wheel behavioral evidence is recorded separately in `docs/ADOPTION.md`.

## Owner-, credential-, or production-blocked tasks

The immutable GitHub prerelease `v2.0.0a5` is published from commit
`60fa5554d8ef4625dc803751cc4bd34cf757e094` with verified checksums, GitHub Actions
build provenance, and a clean installed-wheel lifecycle probe. The exact assets,
The immutable GitHub prerelease `v2.0.0a6` is published from commit
`f09e77877b04500aa7d23504ba21123577138543` with verified checksums, GitHub Actions
build provenance, and a clean installed-wheel rate-limit recovery probe. The exact assets,
workflow runs, verification, installation evidence, and recovery model are recorded in
`docs/RELEASING.md`. This passes the GitHub release gate only; it does not pass the
PyPI, stable API, or third-party production-adoption gates.
Expand Down
39 changes: 39 additions & 0 deletions docs/RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,45 @@ contract is wrong, document the issue, prepare a new version, rerun the complete
and publish a new tag. Consumers can roll back by installing a previously verified
release asset or exact commit. Core stores no remote runtime state.

## Published evidence: v2.0.0a6

The per-tool rate-limit alpha was published on 2026-08-10 as an immutable GitHub
prerelease:

| Evidence | Value |
| --- | --- |
| Release | [`v2.0.0a6`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a6) |
| Tagged commit | `f09e77877b04500aa7d23504ba21123577138543` |
| Annotated tag object | `e38fa58fcf94fac6b0525027967194f9c6d8fb64` |
| Release workflow | [run `31451329609`](https://github.com/Deathcharge/samsarix-core/actions/runs/31451329609) |
| Build-only dry run | [run `31451018128`](https://github.com/Deathcharge/samsarix-core/actions/runs/31451018128) |
| Exact-main CI | [run `31450834231`](https://github.com/Deathcharge/samsarix-core/actions/runs/31450834231) |
| Release state | published, prerelease, immutable |

Published assets are:

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `samsarix_core-2.0.0a6-py3-none-any.whl` | 48,503 | `4e0b52c0bd72d143e8ab5cc28180f86b12fc004ef3a056d854a275d1654c7d22` |
| `samsarix_core-2.0.0a6.tar.gz` | 124,908 | `61cce7d16c659916b0fb36887c5cadd9e48f697c46f41d6f7d7f6efa42d716fe` |
| `SHA256SUMS` | 200 | `b8d701365b30f258e014aa3a46f2e491eff908598d746c04c01ac453ad84c433` |

`gh release verify` confirmed the immutable release, and `gh release verify-asset`
confirmed all three freshly downloaded assets. The downloaded manifest independently
matched both distribution digests. `gh attestation verify` validated SLSA provenance
for the wheel and source distribution while explicitly requiring this public repository,
`.github/workflows/release.yml`, tag ref `refs/tags/v2.0.0a6`, source commit
`f09e77877b04500aa7d23504ba21123577138543`, and a GitHub-hosted runner.

A fresh Python 3.11.9 environment installed the downloaded wheel without dependencies
and reported no broken requirements. Both public namespaces reported `2.0.0a6`, exposed
the same `ToolRateLimit`, and resolved from the fresh environment's `site-packages`. The
installed public example completed one call, rejected an immediate second call as
`rate_limited` with a numeric retry delay, and succeeded again after that delay. This is
GitHub distribution, provenance, and clean-wheel behavior evidence, not PyPI
publication, a stable-API declaration, a security audit, third-party production
adoption, or an SLA.

## Published evidence: v2.0.0a5

The lifecycle-observability alpha was published on 2026-08-02 as an immutable GitHub
Expand Down