chore: prepare 0.1.0 npm release

CHANGELOG.md

@@ -6,8 +6,17 @@ then, the `Unreleased` section is the release-candidate source of truth.
 
 ## [Unreleased]
 
+No entries.
+
+## [0.1.0] - 2026-07-22
+
 ### Added
 
+- Established Runtime Core and Agent Services with local JSON-RPC, model,
+  artifact, record, memory, vector, resource, secret, and provider-port
+  capabilities.
+- Added atomic record compare-and-set with fail-closed provider capability
+  negotiation.
 - `RPC-LOOPBACK-001`: fail-closed loopback validation for the local RPC server.
 - `RPC-JSONRPC-002`: JSON-RPC 2.0 parse, request, method, parameter, and internal
   error classification.
@@ -24,24 +33,18 @@ then, the `Unreleased` section is the release-candidate source of truth.
 
 ### Validation Evidence
 
-- The release-candidate gate passed 116 tests across 15 test files under Node 20
+- The release-candidate gate passed 117 tests across 15 test files under Node 20
   and Node 22, plus typecheck, build, and a 21-file package dry-run.
 - The production dependency audit reported no known vulnerabilities at the time
   of validation.
 - Two clean external consumer snapshots installed the same generated tarball:
   one passed 51 focused integration tests plus typecheck, and one passed 8
   focused integration tests plus typecheck.
+- An isolated runtime home reported `readiness: ok`; real language, embedding,
+  and vision calls succeeded, smoke output contained no configured secret, and
+  an unconfigured runtime returned `missing_resource` for all model modules.
 
-### Not Yet Proven
+### Residual Risks
 
-- Real provider smoke with owner-managed credentials.
 - Acceptance in concrete domain-agent and build-agent repositories.
-- npm publication and production operation.
-
-## [0.1.0] - Unpublished baseline
-
-- Established Runtime Core and Agent Services with local JSON-RPC, model,
-  artifact, record, memory, vector, resource, secret, and provider-port
-  capabilities.
-- Added atomic record compare-and-set with fail-closed provider capability
-  negotiation.
+- Production operation and any non-loopback or remote MCP exposure.

architecture/project-traceability.md

@@ -14,32 +14,38 @@ risk without treating validation as publication approval.
 | `PACKAGE-INTEGRITY-001` | `PRD.md`; `release-readiness-contract.md` | package metadata and packed consumer | release check and tarball acceptance | Validated local |
 | `CONSUMER-COMPATIBILITY-002` | `PRD.md`; `release-readiness-contract.md` | public library/RPC adapters | clean consumer snapshots against the tarball | Validated snapshots |
 | `DEPENDENCY-SECURITY-003` | `PRD.md`; `release-readiness-contract.md` | package and CI scripts | `pnpm security:audit` | Validated current |
-| `PROVIDER-SMOKE-004` | `PRD.md`; `release-readiness-contract.md` | operator model/resource commands | real provider smoke | Owner gate |
-| `PUBLICATION-OWNER-005` | `PRD.md`; `release-readiness-contract.md` | version, changelog, package metadata | owner approval and registry/tag evidence | Owner gate |
+| `PROVIDER-SMOKE-004` | `PRD.md`; `release-readiness-contract.md` | operator model/resource commands | real provider smoke | Real provider validated |
+| `PUBLICATION-OWNER-005` | `PRD.md`; `release-readiness-contract.md` | version, changelog, package metadata | owner approval and registry/tag evidence | Publication approved |
 
-## Residual Owner Gates
+## Residual Release Gates
 
-- selecting internal tarball/Git distribution or npm publication;
-- real provider credentials and smoke execution;
+- npm registry publication, fresh installation, and release tag verification;
 - acceptance in concrete domain-agent and build-agent consumers;
 - any remote, non-loopback, or MCP exposure.
 
