From 7a79f301f107fea62f3470f4f9ee93fd6236fedc Mon Sep 17 00:00:00 2001 From: Deathcharge Date: Tue, 11 Aug 2026 02:31:35 -0400 Subject: [PATCH] docs: prepare v0.2.0 prerelease --- .github/ISSUE_TEMPLATE/config.yml | 6 +++--- CHANGELOG.md | 4 ++++ README.md | 2 +- ROADMAP.md | 10 +++++----- docs/PRODUCTIZATION.md | 8 ++++---- docs/RELEASING.md | 7 +++---- 6 files changed, 20 insertions(+), 17 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index a311fff..4eef454 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,8 +1,8 @@ blank_issues_enabled: false contact_links: - name: Private security report - url: mailto:support@samsarix.com?subject=Security%3A%20Samsarix%20Platform%20Doctor + url: https://github.com/Deathcharge/samsarix-platform/security/advisories/new about: Report unpatched vulnerabilities or sensitive security details privately. - name: Support - url: mailto:support@samsarix.com?subject=Support%3A%20Samsarix%20Platform%20Doctor - about: Ask a question that is not suitable for a public issue. + url: https://www.samsarix.com + about: Visit Samsarix support or email support@samsarix.com for a private question. diff --git a/CHANGELOG.md b/CHANGELOG.md index a9242ce..ba9e862 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to Samsarix Platform Doctor are documented here. ## Unreleased +No unreleased changes. + +## 0.2.0 - 2026-08-11 + ### Added - Manifest schema version 2 with standards-compliant PEP 440 distribution constraints. diff --git a/README.md b/README.md index 73b0cc0..9cbcd26 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Samsarix Platform Doctor is a local command-line tool from **Samsarix LLC** that It is for developers who want an actionable preflight before starting an agent application or running its CI—not another agent framework or hosted service. -> Status: `0.2.0` pre-release. The core local workflow is implemented, tested, and licensed under MPL 2.0, but the package has not been published. +> Status: `0.2.0` pre-release. The core local workflow is implemented, tested, and licensed under MPL 2.0, but it has not been published to a Python package registry. ## What it does diff --git a/ROADMAP.md b/ROADMAP.md index 9f13693..e773434 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -6,7 +6,7 @@ This roadmap separates four gates: merge, release, publication, and flagship ado Portfolio role: **internal infrastructure**. Use this to improve the portfolio through immutable, reviewed automation or internal deployments. It must not become a hidden runtime dependency for customer-facing products. -Current disposition: publish the repository as an MPL-2.0 open-source prerelease and merge only after the focused source, package, and hosted-CI gates pass. PyPI publication remains a separate owner-controlled milestone. +Current disposition: the repository is an MPL-2.0 open-source prerelease with protected, green hosted CI. PyPI publication remains a separate owner-controlled milestone. ## Stabilize the productized default @@ -15,8 +15,8 @@ Current disposition: publish the repository as an MPL-2.0 open-source prerelease - Preserve the pre-productization default under a rollback ref before merging; do not delete legacy history. - Locally reproduced in this pass: unit tests, formatting, lint, types, 90% coverage, and package build pass. - Environment contract v2 now validates PEP 440 distribution ranges and read-only executable availability while preserving schema v1 compatibility. -- Next: use public-repository Actions to establish exact-head CI, then adopt one real manifest consumer through an immutable revision. -- Review priority: green exact-head wheel/CLI checks, real consumer adoption, then package-publication provenance. +- Next: adopt one real manifest consumer through an immutable revision. +- Review priority: real consumer adoption, then package-publication provenance. ## Release candidate @@ -26,10 +26,10 @@ Current disposition: publish the repository as an MPL-2.0 open-source prerelease Current hardening backlog: -- Private-repository CI was blocked before runner startup by the account billing setting; public standard GitHub-hosted runners avoid paid Actions minutes. +- Public-repository CI is green on Linux and Windows with Python 3.11 and 3.14. - Executable checks establish safe `PATH` discovery only; they do not execute tools to probe their versions or APIs. - Credential validity, package API compatibility, and service reachability are not checked. -- No evidenced adopter, public package, tag, release, or stable schema consumer. +- No evidenced adopter, public Python package, or stable external schema consumer. - The `samsarix-platform` name still suggests