From b03352ced186387c737144c02e5134f6092e0de2 Mon Sep 17 00:00:00 2001 From: Clouds Beyond <34269366+cloudsbeyond@users.noreply.github.com> Date: Wed, 22 Jul 2026 14:59:11 +0800 Subject: [PATCH] chore: prepare 0.1.0 release Change-Id: I5d6ee7edb102671f7a590a6408ee2c115a8bb6f2 --- CHANGELOG.md | 27 ++++++++++++++----------- architecture/project-traceability.md | 24 +++++++++++++--------- architecture/project-traceability.yaml | 24 +++++++++++++++------- package.json | 4 ++++ test/publication-identity.test.ts | 28 +++++++++++++++++++++++++- 5 files changed, 78 insertions(+), 29 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c4715a8..5ed3338 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,8 +6,17 @@ then, the `Unreleased` section is the release-candidate source of truth. ## [Unreleased] +No entries. + +## [0.1.0] - 2026-07-22 + ### Added +- Established Runtime Core and Agent Services with local JSON-RPC, model, + artifact, record, memory, vector, resource, secret, and provider-port + capabilities. +- Added atomic record compare-and-set with fail-closed provider capability + negotiation. - `RPC-LOOPBACK-001`: fail-closed loopback validation for the local RPC server. - `RPC-JSONRPC-002`: JSON-RPC 2.0 parse, request, method, parameter, and internal error classification. @@ -24,24 +33,18 @@ then, the `Unreleased` section is the release-candidate source of truth. ### Validation Evidence -- The release-candidate gate passed 116 tests across 15 test files under Node 20 +- The release-candidate gate passed 117 tests across 15 test files under Node 20 and Node 22, plus typecheck, build, and a 21-file package dry-run. - The production dependency audit reported no known vulnerabilities at the time of validation. - Two clean external consumer snapshots installed the same generated tarball: one passed 51 focused integration tests plus typecheck, and one passed 8 focused integration tests plus typecheck. +- An isolated runtime home reported `readiness: ok`; real language, embedding, + and vision calls succeeded, smoke output contained no configured secret, and + an unconfigured runtime returned `missing_resource` for all model modules. -### Not Yet Proven +### Residual Risks -- Real provider smoke with owner-managed credentials. - Acceptance in concrete domain-agent and build-agent repositories. -- npm publication and production operation. - -## [0.1.0] - Unpublished baseline - -- Established Runtime Core and Agent Services with local JSON-RPC, model, - artifact, record, memory, vector, resource, secret, and provider-port - capabilities. -- Added atomic record compare-and-set with fail-closed provider capability - negotiation. +- Production operation and any non-loopback or remote MCP exposure. diff --git a/architecture/project-traceability.md b/architecture/project-traceability.md index 06a3ef7..2be4135 100644 --- a/architecture/project-traceability.md +++ b/architecture/project-traceability.md @@ -14,32 +14,38 @@ risk without treating validation as publication approval. | `PACKAGE-INTEGRITY-001` | `PRD.md`; `release-readiness-contract.md` | package metadata and packed consumer | release check and tarball acceptance | Validated local | | `CONSUMER-COMPATIBILITY-002` | `PRD.md`; `release-readiness-contract.md` | public library/RPC adapters | clean consumer snapshots against the tarball | Validated snapshots | | `DEPENDENCY-SECURITY-003` | `PRD.md`; `release-readiness-contract.md` | package and CI scripts | `pnpm security:audit` | Validated current | -| `PROVIDER-SMOKE-004` | `PRD.md`; `release-readiness-contract.md` | operator model/resource commands | real provider smoke | Owner gate | -| `PUBLICATION-OWNER-005` | `PRD.md`; `release-readiness-contract.md` | version, changelog, package metadata | owner approval and registry/tag evidence | Owner gate | +| `PROVIDER-SMOKE-004` | `PRD.md`; `release-readiness-contract.md` | operator model/resource commands | real provider smoke | Real provider validated | +| `PUBLICATION-OWNER-005` | `PRD.md`; `release-readiness-contract.md` | version, changelog, package