From dd93e85605d06eb92c01998b3d91bb49c2970c5a Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Mon, 5 Oct 2026 23:02:55 +0530 Subject: [PATCH 1/5] fix: refresh transitive undici dependency --- services/demo-console/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/services/demo-console/package-lock.json b/services/demo-console/package-lock.json index 5895a22..97719a8 100644 --- a/services/demo-console/package-lock.json +++ b/services/demo-console/package-lock.json @@ -2192,9 +2192,9 @@ "optional": true }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "dev": true, "license": "MIT", "engines": { From 12c18a4d1c71d2bf945eff1e35b7bf240f90a9cd Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Tue, 6 Oct 2026 08:06:48 +0530 Subject: [PATCH 2/5] fix(console): pin patched source-map-js --- services/demo-console/package-lock.json | 7 ++++--- services/demo-console/package.json | 3 +++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/services/demo-console/package-lock.json b/services/demo-console/package-lock.json index 97719a8..6f4128d 100644 --- a/services/demo-console/package-lock.json +++ b/services/demo-console/package-lock.json @@ -2040,10 +2040,11 @@ "license": "ISC" }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "dev": true, + "license": "BSD-3-Clause", "engines": { "node": ">=0.10.0" } diff --git a/services/demo-console/package.json b/services/demo-console/package.json index cc0ae7c..0fa5882 100644 --- a/services/demo-console/package.json +++ b/services/demo-console/package.json @@ -28,5 +28,8 @@ "jsdom": "28.1.0", "vite": "8.0.16", "vitest": "4.1.11" + }, + "overrides": { + "source-map-js": "^1.2.2" } } From ced333c8b1abbbb439dfe4450bb4274231062e3a Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Mon, 5 Oct 2026 22:53:10 +0530 Subject: [PATCH 3/5] ci: refresh v1.10 candidate Base pin --- .github/workflows/scenarios.yml | 2 +- docs/first-success.md | 10 +++++----- docs/trust-scenarios.md | 4 ++-- docs/workspace-scenarios.md | 4 ++-- tests/dependency_inputs_test.py | 18 ++++++++++++++++++ 5 files changed, 28 insertions(+), 10 deletions(-) diff --git a/.github/workflows/scenarios.yml b/.github/workflows/scenarios.yml index e7e5ccb..2f3cb40 100644 --- a/.github/workflows/scenarios.yml +++ b/.github/workflows/scenarios.yml @@ -26,7 +26,7 @@ jobs: base: ac8d294421e1bfc14afa8c6a2a12f1affb5268ee options: "" - lane: advisory-v1.10-candidate - base: 5f316aeddc3680b92bd209fcfe652eac020d02d0 + base: 06715fed19aceff27844aba546ba2a0b4c594ac7 options: --candidate steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 diff --git a/docs/first-success.md b/docs/first-success.md index 06c2103..3573702 100644 --- a/docs/first-success.md +++ b/docs/first-success.md @@ -12,7 +12,7 @@ build, test and demo paths require macOS. Bash must be 4.2 or newer. Contributor need the toolchains declared by the manifest/mise configuration; setup may install tools and change the project environment, so preview it first. -Need Base first? Follow the canonical [adopter golden path](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/adopter-golden-path.md) +Need Base first? Follow the canonical [adopter golden path](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/adopter-golden-path.md) for install and consent decisions, then select the stable inputs above. That document is pinned for reference, not an instruction to substitute its candidate for the stable runtime. The README's checksum-verified [Quick Start](../README.md#quick-start) @@ -56,7 +56,7 @@ an unexplained error. `--yes` does not grant command trust or IDE consent. new project under a separate workspace. Choose one existing, harmless project validation command; do not copy the demo's entire toolchain or service graph. -Follow [the adopter golden path's project recipe](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/adopter-golden-path.md#adopt-an-external-style-project) +Follow [the adopter golden path's project recipe](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/adopter-golden-path.md#adopt-an-external-style-project) to declare that command in your own manifest, preview setup, inspect command surfaces, approve the reviewed digest, and run your project's test. Keep command approval, runtime inspection and IDE mutation as separate decisions. The demo's @@ -64,12 +64,12 @@ approval, runtime inspection and IDE mutation as separate decisions. The demo's **Done:** your declared test passes in the intended checkout and a handoff PR contains the manifest, test output, version/provider identities and remaining -warnings. Use [JSON quickstart](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/json-output-quickstart.md) +warnings. Use [JSON quickstart](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/json-output-quickstart.md) for