Skip to content

docs: record v2.0.0a7 release evidence #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Deathcharge merged 1 commit into from
Aug 11, 2026
+54 −10
Merged

docs: record v2.0.0a7 release evidence #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,11 @@

## Unreleased

### Changed

- recorded immutable `v2.0.0a7` release checksums, provenance, and clean
installed-wheel circuit-breaker recovery evidence.

## 2.0.0a7 - 2026-08-11

### Added
Expand Down
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,15 +42,15 @@ accounts, no API keys, no external service, and no hosted operating cost.
Python 3.10 or newer is required.

The latest published immutable prerelease is
[`v2.0.0a6`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a6),
[`v2.0.0a7`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a7),
with an installable wheel, source distribution, SHA-256 manifest, and verifiable
GitHub Actions build provenance. A compact verified-wheel path is:

```bash
gh release download v2.0.0a6 --repo Deathcharge/samsarix-core --pattern "*.whl"
gh attestation verify samsarix_core-2.0.0a6-py3-none-any.whl \
gh release download v2.0.0a7 --repo Deathcharge/samsarix-core --pattern "*.whl"
gh attestation verify samsarix_core-2.0.0a7-py3-none-any.whl \
--repo Deathcharge/samsarix-core
python -m pip install samsarix_core-2.0.0a6-py3-none-any.whl
python -m pip install samsarix_core-2.0.0a7-py3-none-any.whl
```

For a source checkout instead:
Expand Down
2 changes: 1 addition & 1 deletion ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ remain separate decisions.
independent consumer, clean-install, checksum, and SLSA provenance evidence.
- [x] Prove independent consumer adoption for the per-tool circuit-breaker contract
after exact-head review and clean-wheel evidence.
- [ ] Publish immutable GitHub prerelease `v2.0.0a7` with per-tool circuit breaking,
- [x] Publish immutable GitHub prerelease `v2.0.0a7` with per-tool circuit breaking,
independent consumer, clean-install, checksum, and SLSA provenance evidence.

## Samsarix adoption
Expand Down
4 changes: 2 additions & 2 deletions docs/ADOPTION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@ claims. Samsarix Core has a merged independent repository consumer; it does not
yet have a documented third-party production deployment, paid customer, usage
volume, or service-level commitment.

The latest published `2.0.0a6` prerelease has independently verified artifacts and
installed-wheel rate-limit recovery behavior. The repository consumer below pins the
The latest published `2.0.0a7` prerelease has independently verified artifacts and
installed-wheel circuit-breaker recovery behavior. The repository consumer below pins the
merged per-tool circuit-breaker commit, so its exact Git installation reports package
metadata `2.0.0a6`. Release verification is tracked separately and is not presented as
consumer-adoption evidence.
Expand Down
6 changes: 3 additions & 3 deletions docs/PRODUCTIZATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -307,9 +307,9 @@ clean-wheel behavioral evidence is recorded separately in `docs/ADOPTION.md`.

## Owner-, credential-, or production-blocked tasks

The immutable GitHub prerelease `v2.0.0a6` is published from commit
`f09e77877b04500aa7d23504ba21123577138543` with verified checksums, GitHub Actions
build provenance, and a clean installed-wheel rate-limit recovery probe. The exact assets,
The immutable GitHub prerelease `v2.0.0a7` is published from commit
`766189a035c8a076a2b23f10b28576af586d5474` with verified checksums, GitHub Actions
build provenance, and a clean installed-wheel circuit-breaker recovery probe. The exact assets,
workflow runs, verification, installation evidence, and recovery model are recorded in
`docs/RELEASING.md`. This passes the GitHub release gate only; it does not pass the
PyPI, stable API, or third-party production-adoption gates.
Expand Down
39 changes: 39 additions & 0 deletions docs/RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,45 @@ contract is wrong, document the issue, prepare a new version, rerun the complete
and publish a new tag. Consumers can roll back by installing a previously verified
release asset or exact commit. Core stores no remote runtime state.

## Published evidence: v2.0.0a7

The per-tool circuit-breaker alpha was published on 2026-08-11 as an immutable
GitHub prerelease:

| Evidence | Value |
| --- | --- |
| Release | [`v2.0.0a7`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a7) |
| Tagged commit | `766189a035c8a076a2b23f10b28576af586d5474` |
| Annotated tag object | `56308ee653c91a6ea35e410165a519b61297390b` |
| Release workflow | [run `31460562784`](https://github.com/Deathcharge/samsarix-core/actions/runs/31460562784) |
| Build-only dry run | [run `31460435905`](https://github.com/Deathcharge/samsarix-core/actions/runs/31460435905) |
| Exact-main CI | [run `31460476424`](https://github.com/Deathcharge/samsarix-core/actions/runs/31460476424) |
| Release state | published, prerelease, immutable |

Published assets are:

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `samsarix_core-2.0.0a7-py3-none-any.whl` | 51,136 | `2aaa2980e7c1d69445402eab8d0b34a620f2bf829c1311e4f2f6cc57940f7c29` |
| `samsarix_core-2.0.0a7.tar.gz` | 136,538 | `c2b407e84e12cbe956a45c528a528fc142f41bc7767a3986af80c849bc0cb409` |
| `SHA256SUMS` | 200 | `403795bad3323aebed67b129443e396075c73cd28246bce0e9954474edac5b41` |

`gh release verify` confirmed the immutable release, and `gh release verify-asset`
confirmed all three freshly downloaded assets. The downloaded manifest independently
matched both distribution digests. `gh attestation verify` validated SLSA provenance
for the wheel and source distribution while identifying this public repository,
`.github/workflows/release.yml`, tag ref `refs/tags/v2.0.0a7`, source commit
`766189a035c8a076a2b23f10b28576af586d5474`, and a GitHub-hosted runner.

A fresh Python 3.11.9 environment installed the downloaded wheel without dependencies
and reported no broken requirements. Both public namespaces and distribution metadata
reported `2.0.0a7` from the fresh environment's `site-packages`. The installed smoke
probe produced a safe failure, rejected the immediate next call as `circuit_open`, and
completed a successful real recovery probe after the configured interval. This is
GitHub distribution, provenance, and clean-wheel behavior evidence, not PyPI
publication, a stable-API declaration, a security audit, third-party production
adoption, or an SLA.

## Published evidence: v2.0.0a6

The per-tool rate-limit alpha was published on 2026-08-10 as an immutable GitHub
Expand Down