docs: record 0.1.0 publication evidence

CHANGELOG.md

@@ -1,8 +1,8 @@
 # Changelog
 
 All notable changes to Agent Runtime Services are documented in this file. The
-project follows Semantic Versioning after its first published release; until
-then, the `Unreleased` section is the release-candidate source of truth.
+project follows Semantic Versioning, and the `Unreleased` section is the source
+of truth for the next release candidate.
 
 ## [Unreleased]
 
@@ -50,6 +50,10 @@ No entries.
   an unconfigured runtime returned `missing_resource` for all model modules.
 - The packed manifest preserved the CLI mapping and the packed CLI executed
   `--version` and `--help` successfully.
+- Published `agent-runtime-services@0.1.0` to the public npm registry. A fresh
+  install with an isolated empty npm cache passed CLI version/help, public API
+  import, and installed bin mapping checks; `v0.1.0` resolves to release commit
+  `47b472bb9cbd0e38eb4c3a998ff086d94889d63a`.
 
 ### Residual Risks
 

architecture/project-traceability.md

@@ -11,28 +11,35 @@ risk without treating validation as publication approval.
 | `RPC-JSONRPC-002` | `PRD.md`; `rpc-transport-contract.md` | `src/rpc/server.ts` | RPC protocol matrix | Validated local |
 | `RPC-BODY-003` | `PRD.md`; `rpc-transport-contract.md` | `src/rpc/server.ts` | oversized-request regression | Validated local |
 | `RELEASE-GATE-004` | `PRD.md`; `rpc-transport-contract.md` | `package.json`, GitHub Actions | `pnpm release:check` | Validated local |
-| `PACKAGE-INTEGRITY-001` | `PRD.md`; `release-readiness-contract.md` | package metadata and packed consumer | release check and tarball acceptance | Validated local |
+| `PACKAGE-INTEGRITY-001` | `PRD.md`; `release-readiness-contract.md` | package metadata and packed consumer | release check, tarball acceptance, and fresh registry install | Registry-verified |
 | `CONSUMER-COMPATIBILITY-002` | `PRD.md`; `release-readiness-contract.md` | public library/RPC adapters | clean consumer snapshots against the tarball | Validated snapshots |
 | `DEPENDENCY-SECURITY-003` | `PRD.md`; `release-readiness-contract.md` | package and CI scripts | `pnpm security:audit` | Validated current |
 | `PROVIDER-SMOKE-004` | `PRD.md`; `release-readiness-contract.md` | operator model/resource commands | real provider smoke | Real provider validated |
-| `PUBLICATION-OWNER-005` | `PRD.md`; `release-readiness-contract.md` | version, changelog, package metadata | owner approval and registry/tag evidence | Publication approved |
+| `PUBLICATION-OWNER-005` | `PRD.md`; `release-readiness-contract.md` | version, changelog, package metadata | owner approval and registry/tag evidence | Published and registry-verified |
 
-## Residual Release Gates
+## Residual Operational and Adoption Gates
 
-- npm registry publication, fresh installation, and release tag verification;
 - acceptance in concrete domain-agent and build-agent consumers;
 - any remote, non-loopback, or MCP exposure.
 
-The npm publication destination is the public npm registry. The owner approved
-publication after validation on 2026-07-22. Remaining gates stay open until
-direct post-publication or product-acceptance evidence exists.
+`agent-runtime-services@0.1.0` was published to the public npm registry after
+owner approval on 2026-07-22. Registry metadata, package ownership, a fresh
+installation, and the `v0.1.0` tag were verified against release commit
+`47b472bb9cbd0e38eb4c3a998ff086d94889d63a`. Concrete consumer acceptance and
+production operation remain separate from package publication.
 
 ## Current Validation Baseline
 
 - `pnpm release:check`: 15 test files and 117 tests passed under Node 20 and
   Node 22; typecheck, build, and the 21-file package dry-run passed.
 - The packed package manifest retained the `agent-runtime-services` CLI bin
   mapping, and the packed CLI executed `--version` and `--help` successfully.
+- The public registry reports `agent-runtime-services@0.1.0` with shasum
+  `9427c0af2dd040e0eb80fdad408e0a6fe759e34f`. A fresh install using an isolated
+  empty npm cache passed CLI version/help, public API import, and installed bin
+  mapping checks. The registry owner is `cloudsbeyond`.
+- Annotated tag `v0.1.0` resolves locally and on `origin` to release commit
+  `47b472bb9cbd0e38eb4c3a998ff086d94889d63a`.
 - `pnpm security:audit`: no known production dependency vulnerabilities at the
   time of the check.
 - A dedicated isolated runtime home reported `readiness: ok`; real language,
@@ -46,9 +53,9 @@ direct post-publication or product-acceptance evidence exists.
   installed the same tarball and passed 8 focused integration tests plus
   typecheck.
 
-These observations are revision-specific L4 evidence. They do not establish
-acceptance of uncommitted consumer work, npm registry availability, or
-production operation.
+These observations are revision-specific L4 evidence. They establish package
+publication and registry installation at the observation time, but do not
+establish acceptance of future consumer revisions or production operation.
 