a broader platform than the implemented doctor command. - PyPI namespace ownership, trusted publishing, provenance, and first-release authority remain owner gates. diff --git a/docs/PRODUCTIZATION.md b/docs/PRODUCTIZATION.md index b5c2955..06f67be 100644 --- a/docs/PRODUCTIZATION.md +++ b/docs/PRODUCTIZATION.md @@ -165,17 +165,17 @@ Run on Windows with Python 3.11.9 against the final implementation: | `python -m pip_audit . --strict --progress-spinner off` | Exit 0; no known runtime dependency vulnerabilities found. | | Local Markdown target check | Exit 0; 0 broken relative links. | -The authored GitHub Actions matrix covers Linux and Windows on Python 3.11 and 3.14. A pushed branch and its remote check results are recorded separately from this local verification. No production deployment or package publication was attempted. +The protected GitHub Actions matrix passed on Linux and Windows with Python 3.11 and 3.14 at the exact merged commit. No production deployment or Python package-registry publication was attempted. ## Release disposition -**Open-source prerelease candidate with named package-publication gates.** The local product journey, tests, build, package shape, documentation, licensing, and standard security scan are complete with no locally actionable P0. Four low-severity scan findings were remediated before repository publication. A PyPI release still requires namespace confirmation, trusted publishing, provenance policy, and an explicitly approved release commit. +**Verified open-source prerelease with named package-publication gates.** The product journey, tests, build, package shape, documentation, licensing, protected hosted CI, and standard security scan are complete with no locally actionable P0. Four low-severity scan findings were remediated before repository publication. A PyPI release still requires namespace confirmation, trusted publishing, provenance policy, and an explicitly approved release commit. ## Deferred and blocked work - Legal counsel has not independently reviewed the selected standard MPL 2.0 license or brand notice; obtain advice if the business model or contributor structure changes. -- PyPI project ownership, trusted publishing, release signing, and the first public release require owner authorization and account configuration. -- Exact-head hosted CI remains a merge gate and is recorded on the pull request rather than inferred from local checks. +- PyPI project ownership, trusted publishing, release signing, and the first package-registry release require owner authorization and account configuration. +- Exact-head hosted CI remains a merge gate and is recorded on each pull request rather than inferred from local checks. - Production deployment is not applicable to a local CLI. Package publication is documented but will not be executed here. - Product-market demand is unvalidated. Hosted services, telemetry, subscriptions, and provider integrations remain out of scope. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 3d6234d..cb8c739 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -4,14 +4,13 @@ Samsarix Platform Doctor is distributed as a Python source archive and universal ## Current release disposition -Version `0.2.0` is a pre-release candidate. Local build and verification are implemented. Public publication remains blocked on owner decisions and external setup: +Version `0.2.0` is a verified GitHub prerelease. Source, package, and protected hosted-CI gates pass. Publication to PyPI remains blocked on owner decisions and external setup: - confirm or claim the `samsarix-platform` distribution name immediately before release; - configure the owner's PyPI project and trusted publisher; -- choose tag-signing and artifact-provenance policy; -- obtain a green protected-branch CI run for the release commit. +- choose the stable-release signing and artifact-provenance policy. -The repository is licensed under MPL 2.0, identifies Samsarix LLC as the initial copyright holder, and publishes private support/security contact details. The public PyPI project and JSON URLs for `samsarix-platform` returned `404` when checked on 2026-07-28, but that is not a reservation or guarantee that the name can be claimed later. +The repository is licensed under MPL 2.0, identifies Samsarix LLC as the initial copyright holder, and publishes direct support/security contact details. The public PyPI project and JSON URLs for `samsarix-platform` returned `404` when checked on 2026-07-28, but that is not a reservation or guarantee that the name can be claimed later. Do not publish from an unreviewed developer workstation or by placing a long-lived PyPI token in this repository.