-These gates remain open until direct evidence and owner approval exist.
+The npm publication destination is the public npm registry. The owner approved
+publication after validation on 2026-07-22. Remaining gates stay open until
+direct post-publication or product-acceptance evidence exists.
 
 ## Current Validation Baseline
 
-- `pnpm release:check`: 15 test files and 116 tests passed under Node 20 and
+- `pnpm release:check`: 15 test files and 117 tests passed under Node 20 and
   Node 22; typecheck, build, and the 21-file package dry-run passed.
 - `pnpm security:audit`: no known production dependency vulnerabilities at the
   time of the check.
+- A dedicated isolated runtime home reported `readiness: ok`; real language,
+  embedding, and vision model smoke calls succeeded. Exact-value comparison
+  found no configured secret in command output. A second runtime home without
+  credentials returned `missing_resource` and a non-zero exit for every model
+  module.
 - Clean consumer snapshot `4c200a13a5331cf5df213f8a73d3b9bee583983a`
   installed the tarball and passed 51 focused integration tests plus typecheck.
 - Clean consumer snapshot `0571b678563e82ab5ec6032ff7eccb13ffc6188c`
   installed the same tarball and passed 8 focused integration tests plus
   typecheck.
 
-These observations are revision-specific L4 evidence. They do not cover
-uncommitted consumer work, real provider credentials, npm publication, or
+These observations are revision-specific L4 evidence. They do not establish
+acceptance of uncommitted consumer work, npm registry availability, or
 production operation.
 
 Node 22 also exposed an environment-specific residue: enabling the experimental

architecture/project-traceability.yaml

@@ -3,10 +3,20 @@ validation_baseline:
   observed_at: 2026-07-22
   release_candidate:
     command: pnpm release:check
-    result: 15 test files and 116 tests passed on Node 20 and Node 22; typecheck, build, and 21-file package dry-run passed
+    result: 15 test files and 117 tests passed on Node 20 and Node 22; typecheck, build, and 21-file package dry-run passed
   dependency_security:
     command: pnpm security:audit
     result: no known production dependency vulnerabilities
+  provider_smoke:
+    runtime_home: isolated owner-configured release home
+    command: agent-runtime-services models smoke --module all
+    result: language ok with 4 text characters; embedding ok with 2048 dimensions; vision ok with a URL artifact
+    secret_non_disclosure: exact configured secret absent from command output
+    fail_closed: all model modules returned missing_resource and a non-zero exit without credentials
+  publication:
+    owner_approved_at: 2026-07-22
+    destination: https://registry.npmjs.org/
+    access: public
   packed_consumers:
     - role: domain-agent session navigation
       source_revision: 4c200a13a5331cf5df213f8a73d3b9bee583983a
@@ -89,7 +99,7 @@ requirements:
     validation:
       - pnpm release:check
     residual_risk:
-      - Real provider smoke, consumer acceptance, npm publication, and production operation require separate evidence.
+      - Consumer acceptance, npm publication, and production operation require separate evidence.
       - Node 22 with the experimental NODE_USE_ENV_PROXY flag emits runtime warnings on stderr; the CI-like matrix without that experimental flag passes.
   - id: PACKAGE-INTEGRITY-001
     status: validated_local
@@ -135,7 +145,7 @@ requirements:
     residual_risk:
       - Advisory results are time-sensitive and must be refreshed for each release candidate.
   - id: PROVIDER-SMOKE-004
-    status: owner_gate
+    status: validated_real
     prd_refs:
       - PRD.md#owner-boundary
     yaml_refs:
@@ -147,9 +157,9 @@ requirements:
       - agent-runtime-services models smoke --module all
       - agent-runtime-services doctor
     residual_risk:
-      - Requires owner-managed credentials and a selected real provider configuration.
+      - Provider availability and credentials remain time-sensitive operational dependencies.
   - id: PUBLICATION-OWNER-005
-    status: owner_gate
+    status: approved
     prd_refs:
       - PRD.md#owner-boundary
     yaml_refs:
@@ -158,7 +168,7 @@ requirements:
       - package.json
       - CHANGELOG.md
     validation:
-      - explicit owner approval
+      - explicit owner approval on 2026-07-22 for npm publication after validation
       - registry and tag verification after publication
     residual_risk:
-      - Package is not published and no release tag exists.
+      - Registry publication and release tag verification remain pending until the publish command succeeds.

