From 9299313adb040270f261e9d51d7f7bf815247a8b Mon Sep 17 00:00:00 2001 From: Deathcharge Date: Tue, 11 Aug 2026 01:12:38 -0400 Subject: [PATCH] docs: record v2.0.0a7 release evidence --- CHANGELOG.md | 5 +++++ README.md | 8 ++++---- ROADMAP.md | 2 +- docs/ADOPTION.md | 4 ++-- docs/PRODUCTIZATION.md | 6 +++--- docs/RELEASING.md | 39 +++++++++++++++++++++++++++++++++++++++ 6 files changed, 54 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e767dc9..0894aae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ ## Unreleased +### Changed + +- recorded immutable `v2.0.0a7` release checksums, provenance, and clean + installed-wheel circuit-breaker recovery evidence. + ## 2.0.0a7 - 2026-08-11 ### Added diff --git a/README.md b/README.md index aae4815..a108c9d 100644 --- a/README.md +++ b/README.md @@ -42,15 +42,15 @@ accounts, no API keys, no external service, and no hosted operating cost. Python 3.10 or newer is required. The latest published immutable prerelease is -[`v2.0.0a6`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a6), +[`v2.0.0a7`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a7), with an installable wheel, source distribution, SHA-256 manifest, and verifiable GitHub Actions build provenance. A compact verified-wheel path is: ```bash -gh release download v2.0.0a6 --repo Deathcharge/samsarix-core --pattern "*.whl" -gh attestation verify samsarix_core-2.0.0a6-py3-none-any.whl \ +gh release download v2.0.0a7 --repo Deathcharge/samsarix-core --pattern "*.whl" +gh attestation verify samsarix_core-2.0.0a7-py3-none-any.whl \ --repo Deathcharge/samsarix-core -python -m pip install samsarix_core-2.0.0a6-py3-none-any.whl +python -m pip install samsarix_core-2.0.0a7-py3-none-any.whl ``` For a source checkout instead: diff --git a/ROADMAP.md b/ROADMAP.md index 4770e80..6548d8b 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -93,7 +93,7 @@ remain separate decisions. independent consumer, clean-install, checksum, and SLSA provenance evidence. - [x] Prove independent consumer adoption for the per-tool circuit-breaker contract after exact-head review and clean-wheel evidence. -- [ ] Publish immutable GitHub prerelease `v2.0.0a7` with per-tool circuit breaking, +- [x] Publish immutable GitHub prerelease `v2.0.0a7` with per-tool circuit breaking, independent consumer, clean-install, checksum, and SLSA provenance evidence. ## Samsarix adoption diff --git a/docs/ADOPTION.md b/docs/ADOPTION.md index 7a46b54..6221ea1 100644 --- a/docs/ADOPTION.md +++ b/docs/ADOPTION.md @@ -5,8 +5,8 @@ claims. Samsarix Core has a merged independent repository consumer; it does not yet have a documented third-party production deployment, paid customer, usage volume, or service-level commitment. -The latest published `2.0.0a6` prerelease has independently verified artifacts and -installed-wheel rate-limit recovery behavior. The repository consumer below pins the +The latest published `2.0.0a7` prerelease has independently verified artifacts and +installed-wheel circuit-breaker recovery behavior. The repository consumer below pins the merged per-tool circuit-breaker commit, so its exact Git installation reports package metadata `2.0.0a6`. Release verification is tracked separately and is not presented as consumer-adoption evidence. diff --git a/docs/PRODUCTIZATION.md b/docs/PRODUCTIZATION.md index 53b8dc7..c3b948f 100644 --- a/docs/PRODUCTIZATION.md +++ b/docs/PRODUCTIZATION.md @@ -307,9 +307,9 @@ clean-wheel behavioral evidence is recorded separately in `docs/ADOPTION.md`. ## Owner-, credential-, or production-blocked tasks -The immutable GitHub prerelease `v2.0.0a6` is published from commit -`f09e77877b04500aa7d23504ba21123577138543` with verified checksums, GitHub Actions -build provenance, and a clean installed-wheel rate-limit recovery probe. The exact assets, +The immutable GitHub prerelease `v2.0.0a7` is published from commit +`766189a035c8a076a2b23f10b28576af586d5474` with verified checksums, GitHub Actions +build provenance, and a clean installed-wheel circuit-breaker recovery probe. The exact assets, workflow runs, verification, installation evidence, and recovery model are recorded in `docs/RELEASING.md`. This passes the GitHub release gate only; it does not pass the PyPI, stable API, or third-party production-adoption gates. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 9272c90..a271f74 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -86,6 +86,45 @@ contract is wrong, document the issue, prepare a new version, rerun the complete and publish a new tag. Consumers can roll back by installing a previously verified release asset or exact commit. Core stores no remote runtime state. +## Published evidence: v2.0.0a7 + +The per-tool circuit-breaker alpha was published on 2026-08-11 as an immutable +GitHub prerelease: + +| Evidence | Value | +| --- | --- | +| Release | [`v2.0.0a7`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a7) | +| Tagged commit | `766189a035c8a076a2b23f10b28576af586d5474` | +| Annotated tag object | `56308ee653c91a6ea35e410165a519b61297390b` | +| Release workflow | [run `31460562784`](https://github.com/Deathcharge/samsarix-core/actions/runs/31460562784) | +| Build-only dry run | [run `31460435905`](https://github.com/Deathcharge/samsarix-core/actions/runs/31460435905) | +| Exact-main CI | [run `31460476424`](https://github.com/Deathcharge/samsarix-core/actions/runs/31460476424) | +| Release state | published, prerelease, immutable | + +Published assets are: + +| Artifact | Bytes | SHA-256 | +| --- | ---: | --- | +| `samsarix_core-2.0.0a7-py3-none-any.whl` | 51,136 | `2aaa2980e7c1d69445402eab8d0b34a620f2bf829c1311e4f2f6cc57940f7c29` | +| `samsarix_core-2.0.0a7.tar.gz` | 136,538 | `c2b407e84e12cbe956a45c528a528fc142f41bc7767a3986af80c849bc0cb409` | +| `SHA256SUMS` | 200 | `403795bad3323aebed67b129443e396075c73cd28246bce0e9954474edac5b41` | + +`gh release verify` confirmed the immutable release, and `gh release verify-asset` +confirmed all three freshly downloaded assets. The downloaded manifest independently +matched both distribution digests. `gh attestation verify` validated SLSA provenance +for the wheel and source distribution while identifying this public repository, +`.github/workflows/release.yml`, tag ref `refs/tags/v2.0.0a7`, source commit +`766189a035c8a076a2b23f10b28576af586d5474`, and a GitHub-hosted runner. + +A fresh Python 3.11.9 environment installed the downloaded wheel without dependencies +and reported no broken requirements. Both public namespaces and distribution metadata +reported `2.0.0a7` from the fresh environment's `site-packages`. The installed smoke +probe produced a safe failure, rejected the immediate next call as `circuit_open`, and +completed a successful real recovery probe after the configured interval. This is +GitHub distribution, provenance, and clean-wheel behavior evidence, not PyPI +publication, a stable-API declaration, a security audit, third-party production +adoption, or an SLA. + ## Published evidence: v2.0.0a6 The per-tool rate-limit alpha was published on 2026-08-10 as an immutable GitHub