Skip to content
This repository was archived by the owner on Aug 18, 2026. It is now read-only.

CHANGELOG.md

Latest commit

 

History

History
129 lines (117 loc) · 13.7 KB

CHANGELOG.md

File metadata and controls

129 lines (117 loc) · 13.7 KB
Raw

Changelog

0.1.0-alpha.6 — published corrective alpha release

  • P9-10 alpha.6 corrective release prep:
    • publishes 0.1.0-alpha.6 as the corrective alpha release;
    • keeps publishConfig.tag on alpha;
    • records that npm alpha and latest dist-tags point at 0.1.0-alpha.6, with GitHub Release v0.1.0-alpha.6 carrying the npm registry tarball asset and release:post-alpha:verify tarball parity passing;
    • records current registry state: 0.1.0-alpha.5 is published on npm, and npm alpha and latest dist-tags both point at 0.1.0-alpha.6;
    • records that GitHub Release v0.1.0-alpha.5 exists as a prerelease with the npm registry tarball asset and release:post-alpha:verify tarball parity passes;
    • records the alpha.5 stale-docs incident: the immutable alpha.5 npm tarball contains stale package docs, so aggregate published verification (published:verify / published:verify:evidence) fails with registry_packaged_docs_failed;
    • keeps alpha.4 as historical published state with stale release-prep package docs and GitHub Release tarball parity closed;
    • keeps 0.1.0-alpha.3 as historical corrective pre-alpha release, 0.1.0-alpha.2 as a stale pre-publish package-docs incident, 0.1.0-alpha.1 as earlier alpha history, and 0.1.0-alpha.0 as deprecated stale-docs history;
    • keeps npm registry metadata and GitHub Releases as the source of truth for available versions and dist-tags;
    • requires fresh release evidence before future beta promotion or stable promotion;
    • keeps .release-evidence/, current run ids, artifact ids, artifact digests, tarball hashes, pack hashes, local temporary paths, raw logs, prompts, and token-looking values outside packaged docs.

0.1.0-alpha.5 — published alpha with stale package docs

  • P9-9 alpha.5 real publish and post-publish closure:
    • publishes 0.1.0-alpha.5 to npm as the corrective alpha release that replaces stale alpha.4 package docs for consumers;
    • keeps publishConfig.tag on alpha and records that npm alpha and latest dist-tags both point at 0.1.0-alpha.6;
    • creates GitHub Release v0.1.0-alpha.5 as a prerelease with the npm registry tarball asset, so release:post-alpha:verify tarball parity passes for alpha.5;
    • verifies npm registry metadata, published smoke, published daemon lifecycle, published adapter fake-CLI contract gates, and GitHub Release tarball parity, but registry packaged-docs inspection fails because the immutable alpha.5 npm tarball contains stale package docs; published:verify and published:verify:evidence fail with registry_packaged_docs_failed;
    • preserves the alpha.4 facts: 0.1.0-alpha.4 is published on npm, GitHub Release v0.1.0-alpha.4 exists with the npm registry tarball asset, and release:post-alpha:verify tarball parity passes;
    • records that the immutable alpha.4 npm tarball contains stale release-prep package docs, so aggregate published verification for alpha.4 remains blocked by registry packaged-docs inspection;
    • future beta or stable promotion requires fresh release evidence for that target;
    • keeps real npm publish, npm dist-tag/deprecate changes, GitHub Release creation or editing, npm token/trusted publishing configuration, authenticated real agent runs, run ids, artifact digests, tarball hashes, local temp paths, raw logs, prompts, and token-looking values outside this package.

