diff --git a/CHANGELOG.md b/CHANGELOG.md index 83b8ca2..f9980cb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,8 @@ # Changelog All notable changes to Agent Runtime Services are documented in this file. The -project follows Semantic Versioning after its first published release; until -then, the `Unreleased` section is the release-candidate source of truth. +project follows Semantic Versioning, and the `Unreleased` section is the source +of truth for the next release candidate. ## [Unreleased] @@ -50,6 +50,10 @@ No entries. an unconfigured runtime returned `missing_resource` for all model modules. - The packed manifest preserved the CLI mapping and the packed CLI executed `--version` and `--help` successfully. +- Published `agent-runtime-services@0.1.0` to the public npm registry. A fresh + install with an isolated empty npm cache passed CLI version/help, public API + import, and installed bin mapping checks; `v0.1.0` resolves to release commit + `47b472bb9cbd0e38eb4c3a998ff086d94889d63a`. ### Residual Risks diff --git a/architecture/project-traceability.md b/architecture/project-traceability.md index 2931d7f..b7bd208 100644 --- a/architecture/project-traceability.md +++ b/architecture/project-traceability.md @@ -11,21 +11,22 @@ risk without treating validation as publication approval. | `RPC-JSONRPC-002` | `PRD.md`; `rpc-transport-contract.md` | `src/rpc/server.ts` | RPC protocol matrix | Validated local | | `RPC-BODY-003` | `PRD.md`; `rpc-transport-contract.md` | `src/rpc/server.ts` | oversized-request regression | Validated local | | `RELEASE-GATE-004` | `PRD.md`; `rpc-transport-contract.md` | `package.json`, GitHub Actions | `pnpm release:check` | Validated local | -| `PACKAGE-INTEGRITY-001` | `PRD.md`; `release-readiness-contract.md` | package metadata and packed consumer | release check and tarball acceptance | Validated local | +| `PACKAGE-INTEGRITY-001` | `PRD.md`; `release-readiness-contract.md` | package metadata and packed consumer | release check, tarball acceptance, and fresh registry install | Registry-verified | | `CONSUMER-COMPATIBILITY-002` | `PRD.md`; `release-readiness-contract.md` | public library/RPC adapters | clean consumer snapshots against the tarball | Validated snapshots | | `DEPENDENCY-SECURITY-003` | `PRD.md`; `release-readiness-contract.md` | package and CI scripts | `pnpm security:audit` | Validated current | | `PROVIDER-SMOKE-004` | `PRD.md`; `release-readiness-contract.md` | operator model/resource commands | real provider smoke | Real provider validated | -| `PUBLICATION-OWNER-005` | `PRD.md`; `release-readiness-contract.md` | version, changelog, package metadata | owner approval and registry/tag evidence | Publication approved | +| `PUBLICATION-OWNER-005` | `PRD.md`; `release-readiness-contract.md` | version, changelog, package metadata | owner approval and registry/tag evidence | Published and registry-verified | -## Residual Release Gates +## Residual Operational and Adoption Gates -- npm registry publication, fresh installation, and release tag verification; - acceptance in concrete domain-agent and build-agent consumers; - any remote, non-loopback, or MCP exposure. -The npm publication destination is the public npm registry. The owner approved -publication after validation on 2026-07-22. Remaining gates stay open until -direct post-publication or product-acceptance evidence exists. +`agent-runtime-services@0.1.0` was published to the public npm registry after +owner approval on 2026-07-22. Registry metadata, package ownership, a fresh +installation, and the `v0.1.0` tag were verified against release commit +`47b472bb9cbd0e38eb4c3a998ff086d94889d63a`. Concrete consumer acceptance and +production operation remain separate from package publication. ## Current Validation Baseline @@ -33,6 +34,12 @@ direct post-publication or product-acceptance evidence exists. Node 22; typecheck, build, and the 21-file package dry-run passed. - The packed package manifest retained the `agent-runtime-services` CLI bin mapping, and the packed CLI executed `--version` and `--help` successfully. +- The public registry reports `agent-runtime-services@0.1.0` with shasum + `9427c0af2dd040e0eb80fdad408e0a6fe759e34f`. A fresh install using an isolated + empty npm cache passed CLI version/help, public API import, and installed bin + mapping checks. The registry owner is `cloudsbeyond`. +- Annotated tag `v0.1.0` resolves locally and on `origin` to release commit + `47b472bb9cbd0e38eb4c3a998ff086d94889d63a`. - `pnpm security:audit`: no known production dependency vulnerabilities at the time of the check. - A dedicated isolated runtime home reported `readiness: ok`; real language, @@ -46,9 +53,9 @@ direct post-publication or product-acceptance evidence exists. installed the same tarball and passed 8 focused integration tests plus typecheck. -These observations are revision-specific L4 evidence. They do not establish -acceptance of uncommitted consumer work, npm registry availability, or -production operation. +These observations are revision-specific L4 evidence. They establish package +publication and registry installation at the observation time, but