machine-readable evidence; check both JSON status and process exit. **Safe failure/recovery:** preview setup with `basectl setup --dry-run` before applying it. A missing prerequisite or stale environment is a diagnostic, not -permission to grant more trust. Use [first-run troubleshooting](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/first-run-troubleshooting.md) +permission to grant more trust. Use [first-run troubleshooting](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/first-run-troubleshooting.md) to repair the specific finding and rerun validation. Review any proposed IDE or shell-profile changes separately. This internal rehearsal is not independent external-adoption evidence. @@ -102,7 +102,7 @@ does not select a service environment or fix other readiness findings. Inspect each remaining finding; do not declare success from the marker alone. Services use `services --env dev` separately; staging/prod are non-operational examples. -For release work, use the canonical [downstream release smoke test](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/downstream-release-smoke-test.md) +For release work, use the canonical [downstream release smoke test](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/downstream-release-smoke-test.md) and the demo's [release policy](release.md). A contributor PR is not permission to tag or publish. The [complete command reference](../README.md#complete-command-reference) remains available after these short paths. diff --git a/docs/trust-scenarios.md b/docs/trust-scenarios.md index e19ebe8..08f23f6 100644 --- a/docs/trust-scenarios.md +++ b/docs/trust-scenarios.md @@ -31,7 +31,7 @@ inspection are demonstrated only against the implemented v1.10 candidate. The stable lane prints this boundary and does not invoke candidate-only flags. The separate advisory lane uses exact Base commit -`5f316aeddc3680b92bd209fcfe652eac020d02d0`. Run the same command with that +`06715fed19aceff27844aba546ba2a0b4c594ac7`. Run the same command with that checkout/commit and add `--candidate`. A published v1.10 release is not required, but a moving branch is not an acceptable substitute for the recorded revision. Both lanes run in [isolated scenario CI](../.github/workflows/scenarios.yml). @@ -62,4 +62,4 @@ that the host is ready. Local temporary paths are redacted from assertion diagnostics. `tests/scenario_harness_test.py` verifies cleanup and redaction. For the authoritative boundaries, see Base's -[command-trust policy](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/manifest-command-trust.md). +[command-trust policy](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/manifest-command-trust.md). diff --git a/docs/workspace-scenarios.md b/docs/workspace-scenarios.md index a98fc00..b92d971 100644 --- a/docs/workspace-scenarios.md +++ b/docs/workspace-scenarios.md @@ -23,7 +23,7 @@ workspace identity, missing-peer reporting and read-only behavior. It prints an explicit supported-version boundary without invoking newer flags. For the implemented 1.10 candidate, select its checkout and exact commit -`5f316aeddc3680b92bd209fcfe652eac020d02d0`, and add `--candidate`. +`06715fed19aceff27844aba546ba2a0b4c594ac7`, and add `--candidate`. [Scenario CI](../.github/workflows/scenarios.yml) runs both lanes. This is advisory candidate evidence, not a stable-release compatibility claim. @@ -46,5 +46,5 @@ The candidate asserts: Each completed assertion group prints `PASS`; fixtures are removed on success or exception. There is no second application stack and no host-readiness claim. -See the exact candidate's [workspace contract](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/workspace-manifest.md) +See the exact candidate's [workspace contract](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/workspace-manifest.md) for the authoritative API. diff --git a/tests/dependency_inputs_test.py b/tests/dependency_inputs_test.py index 92c595a..0447e36 100644 --- a/tests/dependency_inputs_test.py +++ b/tests/dependency_inputs_test.py @@ -1,5 +1,6 @@ """The selection record and its materialized consumers must never drift.""" import json +import re from pathlib import Path import shutil import subprocess @@ -51,6 +52,23 @@ def test_github_outputs_are_only_validated_scalars(self): self.assertEqual(output["base_cli_version"], "0.4.3") self.assertEqual(len(output["base_commit"]), 40) + def test_advisory_candidate_pin_matches_documented_references(self): + workflow = (ROOT / ".github/workflows/scenarios.yml").read_text() + match = re.search( + r"- lane: advisory-v1\.10-candidate\s+base: ([0-9a-f]{40})", + workflow, + ) + self.assertIsNotNone(match) + candidate = match.group(1) + self.assertNotEqual(candidate, "5f316aeddc3680b92bd209fcfe652eac020d02d0") + for filename in ( + "docs/trust-scenarios.md", + "docs/workspace-scenarios.md", + "docs/first-success.md", + ): + with self.subTest(filename=filename): + self.assertIn(candidate, (ROOT / filename).read_text()) + if __name__ == "__main__": unittest.main() From c89ba02140c4239e0da4e5e60c01446f9ee3e951 Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Tue, 6 Oct 2026 18:24:14 +0530 Subject: [PATCH 4/5] test: validate candidate pin references generically --- tests/dependency_inputs_test.