package.json

@@ -11,6 +11,10 @@
     "url": "https://github.com/cloudsbeyond/agent-runtime-services/issues"
   },
   "homepage": "https://github.com/cloudsbeyond/agent-runtime-services#readme",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
   "type": "module",
   "bin": {
     "agent-runtime-services": "./bin/agent-runtime-services.mjs"

test/publication-identity.test.ts

@@ -45,19 +45,31 @@ describe('publication identity', () => {
       readFile(join(repoRoot, 'CHANGELOG.md'), 'utf8').catch(() => ''),
       readFile(join(repoRoot, 'architecture', 'release-readiness-contract.md'), 'utf8').catch(() => ''),
     ]);
-    const pkg = JSON.parse(pkgRaw) as { files?: string[]; scripts?: Record<string, string> };
+    const pkg = JSON.parse(pkgRaw) as {
+      files?: string[];
+      publishConfig?: { access?: string; registry?: string };
+      scripts?: Record<string, string>;
+      version?: string;
+    };
 
     expect(pkg.scripts?.['release:check']).toBe(
       'pnpm test && pnpm typecheck && pnpm build && npm pack --dry-run --ignore-scripts',
     );
     expect(pkg.scripts?.prepublishOnly).toBe('pnpm test:acceptance && pnpm release:check');
+    expect(pkg.version).toBe('0.1.0');
+    expect(pkg.publishConfig).toEqual({
+      access: 'public',
+      registry: 'https://registry.npmjs.org/',
+    });
     expect(pkg.files).toContain('CHANGELOG.md');
     expect(workflow).toContain('pnpm release:check');
     expect(workflow).toContain('pnpm security:audit');
     expect(workflow).toMatch(/node-version:\s*\[20, 22\]/);
     expect(workflow).toContain('pnpm install --frozen-lockfile');
     expect(pkg.scripts?.['security:audit']).toBe('pnpm audit --prod --audit-level high');
     expect(changelog).toContain('## [Unreleased]');
+    expect(changelog).toContain('## [0.1.0] - 2026-07-22');
+    expect(changelog).not.toContain('Unpublished baseline');
     expect(changelog).toContain('RPC-LOOPBACK-001');
     for (const gate of [
       'PACKAGE-INTEGRITY-001',
@@ -70,6 +82,20 @@ describe('publication identity', () => {
     }
   });
 
+  test('0.1.0 release evidence records provider validation and publication approval', async () => {
+    const [traceability, humanTraceability] = await Promise.all([
+      readFile(join(repoRoot, 'architecture', 'project-traceability.yaml'), 'utf8'),
+      readFile(join(repoRoot, 'architecture', 'project-traceability.md'), 'utf8'),
+    ]);
+
+    expect(traceability).toMatch(/id: PROVIDER-SMOKE-004\n\s+status: validated_real/);
+    expect(traceability).toMatch(/id: PUBLICATION-OWNER-005\n\s+status: approved/);
+    expect(humanTraceability).toContain('| `PROVIDER-SMOKE-004`');
+    expect(humanTraceability).toContain('| Real provider validated |');
+    expect(humanTraceability).toContain('| `PUBLICATION-OWNER-005`');
+    expect(humanTraceability).toContain('| Publication approved |');
+  });
+
   test('package identity is Agent Runtime Services while retaining upstream attribution', async () => {
     const license = await readFile(join(repoRoot, 'LICENSE'), 'utf8');
     const notice = await readFile(join(repoRoot, 'NOTICE'), 'utf8');