metadata | owner approval and registry/tag evidence | Publication approved | -## Residual Owner Gates +## Residual Release Gates -- selecting internal tarball/Git distribution or npm publication; -- real provider credentials and smoke execution; +- npm registry publication, fresh installation, and release tag verification; - acceptance in concrete domain-agent and build-agent consumers; - any remote, non-loopback, or MCP exposure. -These gates remain open until direct evidence and owner approval exist. +The npm publication destination is the public npm registry. The owner approved +publication after validation on 2026-07-22. Remaining gates stay open until +direct post-publication or product-acceptance evidence exists. ## Current Validation Baseline -- `pnpm release:check`: 15 test files and 116 tests passed under Node 20 and +- `pnpm release:check`: 15 test files and 117 tests passed under Node 20 and Node 22; typecheck, build, and the 21-file package dry-run passed. - `pnpm security:audit`: no known production dependency vulnerabilities at the time of the check. +- A dedicated isolated runtime home reported `readiness: ok`; real language, + embedding, and vision model smoke calls succeeded. Exact-value comparison + found no configured secret in command output. A second runtime home without + credentials returned `missing_resource` and a non-zero exit for every model + module. - Clean consumer snapshot `4c200a13a5331cf5df213f8a73d3b9bee583983a` installed the tarball and passed 51 focused integration tests plus typecheck. - Clean consumer snapshot `0571b678563e82ab5ec6032ff7eccb13ffc6188c` installed the same tarball and passed 8 focused integration tests plus typecheck. -These observations are revision-specific L4 evidence. They do not cover -uncommitted consumer work, real provider credentials, npm publication, or +These observations are revision-specific L4 evidence. They do not establish +acceptance of uncommitted consumer work, npm registry availability, or production operation. Node 22 also exposed an environment-specific residue: enabling the experimental diff --git a/architecture/project-traceability.yaml b/architecture/project-traceability.yaml index 74fdcca..678d0b7 100644 --- a/architecture/project-traceability.yaml +++ b/architecture/project-traceability.yaml @@ -3,10 +3,20 @@ validation_baseline: observed_at: 2026-07-22 release_candidate: command: pnpm release:check - result: 15 test files and 116 tests passed on Node 20 and Node 22; typecheck, build, and 21-file package dry-run passed + result: 15 test files and 117 tests passed on Node 20 and Node 22; typecheck, build, and 21-file package dry-run passed dependency_security: command: pnpm security:audit result: no known production dependency vulnerabilities + provider_smoke: + runtime_home: isolated owner-configured release home + command: agent-runtime-services models smoke --module all + result: language ok with 4 text characters; embedding ok with 2048 dimensions; vision ok with a URL artifact + secret_non_disclosure: exact configured secret absent from command output + fail_closed: all model modules returned missing_resource and a non-zero exit without credentials + publication: + owner_approved_at: 2026-07-22 + destination: https://registry.npmjs.org/ + access: public packed_consumers: - role: domain-agent session navigation source_revision: 4c200a13a5331cf5df213f8a73d3b9bee583983a @@ -89,7 +99,7 @@ requirements: validation: - pnpm release:check residual_risk: - - Real provider smoke, consumer acceptance, npm publication, and production operation require separate evidence. + - Consumer acceptance, npm publication, and production operation require separate evidence. - Node 22 with the experimental NODE_USE_ENV_PROXY flag emits runtime warnings on stderr; the CI-like matrix without that experimental flag passes. - id: PACKAGE-INTEGRITY-001 status: validated_local @@ -135,7 +145,7 @@ requirements: residual_risk: - Advisory results are time-sensitive and must be refreshed for each release candidate. - id: PROVIDER-SMOKE-004 - status: owner_gate + status: validated_real prd_refs: - PRD.md#owner-boundary yaml_refs: @@ -147,9 +157,9 @@ requirements: - agent-runtime-services models smoke --module all - agent-runtime-services doctor residual_risk: - - Requires owner-managed credentials and a selected real provider configuration. + - Provider availability and credentials remain time-sensitive operational dependencies. - id: PUBLICATION-OWNER-005 - status: owner_gate + status: approved prd_refs: - PRD.md#owner-boundary yaml_refs: @@ -158,7 +168,7 @@ requirements: - package.json - CHANGELOG.md validation: - - explicit owner approval + - explicit owner approval on 2026-07-22 for npm publication after validation - registry and tag verification after publication residual_risk: - - Package is not published and no release tag exists. + - Registry publication and release tag verification remain pending until the publish command succeeds. diff --git a/package.json b/package.json index a8102bd..02b0eb6 100644 --- a/package.json +++ b/package.json @@ -11,6 +11,10 @@ "url": "https://github.com/cloudsbeyond/agent-runtime-services/issues" }, "homepage": "https://github.com/cloudsbeyond/agent-runtime-services#readme", + "publishConfig": { + "access": "public", + "registry": "https://registry.npmjs.org/" + }, "type": "module", "bin": { "agent-runtime-services": "./bin/agent-runtime-services.mjs" diff --git a/test/publication-identity.test.ts b/test/publication-identity.test.ts index 75ad77f..c01a177 100644 --- a/test/publication-identity.test.ts +++ b/test/publication-identity.test.ts @@ -45,12 +45,22 @@ describe('publication identity', () => { readFile(join(repoRoot, 'CHANGELOG.md'), 'utf8').catch(() => ''), readFile(join(repoRoot, 'architecture', 'release-readiness-contract.md'), 'utf8').catch(() => ''), ]); - const pkg = JSON.parse(pkgRaw) as { files?: string[]; scripts?: Record }; + const pkg = JSON.parse(pkgRaw) as { + files?: string[]; + publishConfig?: { access?: string; registry?: string }; + scripts?: Record; + version?: string; + }; expect(pkg.scripts?.['release:check']).toBe( 'pnpm test && pnpm typecheck && pnpm build && npm pack --dry-run --ignore-scripts', ); expect(pkg.scripts?.prepublishOnly).toBe('pnpm test:acceptance && pnpm release:check'); + expect(pkg.version).toBe('0.1.0'); + expect(pkg.publishConfig).toEqual({ + access: 'public', + registry: 'https://registry.npmjs.org/', + }); expect(pkg.files).toContain('CHANGELOG.md'); expect(workflow).toContain('pnpm release:check'); expect(workflow).toContain('pnpm security:audit'); @@ -58,6 +68,8 @@ describe('publication identity', () => { expect(workflow).toContain('pnpm install --frozen-lockfile'); expect(pkg.scripts?.['security:audit']).toBe('pnpm audit --prod --audit-level high'); expect(changelog).toContain('## [Unreleased]'); + expect(changelog).toContain('## [0.1.0] - 2026-07-22'); + expect(changelog).not.toContain('Unpublished baseline'); expect(changelog).toContain('RPC-LOOPBACK-001'); for (const gate of [ 'PACKAGE-INTEGRITY-001', @@ -70,6 +82,20 @@ describe('publication identity', () => { } }); + test('0.1.0 release evidence records provider validation and publication approval', async () => { + const [traceability, humanTraceability] = await Promise.all([ + readFile(join(repoRoot, 'architecture', 'project-traceability.yaml'), 'utf8'), + readFile(join(repoRoot, 'architecture', 'project-traceability.md'), 'utf8'), + ]); + + expect(traceability).toMatch(/id: PROVIDER-SMOKE-004\n\s+status: validated_real/); + expect(traceability).toMatch(/id: PUBLICATION-OWNER-005\n\s+status: approved/); + expect(humanTraceability).toContain('| `PROVIDER-SMOKE-004`'); + expect(humanTraceability).toContain('| Real provider validated |'); + expect(humanTraceability).toContain('| `PUBLICATION-OWNER-005`'); + expect(humanTraceability).toContain('| Publication approved |'); + }); + test('package identity is Agent Runtime Services while retaining upstream attribution', async () => { const license = await readFile(join(repoRoot, 'LICENSE'), 'utf8'); const notice = await readFile(join(repoRoot, 'NOTICE'), 'utf8');