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/tests/dependency_inputs_test.py b/tests/dependency_inputs_test.py index 0447e36..c34a56c 100644 --- a/tests/dependency_inputs_test.py +++ b/tests/dependency_inputs_test.py @@ -60,14 +60,20 @@ def test_advisory_candidate_pin_matches_documented_references(self): ) self.assertIsNotNone(match) candidate = match.group(1) - self.assertNotEqual(candidate, "5f316aeddc3680b92bd209fcfe652eac020d02d0") + stable = json.loads( + (ROOT / ".release/supported-dependencies.json").read_text() + )["components"]["base"]["commit"] + documented = set() for filename in ( "docs/trust-scenarios.md", "docs/workspace-scenarios.md", "docs/first-success.md", ): with self.subTest(filename=filename): - self.assertIn(candidate, (ROOT / filename).read_text()) + text = (ROOT / filename).read_text() + self.assertIn(candidate, text) + documented.update(re.findall(r"\b[0-9a-f]{40}\b", text)) + self.assertEqual(documented, {stable, candidate}) if __name__ == "__main__": From 52cd4d39f5a91a65c5ae6d14770b34146036727e Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Mon, 5 Oct 2026 22:53:32 +0530 Subject: [PATCH 5/5] docs: align release guidance with Base 1.10 --- docs/base-capability-matrix.md | 18 ++++++++++-------- docs/dependency-inputs.md | 9 ++++++--- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/docs/base-capability-matrix.md b/docs/base-capability-matrix.md index 7c9be51..2c2fa58 100644 --- a/docs/base-capability-matrix.md +++ b/docs/base-capability-matrix.md @@ -8,10 +8,12 @@ evidence that this repository does not execute. Current Base release: `1.9.0` Planned Base release: `1.10.0` -The repository's CI still exercises the immutable Base `v1.8.0` compatibility -pin. That is recorded as a gap below until the compatibility train updates the -pin and adds the release-specific evidence. A moving local Base checkout is -useful for development, but does not by itself establish released compatibility. +The stable CI lane exercises the immutable Base `v1.9.0` compatibility pin. A +separate advisory lane exercises the exact Base `v1.10.0` candidate commit; it +is useful release evidence, but does not establish released compatibility until +Base publishes `v1.10.0` and the final downstream BOM is verified. A moving +local Base checkout is useful for development, but does not by itself establish +either claim. ## Capability matrix @@ -22,16 +24,16 @@ useful for development, but does not by itself establish released compatibility. | Workspace onboarding, agent handoff, and AI context | `1.9.0` | Workspace onboarding and agent-brief JSON are checked in [`.github/workflows/tests.yml`](../.github/workflows/tests.yml); the project context is indexed by [`.ai-context/overview.md`](../.ai-context/overview.md) | Workspace paths must be inside the configured workspace; WSL2 follows the Linux boundary | Demonstrated | Base + base-demo | Add a row when a new handoff artifact becomes user-facing. | | Representative build, test, service, environment, and non-interactive demo loop | `1.9.0` | The manifest targets in [`base_manifest.yaml`](../base_manifest.yaml), baseline gate in [`tests/validate.sh`](../tests/validate.sh), and focused suites in [`tests/services_test.bats`](../tests/services_test.bats), [`tests/environments_test.bats`](../tests/environments_test.bats), and [`tests/demo_test.bats`](../tests/demo_test.bats) | Full project loop is macOS; Ubuntu/Debian validates Base setup and project health only | Demonstrated | base-demo | Add executable evidence before calling a new service or command demonstrated. | | Linux and WSL2 read-only support boundary | `1.9.0` | The supported commands and explicit native-Windows boundary are in [`README.md`](../README.md) and [`docs/contracts.md`](contracts.md); CI's Ubuntu path is in [`.github/workflows/tests.yml`](../.github/workflows/tests.yml) | Ubuntu/Debian and WSL2 use setup, dev-profile, check, and doctor/read-only paths; native Windows is excluded | Demonstrated | Base + base-demo | Keep platform claims tied to a hosted or repository-local check. | -| Base `1.9.0` released-compatibility pin and full Go/live-HTTP evidence | `1.9.0` | Structured pins in [supported inputs](../.release/supported-dependencies.json), verified by `bin/base-demo-dependencies`; full-language