From 0c538025d333528152828540ebe89cbd602f45c3 Mon Sep 17 00:00:00 2001 From: wonkwonlee Date: Thu, 6 Aug 2026 21:42:49 -0400 Subject: [PATCH 1/2] docs: record the verified v0.4.1 provenance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Asserted only after checking, which was the point of holding the claim back until the packages were live: all five 0.4.1 attestations name .github/workflows/publish.yml in wonkwonlee/ChangeSafe at refs/tags/v0.4.1, commit bafdeeb, and 'npm audit signatures' reports verified signatures and attestations for the installed tree. The registry-installed CLI was also exercised end to end — it gates a destructive Terraform plan to exit 1, and the Kubernetes package imports directly under Node ESM, the defect that forced the v0.3.1 patch. The README now tells readers to run 'npm audit signatures' themselves rather than take a paragraph's word for provenance, and says plainly that 0.4.0 is an incomplete set: the three packages published there are genuine, but the CLI and the Kubernetes domain do not exist at that version. MEMORY.md's release section was a month stale; it now records v0.4.1, why v0.4.0 could not simply be retried, and that publishing is resumable. Co-Authored-By: Claude Opus 5 (1M context) --- MEMORY.md | 44 +++++++++++++++++++++++++++----------------- README.md | 13 ++++++++++--- docs/LAUNCH.md | 10 ++++++++-- 3 files changed, 45 insertions(+), 22 deletions(-) diff --git a/MEMORY.md b/MEMORY.md index c0900fa..f5a520a 100644 --- a/MEMORY.md +++ b/MEMORY.md @@ -36,23 +36,33 @@ domain decisions. - Read `docs/OSS_ROADMAP.md` before starting multi-file work and follow the repository contract in `AGENTS.md`. -## Current release and vNext status (2026-07-30) - -- Kubernetes shipped in v0.3.0 and was patched in v0.3.1. The v0.3.1 tag and - GitHub Release are published; use `@changesafe/domain-kubernetes@0.3.1` or - later. -- The npm `@changesafe/domain-kubernetes@0.3.0` publication is deprecated: - its direct Node ESM imports were invalid. The bundled `changesafe@0.3.0` - CLI was unaffected. -- The five public v0.3.1 packages are on npm. The v0.3.0 bootstrap and v0.3.1 - remediation were manually published, so those v0.3.x packages do not have - npm provenance attestations. Future releases should use the configured npm - trusted-publishing workflow and verify provenance before announcement. -- v0.3.1 was validated by the full CI gate, including lint, typecheck, unit and - integration tests, build, Playwright, scenario corpus/gallery, secret scans, - and Kubernetes offline/read-only checks. A registry smoke also verified the - CLI version, direct Kubernetes package import, schema parsing, and a clean - Kubernetes gate. +## Current release status (2026-08-07) + +- **v0.4.1 is the canonical release.** All five public packages are on npm at + `0.4.1`, published by the release workflow over trusted publishing, and + every one carries a verified provenance attestation recording + `.github/workflows/publish.yml` in `wonkwonlee/ChangeSafe` at + `refs/tags/v0.4.1`, commit `bafdeeb`. This is the project's first release + with provenance. +- **Do not point anyone at `0.4.0`.** It published `@changesafe/core`, + `domain-network`, and `domain-terraform` and then failed: the Kubernetes + domain had no trusted-publisher configuration on npm, so the registry + answered 404 and the loop exited before the CLI. Those three are genuine and + attested; the set is incomplete, not broken, and nothing was withdrawn. +- v0.4.0 could not be re-published because a `release` event runs the workflow + file **at the tagged commit**, and the resumable-publish fix landed after + the tag. Moving the tag was rejected: the attestations already record the + original commit. Hence v0.4.1 rather than a retry. +- Publishing is now resumable — a version already on the registry is skipped + rather than refused (`scripts/select-unpublished.sh`, covered by + `tests/integration/release-publish-selection.test.ts`). +- The v0.3.0 `@changesafe/domain-kubernetes` publication is deprecated (its + direct Node ESM imports were invalid). v0.3.0 and v0.3.1 were published + manually and carry no attestation. +- v0.4.1 was validated by the full CI gate and, after publication, by a + registry smoke: `npm audit signatures` clean, the installed CLI gates a + destructive Terraform plan to exit 1, and the Kubernetes package imports + directly under Node ESM. ## Verification baseline diff --git a/README.md b/README.md index 1715bcf..d6b4d03 100644 --- a/README.md +++ b/README.md @@ -345,9 +345,16 @@ there is no `--auto-approve`. Full usage: [packages/cli/README.md](packages/cli/ ## Packages -Five public packages are on npm. Automated releases use npm trusted -publishing and attach provenance; the manually published v0.3.0 and v0.3.1 -bootstrap/remediation versions do not carry npm provenance attestations. +Five public packages are on npm. As of **v0.4.1** they are published by the +release workflow over npm trusted publishing, and each carries a provenance +attestation naming the workflow, repository, and commit that produced it — +`npm audit signatures` verifies them, and you should rather than take this +paragraph's word for it. The manually published v0.3.0 and v0.3.1 +bootstrap/remediation versions carry no attestation. + +Use `0.4.1` or later. `0.4.0` published only three of the five packages +before failing, so the CLI and the Kubernetes domain do not exist at that +version; what did ship there is genuine, but the set is incomplete. ```bash npm i @changesafe/core @changesafe/domain-terraform # embed the gate diff --git a/docs/LAUNCH.md b/docs/LAUNCH.md index e3e8d17..81d3cc9 100644 --- a/docs/LAUNCH.md +++ b/docs/LAUNCH.md @@ -15,8 +15,14 @@ deploys, tags, or posts automatically. - `@changesafe/domain-kubernetes@0.3.0` is deprecated because its direct Node ESM imports were invalid; use `0.3.1` or later. - v0.3.0 and v0.3.1 were manually published and do **not** carry npm - provenance attestations. Verify v0.4.1's attestations before announcing it - — an unverified provenance claim is worth less than none. + provenance attestations. +- **v0.4.1's attestations are verified** (2026-08-07). All five packages + record `.github/workflows/publish.yml` in `wonkwonlee/ChangeSafe` at + `refs/tags/v0.4.1`, commit `bafdeeb`, and `npm audit signatures` reports + verified signatures and attestations for the installed tree. The + registry-installed CLI was also exercised end to end: it gates a + destructive Terraform plan to exit 1, and the Kubernetes package imports + directly under Node ESM — the defect that forced the v0.3.1 patch. - The vNext UI cutover (#47, #48, #49) is merged to `main` and deployed to the hosted Vercel URL. It does not itself create an npm release, Git tag, or GitHub Release. From 5b53fe1863906093ef151fd925e8ebbb77b9fe47 Mon Sep 17 00:00:00 2001 From: wonkwonlee Date: Thu, 6 Aug 2026 21:52:29 -0400 Subject: [PATCH 2/2] docs: say first complete attested release, not first attested release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review of #59 caught MEMORY.md contradicting itself one bullet apart: it called v0.4.1 the project's first release with provenance, then recorded that three packages reached the registry during the failed v0.4.0 run — which were attested. v0.4.1 is the first release where all five are. The durable release record is the wrong place to be loose about this. A project that asks readers to verify attestations rather than trust prose does not get to overstate its own provenance history. Also tightened the README's 0.4.0 sentence from 'what did ship there is genuine' to 'those three are genuine and attested', so the same fact reads the same way in both places. Co-Authored-By: Claude Opus 5 (1M context) --- MEMORY.md | 6 ++++-- README.md | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/MEMORY.md b/MEMORY.md index f5a520a..8e3f06e 100644 --- a/MEMORY.md +++ b/MEMORY.md @@ -42,8 +42,10 @@ domain decisions. `0.4.1`, published by the release workflow over trusted publishing, and every one carries a verified provenance attestation recording `.github/workflows/publish.yml` in `wonkwonlee/ChangeSafe` at - `refs/tags/v0.4.1`, commit `bafdeeb`. This is the project's first release - with provenance. + `refs/tags/v0.4.1`, commit `bafdeeb`. This is the first *complete* set the + project has published with provenance — the three packages that reached the + registry during the failed v0.4.0 run were attested too, so v0.4.1 is the + first release where all five are. - **Do not point anyone at `0.4.0`.** It published `@changesafe/core`, `domain-network`, and `domain-terraform` and then failed: the Kubernetes domain had no trusted-publisher configuration on npm, so the registry diff --git a/README.md b/README.md index d6b4d03..4289e77 100644 --- a/README.md +++ b/README.md @@ -354,7 +354,7 @@ bootstrap/remediation versions carry no attestation. Use `0.4.1` or later. `0.4.0` published only three of the five packages before failing, so the CLI and the Kubernetes domain do not exist at that -version; what did ship there is genuine, but the set is incomplete. +version; those three are genuine and attested, but the set is incomplete. ```bash npm i @changesafe/core @changesafe/domain-terraform # embed the gate