diff --git a/HANDOFF.md b/HANDOFF.md index a4d3601..86dfd58 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -2,34 +2,34 @@ ## Finished -- Added one opt-in acceptance journey using Druff's production clients against current protected Dander RC32. -- Confirmed RC32 retains Druff's exact published Control contract bundle bytes. -- Kept ordinary unit tests network-free and isolated the cross-repository journey in its own configuration. -- Made browser acceptance use an explicit safe local port when another workspace occupies port 3000. +- Merged current-Dander compatibility in PR #23 and passed exact-main CI at `34acec00dfc9aafe93a62b1e3ed2b1b807a66487`. +- Exercised Druff's production clients against protected Dander RC32 at `33801213ee8c1bab78b8847a4b86bd9b4b8d1c63`. +- Built and retained exact active and rollback multi-platform OCI artifacts with SBOM and provenance attestations. +- Verified both artifacts are source-free, non-root, read-only, route-complete, and clean under the protected Trivy policy. ## Try It -Start current Dander with `uv run dander control serve --ephemeral --project demo-project --port 8770`, then run `DANDER_CONTROL_URL=http://127.0.0.1:8770 DANDER_EXPECTED_VERSION=0.9.0rc32 pnpm test:current-dander`. +Resolve the retained artifacts with `oras resolve --oci-layout /Users/harrison/.codex/artifacts/druff/2026-08-24-release/druff-active-34acec00dfc9.oci.tar:active` or the matching `druff-rollback-55f1565f3cb8.oci.tar:rollback`. For Control API acceptance, start current Dander and run `DANDER_CONTROL_URL=http://127.0.0.1:8770 DANDER_EXPECTED_VERSION=0.9.0rc32 pnpm test:current-dander`. ## Checks -- Current-Dander acceptance passed against protected Dander commit `33801213ee8c1bab78b8847a4b86bd9b4b8d1c63`. -- Contract drift, artifact tests, ESLint, TypeScript, Prettier, and all 669 unit tests passed. -- Production build and all 11 Playwright journeys passed on isolated port 3100. +- PR #23 and exact-main run `32787930579` passed Frontend quality, Source-free container, and Secret scan. +- Current-Dander acceptance, contract/artifact checks, lint, types, format, 669 unit tests, and 11 Playwright journeys passed. +- Both exact artifacts passed reproducible-layer, promotion, archive, amd64/arm64 runtime/export, and Trivy 0.70.0 HIGH/CRITICAL plus secret checks with zero findings. ## Decisions -- Retain the public RC19 contract artifact pin because RC32's bundle is byte-identical. -- Verify service compatibility through a real local HTTP application without adding a runtime adapter. +- Active is merge commit `34acec00dfc9`; rollback is green PR head `55f1565f3cb8`; both share tree `ce829147ef3b`. +- Retain the public RC19 contract pin because protected RC32's bundle is byte-identical. +- Keep the release artifacts as local OCI archives; public registry publication remains a separate external action. ## Remaining -- Merge the focused protected PR after all three required jobs pass. -- Build, inspect, scan, and retain exact active and rollback OCI artifacts from protected commits. -- Record their immutable identities and terminal release disposition. +- No Druff implementation or release-readiness gap remains. +- Publish or deploy the retained artifact only when a destination is explicitly approved. ## Review First -- `integration/current-dander-control.test.ts` -- `playwright.config.ts` - `tickets/DRUFF-31-current-dander-release-acceptance.md` +- `integration/current-dander-control.test.ts` +- `/Users/harrison/.codex/artifacts/druff/2026-08-24-release/records` diff --git a/tickets/DRUFF-31-current-dander-release-acceptance.md b/tickets/DRUFF-31-current-dander-release-acceptance.md index bac413e..036734f 100644 --- a/tickets/DRUFF-31-current-dander-release-acceptance.md +++ b/tickets/DRUFF-31-current-dander-release-acceptance.md @@ -47,3 +47,27 @@ adapter. Normal Vitest excludes the integration directory. The smallest release gap is a real-server compatibility check. The current protected Dander bundle matches Druff's published pin byte-for-byte, so regenerating DTOs or changing runtime code would be false churn. + +### 2026-08-24 — release artifact record + +PR #23 merged as `34acec00dfc9aafe93a62b1e3ed2b1b807a66487`; exact-main CI run +`32787930579` passed all three required jobs. Active uses that merge commit. Rollback uses its green +PR head `55f1565f3cb8d83efb1c38d0552d13808867b1be`; both resolve to tree +`ce829147ef3b06cc73c4b4c892541977913686cb`. + +| Identity | Active | Rollback | +| --- | --- | --- | +| OCI index | `sha256:5ab559fe0c637407dd3398304d0480c73477cd770c073c92de4f8f2cda023eb9` | `sha256:bd1228bbe30a7f17ce3d0d9f9f4967e271a9b6fb9d010c8ffb648b2a8c19175d` | +| linux/amd64 | `sha256:df39b359f7e16f5ed21b9fe429bbd92b5d1bfdf55eede9ae13bfea5bf807a138` | `sha256:128fbb599b7fbaac4f6655210e118e8cd53da30cfaeab7e6fbb3352b0501d77d` | +| linux/arm64 | `sha256:cda7a83ad5343ca6766d79cb974d740137c77dbae73166c2aab9251a6f09060d` | `sha256:bcccc122f6b9cf15ce9dc4a211fc76a566eb816bb4d53bc4f82914bd623491f6` | +| Static layer | `sha256:d55b44dceb9c5300c6c709c29d48c442f66b917ed1594c3fe46475b50d43c6cd` | `sha256:09557745dfe7293e457107cc13b1c2185971d992e468220dc7a441eaa96f0a6a` | +| Static bundle | `904c7eb1629ba7ab60def188acbe4bc7d0db316954ffb91a8684aee5cec50865` | `8b1d86a49d02cf722de45993d7f1cfdee7bb2781e29b78c3b1476add2c761d2b` | +| OCI archive SHA-256 | `f40cf29112dd02dd639aa2be4fc93d661f1862d8b4bcc01695a1f42f80d33dfc` | `992ee53405f04bc6b47924eda4310a84e41cfd2763d850a3d4db964ab9eb30c4` | + +The archives are retained under `/Users/harrison/.codex/artifacts/druff/2026-08-24-release/`. +Each contains both platforms plus SPDX SBOM and SLSA provenance attestations. Exact promotion kept +the source index bytes unchanged; isolated repeat builds reproduced the static layer. Both platform +manifests for both artifacts passed Trivy 0.70.0 vulnerability and secret scanning with zero +HIGH/CRITICAL or secret findings. Both platforms also passed exported source-free checks and +read-only runtime route, probe, cache, and security-header verification. The production clients +passed again from protected Druff against protected Dander RC32 after the artifacts were retained.