do not +establish acceptance of future consumer revisions or production operation. Node 22 also exposed an environment-specific residue: enabling the experimental `NODE_USE_ENV_PROXY` flag makes Node itself emit `EnvHttpProxyAgent` warnings on diff --git a/architecture/project-traceability.yaml b/architecture/project-traceability.yaml index 1d1015d..205eaec 100644 --- a/architecture/project-traceability.yaml +++ b/architecture/project-traceability.yaml @@ -15,8 +15,19 @@ validation_baseline: fail_closed: all model modules returned missing_resource and a non-zero exit without credentials publication: owner_approved_at: 2026-07-22 + published_at: 2026-07-22 + package: agent-runtime-services + version: 0.1.0 destination: https://registry.npmjs.org/ access: public + owner: cloudsbeyond + release_commit: 47b472bb9cbd0e38eb4c3a998ff086d94889d63a + release_tag: v0.1.0 + tarball: https://registry.npmjs.org/agent-runtime-services/-/agent-runtime-services-0.1.0.tgz + integrity: sha512-qwiO8abN9iW4tltynFA9ZHZh49v3VX9DEza0e1O2vF9RqxS71ZXNZR4oS2EOrTYt3qcl7AdtMDJmDpZBpcxLGQ== + shasum: 9427c0af2dd040e0eb80fdad408e0a6fe759e34f + fresh_registry_install: passed + installed_validation: CLI version and help passed; public API imports and bin mapping passed packed_consumers: - role: domain-agent session navigation source_revision: 4c200a13a5331cf5df213f8a73d3b9bee583983a @@ -101,10 +112,10 @@ requirements: - packed package manifest retains the agent-runtime-services bin mapping - packed CLI executes --version and --help residual_risk: - - Consumer acceptance, npm publication, and production operation require separate evidence. + - Concrete consumer product acceptance and production operation require separate evidence. - Node 22 with the experimental NODE_USE_ENV_PROXY flag emits runtime warnings on stderr; the CI-like matrix without that experimental flag passes. - id: PACKAGE-INTEGRITY-001 - status: validated_local + status: registry_verified prd_refs: - PRD.md#p0-scope - PRD.md#downstream-chain @@ -115,8 +126,10 @@ requirements: - test/cli-rpc-smoke.test.ts validation: - pnpm release:check + - fresh public-registry installation with an isolated empty npm cache + - installed CLI version and help, public API imports, and bin mapping residual_risk: - - npm publication and registry installation remain owner-controlled gates. + - Registry availability and package-manager compatibility remain time-sensitive operational dependencies. - id: CONSUMER-COMPATIBILITY-002 status: validated_snapshot prd_refs: @@ -161,7 +174,7 @@ requirements: residual_risk: - Provider availability and credentials remain time-sensitive operational dependencies. - id: PUBLICATION-OWNER-005 - status: approved + status: published prd_refs: - PRD.md#owner-boundary yaml_refs: @@ -171,6 +184,8 @@ requirements: - CHANGELOG.md validation: - explicit owner approval on 2026-07-22 for npm publication after validation - - registry and tag verification after publication + - public registry metadata and owner verified for agent-runtime-services@0.1.0 + - fresh registry installation validated CLI version and help, public API imports, and bin mapping + - annotated v0.1.0 tag verified locally and on origin at release commit 47b472bb9cbd0e38eb4c3a998ff086d94889d63a residual_risk: - - Registry publication and release tag verification remain pending until the publish command succeeds. + - Registry availability and npm account ownership remain time-sensitive operational dependencies. diff --git a/test/publication-identity.test.ts b/test/publication-identity.test.ts index 27b14ab..c8eef8e 100644 --- a/test/publication-identity.test.ts +++ b/test/publication-identity.test.ts @@ -86,18 +86,22 @@ describe('publication identity', () => { } }); - test('0.1.0 release evidence records provider validation and publication approval', async () => { + test('0.1.0 release evidence records provider validation and verified publication', async () => { const [traceability, humanTraceability] = await Promise.all([ readFile(join(repoRoot, 'architecture', 'project-traceability.yaml'), 'utf8'), readFile(join(repoRoot, 'architecture', 'project-traceability.md'), 'utf8'), ]); expect(traceability).toMatch(/id: PROVIDER-SMOKE-004\n\s+status: validated_real/); - expect(traceability).toMatch(/id: PUBLICATION-OWNER-005\n\s+status: approved/); + expect(traceability).toMatch(/id: PUBLICATION-OWNER-005\n\s+status: published/); + expect(traceability).toContain('version: 0.1.0'); + expect(traceability).toContain('shasum: 9427c0af2dd040e0eb80fdad408e0a6fe759e34f'); + expect(traceability).toContain('release_commit: 47b472bb9cbd0e38eb4c3a998ff086d94889d63a'); + expect(traceability).toContain('fresh_registry_install: passed'); expect(humanTraceability).toContain('| `PROVIDER-SMOKE-004`'); expect(humanTraceability).toContain('| Real provider validated |'); expect(humanTraceability).toContain('| `PUBLICATION-OWNER-005`'); - expect(humanTraceability).toContain('| Publication approved |'); + expect(humanTraceability).toContain('| Published and registry-verified |'); }); test('package identity is Agent Runtime Services while retaining upstream attribution', async () => {