 Node 22 also exposed an environment-specific residue: enabling the experimental
 `NODE_USE_ENV_PROXY` flag makes Node itself emit `EnvHttpProxyAgent` warnings on

architecture/project-traceability.yaml

@@ -15,8 +15,19 @@ validation_baseline:
     fail_closed: all model modules returned missing_resource and a non-zero exit without credentials
   publication:
     owner_approved_at: 2026-07-22
+    published_at: 2026-07-22
+    package: agent-runtime-services
+    version: 0.1.0
     destination: https://registry.npmjs.org/
     access: public
+    owner: cloudsbeyond
+    release_commit: 47b472bb9cbd0e38eb4c3a998ff086d94889d63a
+    release_tag: v0.1.0
+    tarball: https://registry.npmjs.org/agent-runtime-services/-/agent-runtime-services-0.1.0.tgz
+    integrity: sha512-qwiO8abN9iW4tltynFA9ZHZh49v3VX9DEza0e1O2vF9RqxS71ZXNZR4oS2EOrTYt3qcl7AdtMDJmDpZBpcxLGQ==
+    shasum: 9427c0af2dd040e0eb80fdad408e0a6fe759e34f
+    fresh_registry_install: passed
+    installed_validation: CLI version and help passed; public API imports and bin mapping passed
   packed_consumers:
     - role: domain-agent session navigation
       source_revision: 4c200a13a5331cf5df213f8a73d3b9bee583983a
@@ -101,10 +112,10 @@ requirements:
       - packed package manifest retains the agent-runtime-services bin mapping
       - packed CLI executes --version and --help
     residual_risk:
-      - Consumer acceptance, npm publication, and production operation require separate evidence.
+      - Concrete consumer product acceptance and production operation require separate evidence.
       - Node 22 with the experimental NODE_USE_ENV_PROXY flag emits runtime warnings on stderr; the CI-like matrix without that experimental flag passes.
   - id: PACKAGE-INTEGRITY-001
-    status: validated_local
+    status: registry_verified
     prd_refs:
       - PRD.md#p0-scope
       - PRD.md#downstream-chain
@@ -115,8 +126,10 @@ requirements:
       - test/cli-rpc-smoke.test.ts
     validation:
       - pnpm release:check
+      - fresh public-registry installation with an isolated empty npm cache
+      - installed CLI version and help, public API imports, and bin mapping
     residual_risk:
-      - npm publication and registry installation remain owner-controlled gates.
+      - Registry availability and package-manager compatibility remain time-sensitive operational dependencies.
   - id: CONSUMER-COMPATIBILITY-002
     status: validated_snapshot
     prd_refs:
@@ -161,7 +174,7 @@ requirements:
     residual_risk:
       - Provider availability and credentials remain time-sensitive operational dependencies.
   - id: PUBLICATION-OWNER-005
-    status: approved
+    status: published
     prd_refs:
       - PRD.md#owner-boundary
     yaml_refs:
@@ -171,6 +184,8 @@ requirements:
       - CHANGELOG.md
     validation:
       - explicit owner approval on 2026-07-22 for npm publication after validation
-      - registry and tag verification after publication
+      - public registry metadata and owner verified for agent-runtime-services@0.1.0
+      - fresh registry installation validated CLI version and help, public API imports, and bin mapping
+      - annotated v0.1.0 tag verified locally and on origin at release commit 47b472bb9cbd0e38eb4c3a998ff086d94889d63a
     residual_risk:
-      - Registry publication and release tag verification remain pending until the publish command succeeds.
+      - Registry availability and npm account ownership remain time-sensitive operational dependencies.

test/publication-identity.test.ts

@@ -86,18 +86,22 @@ describe('publication identity', () => {
     }
   });
 
-  test('0.1.0 release evidence records provider validation and publication approval', async () => {
+  test('0.1.0 release evidence records provider validation and verified publication', async () => {
     const [traceability, humanTraceability] = await Promise.all([
       readFile(join(repoRoot, 'architecture', 'project-traceability.yaml'), 'utf8'),
       readFile(join(repoRoot, 'architecture', 'project-traceability.md'), 'utf8'),
     ]);
 
     expect(traceability).toMatch(/id: PROVIDER-SMOKE-004\n\s+status: validated_real/);
-    expect(traceability).toMatch(/id: PUBLICATION-OWNER-005\n\s+status: approved/);
+    expect(traceability).toMatch(/id: PUBLICATION-OWNER-005\n\s+status: published/);
+    expect(traceability).toContain('version: 0.1.0');
+    expect(traceability).toContain('shasum: 9427c0af2dd040e0eb80fdad408e0a6fe759e34f');
+    expect(traceability).toContain('release_commit: 47b472bb9cbd0e38eb4c3a998ff086d94889d63a');
+    expect(traceability).toContain('fresh_registry_install: passed');
     expect(humanTraceability).toContain('| `PROVIDER-SMOKE-004`');
     expect(humanTraceability).toContain('| Real provider validated |');
     expect(humanTraceability).toContain('| `PUBLICATION-OWNER-005`');
-    expect(humanTraceability).toContain('| Publication approved |');
+    expect(humanTraceability).toContain('| Published and registry-verified |');
   });
 
   test('package identity is Agent Runtime Services while retaining upstream attribution', async () => {