0.1.0-alpha.4 — published pre-alpha release

  • P9-7 alpha.4 npm publish:
    • publishes 0.1.0-alpha.4 to npm with the alpha dist-tag under the then-current pre-alpha tagging policy;
    • records that the immutable alpha.4 npm tarball contains stale release-prep package docs;
    • creates GitHub Release v0.1.0-alpha.4 as a prerelease with the npm registry tarball asset, so release:post-alpha:verify tarball parity passes;
    • verifies npm registry metadata, published smoke, published daemon lifecycle, and published adapter fake-CLI contract gates;
    • keeps the post-publish registry and verification summary outside the npm package under .release-evidence/;
    • keeps GitHub Release creation/editing, dist-tag repair, deprecate/unpublish, npm token/trusted publishing configuration, authenticated real agent runs, run ids, artifact digests, tarball hashes, local temp paths, raw logs, prompts, and token-looking values outside this package.
  • P9-5 alpha.4 release-prep:
    • prepares 0.1.0-alpha.4 package metadata as the next pre-alpha candidate after the published alpha.3 corrective line;
    • keeps npm registry metadata and GitHub Releases authoritative for available versions and dist-tags;
    • records the P9 stable surface gate and P9-4 fresh main release-candidate evidence as package-out release evidence, not as a substitute for alpha.4 publish evidence;
    • requires P9-6 fresh main release-candidate workflow evidence after this package-visible version/docs drift is merged to main;
    • treats package-content equivalence against the P9-4 release target as expected drift for package.json and packaged docs, so freshReleaseCandidateRequired remains true before any human publish decision;
    • keeps real npm publish, npm dist-tag/deprecate changes, GitHub Release creation or editing, npm token/trusted publishing configuration, authenticated real agent runs, run ids, artifact digests, tarball hashes, local temp paths, raw logs, prompts, and token-looking values outside this release-prep package.

0.1.0-alpha.3 — corrective pre-alpha release

  • P7-5 alpha.3 corrective release:
    • records that 0.1.0-alpha.2 was published but its immutable npm tarball kept stale pre-publish package docs;
    • recommends 0.1.0-alpha.3 as the corrective pre-alpha release for package consumers;
    • adds a packaged-docs verification gate that packs and unpacks the local tarball before publish;
    • extends published verification so registry tarball docs are downloaded, unpacked, and checked instead of trusting later repository docs;
    • keeps npm registry metadata and GitHub Releases authoritative for available versions and dist-tags;
    • keeps .release-evidence/, run ids, artifact ids, digests, tarball shasums, integrity values, local temporary paths, raw logs, raw CLI output, prompts, and token-looking values out of packaged docs.

0.1.0-alpha.2 — published pre-alpha release

  • P7-4 alpha.2 real publish and post-publish evidence:
    • publishes 0.1.0-alpha.2 to npm with the alpha dist-tag;
    • creates GitHub pre-release v0.1.0-alpha.2;
    • verifies registry version, dist-tags, installed-package CLI smoke, and GitHub Release metadata;
    • the published 0.1.0-alpha.2 npm tarball contains stale pre-publish package docs, so package consumers should use 0.1.0-alpha.3;
    • records post-publish evidence outside the npm package under .release-evidence/;
    • keeps current-run ids, artifact ids, digests, tarball shasums, pack shasums, local temporary paths, raw logs, raw CLI output, prompts, and token-looking values out of packaged docs.
  • P7-3 alpha.2 publish dry-run evidence:
    • records fresh main release-candidate evidence for the exact alpha.2 publish target;
    • records downloaded artifact verification with npm run release:verify -- --dir <normalized-downloaded-artifact-dir>;
    • records local npm publish --dry-run --ignore-scripts --tag alpha evidence while keeping real npm publish and GitHub Release creation human-gated;
    • keeps current-run ids, artifact ids, digests, tarball shasums, pack shasums, local temporary paths, raw logs, raw CLI output, prompts, and token-looking values out of packaged docs.
  • P7-1 alpha.2 package metadata preparation:
    • bumps package metadata to 0.1.0-alpha.2 while keeping the real npm registry state at the already published 0.1.0-alpha.1;
    • documents the human-controlled alpha.2 path: fresh release-candidate workflow, downloaded artifact verification with npm run release:verify, local npm publish --dry-run --ignore-scripts --tag alpha, then a separate explicit publish decision;
    • keeps current-run ids, artifact ids, digests, tarball shasums, pack shasums, local temporary paths, raw logs, raw CLI output, prompts, and token-looking values out of packaged docs.
  • P6 release-candidate gate consolidation:
    • preserves the offline real compatibility evidence verifier as a release gate through compat:real:evidence:verify;
    • keeps downloaded release-candidate artifacts at the five-artifact set: tarball, pack metadata, package file list, gate evidence, and release verification;
    • records daemon:verify, runtime:safety, and compat:real:evidence:verify in gate evidence without launching authenticated real Codex/Claude/OpenCode runs;
    • keeps .release-evidence/ and .reference/ outside the npm package boundary.