and live-HTTP gates run in [`.github/workflows/tests.yml`](../.github/workflows/tests.yml) | Exact macOS 14 full demo and Ubuntu 24.04 setup/read-only scope; no Linux full-demo claim | Demonstrated | Base + base-demo | Bind final-candidate runs during #303; later dependency changes require fresh proof. | +| Base `1.9.0` released-compatibility pin and full Go/live-HTTP evidence | `1.9.0` | Structured pins in [supported inputs](../.release/supported-dependencies.json), verified by `bin/base-demo-dependencies`; full-language and live-HTTP gates run in [`.github/workflows/tests.yml`](../.github/workflows/tests.yml) | Exact macOS 14 full demo and Ubuntu 24.04 setup/read-only scope; no Linux full-demo claim | Demonstrated | Base + base-demo | Keep the stable pin unchanged until the final v1.10.0 release BOM is verified; candidate refresh is tracked by #324. | | Workspace inventory, selected tests and targeted recovery | `1.9.0` reports; exact `1.10.0` candidate | `tests/scenarios/workspace.py` and [workspace scenario guide](workspace-scenarios.md), run by isolated scenario CI | macOS fixture lane; selection and expanded recovery require the exact candidate | Demonstrated | Base + base-demo | Refresh candidate evidence before release; do not claim stable 1.10 support. | | Trust lifecycle and separate runtime/IDE consent | `1.9.0` baseline; exact `1.10.0` candidate | `tests/scenarios/trust.py` and [trust scenario guide](trust-scenarios.md), executed by [isolated scenario CI](../.github/workflows/scenarios.yml) | macOS fixture lane; full historical revocation and runtime inspection require the pinned candidate | Demonstrated | Base + base-demo | Refresh exact candidate evidence before release; do not attribute candidate-only guarantees to v1.9.0. | | Optional `test.requirements` and uninstall guidance | `1.9.0` | The manifest test entry and contributor setup guidance are [`base_manifest.yaml`](../base_manifest.yaml) and [`README.md`](../README.md) | Optional metadata is not required for the baseline demo contract | Intentionally omitted | base-demo | Revisit when Base publishes a stable user-facing contract and a concrete scenario. | | Native Windows support | `1.11.0` (planned) | The current non-goal is recorded in [`README.md`](../README.md); the staged Base work is tracked by [base-demo#302](https://github.com/basefoundry/base-demo/issues/302) and Base [#2215](https://github.com/basefoundry/base/issues/2215) | Native Windows is not shipped; Git Bash and WSL2 do not count as native Windows evidence | Blocked upstream | Base + base-demo | Wait for the PowerShell-first Base contract and hosted Windows evidence. | | First-class Base Docker-service contract | Future | The existing Compose fixture is documented in [`docs/tooling-testbed.md`](tooling-testbed.md) and [`infra/compose.yaml`](../infra/compose.yaml); adoption remains tracked by [base-demo#163](https://github.com/basefoundry/base-demo/issues/163) and Base [#124](https://github.com/basefoundry/base/issues/124) | Compose is a repository fixture; it does not establish a Base Docker-service contract | Blocked upstream | Base + base-demo | Do not make the future Base command a required demo dependency before Base publishes it. | -The matrix intentionally leaves release-process, BOM, and dependency alignment -implementation out of this train. Those lanes remain separately tracked and -must not be inferred from the capability statuses above. +The matrix intentionally does not treat the advisory candidate lane as a stable +release or final BOM. Release publication and final evidence binding remain +separately tracked and must not be inferred from the capability statuses above. ## Release review checklist diff --git a/docs/dependency-inputs.md b/docs/dependency-inputs.md index 23065a6..80cb4ee 100644 --- a/docs/dependency-inputs.md +++ b/docs/dependency-inputs.md @@ -50,9 +50,12 @@ No successful run, wrong input, failed job, or unavailable GitHub lookup means no publication. Finalizing without `--evidence-run` remains useful for identity fixtures but does not certify the artifacts for publication. -The README interim installer remains deliberately pinned to older reviewed -script bytes, which consume Base 1.8.0 and demo 0.1.0. Current source inputs do -not change that historical script. #303 owns the new public release-asset URL. +The published README installer is pinned to the reviewed v0.2.0 release asset, +which consumes Base 1.9.0 and demo v0.2.0. The stable source inputs remain +unchanged while Base v1.10.0 is still a candidate. Refreshing the advisory +candidate source revision is tracked by #324; it must not be mistaken for a +stable dependency update or a final release asset. #303 owns the public +release-asset URL. ## Candidate boundary