0.1.0-alpha.0 — pre-alpha developer preview (release-candidate hardening)

  • P3-10 pre-documentation alpha release-candidate evidence and human-gated publish packet:
    • refreshed pre-documentation release-candidate evidence for fdba3ebccb2e57a0ad295101028a2a3937a92204 through GitHub Actions run 27945938663;
    • re-verified all five downloaded artifacts with agent-cli-runtime.releaseVerification.v1 and empty diagnostics;
    • documented that committing this packaged evidence packet changes npm pack shasum, so run 27945938663 is not final post-documentation publish evidence;
    • retained P3-9 run 27943672095 for 65fac505ca3eb830a06d8656068cf4ed5f6dd46a as historical evidence only;
    • kept the publish boundary human-gated at npm publish --dry-run --ignore-scripts --tag alpha; no npm publish occurred, and a true publish requires fresh post-documentation release-candidate evidence.
  • P3-9 final alpha dry-run and evidence-target release readiness lock:
    • refreshed evidence-target release-candidate evidence for 65fac505ca3eb830a06d8656068cf4ed5f6dd46a through GitHub Actions run 27943672095;
    • re-verified all five downloaded artifacts with agent-cli-runtime.releaseVerification.v1 and empty diagnostics;
    • confirmed gate-evidence.json records daemon:verify and runtime:safety with packageSource: "installed-tarball";
    • tightened package boundary verification so published file paths cannot contain fixtures?;
    • passed local npm publish --dry-run --ignore-scripts --tag alpha without publishing npm.
  • P2-13 alpha publish readiness decision:
    • completed npm metadata review by adding repository, homepage, and bugs entries while keeping publishConfig.tag: "alpha";
    • added docs/release-publish-runbook.md for dry-run, future real publish commands, human confirmation points, dist-tag checks, rollback/deprecation/unpublish boundaries, 2FA, trusted publishing, provenance, and token strategy;
    • kept the workflows artifact-only and token-free, with contract coverage for no npm publish steps and no registry credential requirements;
    • kept package root value exports limited to createAgentRuntime and did not publish npm.
  • P2-10 release candidate artifact and remote CI audit:
    • added docs/release-report.md for local verification, remote workflow evidence expectations, artifact review, package boundary, real CLI evidence boundaries, known risks, and explicit non-goals;
    • hardened the manual release-candidate workflow with package file-list validation and explicit artifact retention while keeping it workflow_dispatch only;
    • added static workflow contract coverage for Node.js 20/22/24 CI, single-Node dogfood, release-candidate artifact uploads, and no publish/token steps;
    • documented npm publish --dry-run --ignore-scripts --tag alpha as a local manual dry-run gate without making it a remote CI requirement.
  • P2-9 release candidate API and consumer compatibility gate:
    • froze the package-root value API to createAgentRuntime plus documented public TypeScript types;
    • moved store/diagnostics public type shapes behind public-types instead of root re-exporting storage internals;
    • added built-package root contract tests and tarball TypeScript consumer tsc --noEmit smoke;
    • added installed-package fake library run/goal/replay/diagnostics smoke without real CLI credentials;
    • hardened CLI --json error output for parseable redacted exit-code-1 failures;
    • refreshed compatibility evidence for 2026-06-20 local detection/preflight without claiming skipped/auth-missing runs succeeded.
  • P2-8 crash-consistency and repair safety:
    • added fault-injected coverage for manifest temp writes, rename, JSONL append, fsync/fdatasync fallback, repair backup/rewrite, and lock acquire/close paths;
    • preserved old manifests on failed writes, converted append failures into terminal diagnostics, and kept repair backup/rewrite failures non-destructive and diagnosable;
    • kept corrupt lock read-only inspection, repair diagnostics, and package artifacts redacted.
  • P2-7 durable store repair hardening:
    • made store-repair --apply explicit, lease-aware, backup-backed, idempotent, and live-owner refusing;
    • kept store-repair --dry-run --json non-destructive with redacted planned actions;
    • documented repair as local JSONL partial/corrupt record repair, not WAL, database transactions, daemon resume, or compaction.
  • Release hygiene and package boundary finalization for P1-8.
  • Added CHANGELOG.md, SECURITY.md, and CONTRIBUTING.md.
  • Clarified API and install contract: package root intentionally exposes only createAgentRuntime as the value export and public facade types; adapter/parser/internal helpers stay internal.
  • Added npm install smoke verification path (pack → install → ESM import → CLI execution) into contract tests.
  • Documented pre-alpha / developer preview API stability and scope:
    • no stable API guarantee,
    • no daemon,
    • no WAL,
    • no remote runtime mode.
  • Confirmed package packaging boundary excludes .reference/, tests/, and fixture paths; redaction and secrets hygiene remains enforced in diagnostics and package artifacts.