From eb642db63cfa9f97746d589863f2146ab53268ae Mon Sep 17 00:00:00 2001 From: focaxisdev <263514337+focaxisdev@users.noreply.github.com> Date: Sun, 18 Oct 2026 13:48:09 +0800 Subject: [PATCH 1/2] ci: verify published 0.8.0 from registry in clean installs Exact source local commit: 00cf48fefe4db6447bcd5a9d5b1fdb93674e0d4b Verified tracked tree: 7f6865b9b647c0945688ff3cacfec45a01892688 Original local history retained; remote SHA intentionally differs. --- .github/release-v0.8.0-fingerprint.json | 708 +++++++++++++++++++++ .github/scripts/verify-release-0.8.0.mjs | 119 ++++ .github/workflows/verify-release-0.8.0.yml | 33 + 3 files changed, 860 insertions(+) create mode 100644 .github/release-v0.8.0-fingerprint.json create mode 100644 .github/scripts/verify-release-0.8.0.mjs create mode 100644 .github/workflows/verify-release-0.8.0.yml diff --git a/.github/release-v0.8.0-fingerprint.json b/.github/release-v0.8.0-fingerprint.json new file mode 100644 index 0000000..6288112 --- /dev/null +++ b/.github/release-v0.8.0-fingerprint.json @@ -0,0 +1,708 @@ +{ + "releaseCommit": "42221805bdb1853b4cc347d7bfba29532594b3f2", + "ci": "https://github.com/focaxisdev/deja-vu/actions/runs/39093665904", + "manifest": { + "id": "@focaxisdev/deja-vu@0.8.0", + "name": "@focaxisdev/deja-vu", + "version": "0.8.0", + "size": 486560, + "unpackedSize": 822678, + "shasum": "9e09a7067f2a56ebbeefaee89933ad5487276d31", + "integrity": "sha512-QPwz0brkGf7Ip1P7xnfcB1XwKeI3DvLjApccKP+H+CULWkOxtIqdFglMLhN62X5XcawdGyL03aLVigmTaL4H3w==", + "filename": "focaxisdev-deja-vu-0.8.0.tgz", + "files": [ + { + "path": "CHANGELOG.md", + "size": 10814, + "mode": 420 + }, + { + "path": "CONTRIBUTING.md", + "size": 1432, + "mode": 420 + }, + { + "path": "LICENSE", + "size": 1056, + "mode": 420 + }, + { + "path": "README.md", + "size": 9721, + "mode": 420 + }, + { + "path": "dist/src/core/semantic-recall-engine.d.ts", + "size": 2544, + "mode": 420 + }, + { + "path": "dist/src/core/semantic-recall-engine.js", + "size": 21153, + "mode": 420 + }, + { + "path": "dist/src/index.d.ts", + "size": 683, + "mode": 420 + }, + { + "path": "dist/src/index.js", + "size": 623, + "mode": 420 + }, + { + "path": "dist/src/layers/chunk-layer.d.ts", + "size": 567, + "mode": 420 + }, + { + "path": "dist/src/layers/chunk-layer.js", + "size": 599, + "mode": 420 + }, + { + "path": "dist/src/layers/familiarity-layer.d.ts", + "size": 576, + "mode": 420 + }, + { + "path": "dist/src/layers/familiarity-layer.js", + "size": 551, + "mode": 420 + }, + { + "path": "dist/src/layers/summary-layer.d.ts", + "size": 324, + "mode": 420 + }, + { + "path": "dist/src/layers/summary-layer.js", + "size": 257, + "mode": 420 + }, + { + "path": "dist/src/memory/default-chunker.d.ts", + "size": 239, + "mode": 420 + }, + { + "path": "dist/src/memory/default-chunker.js", + "size": 2989, + "mode": 420 + }, + { + "path": "dist/src/memory/default-summary-generator.d.ts", + "size": 545, + "mode": 420 + }, + { + "path": "dist/src/memory/default-summary-generator.js", + "size": 2211, + "mode": 420 + }, + { + "path": "dist/src/plugins/cached-embedding-provider.d.ts", + "size": 1305, + "mode": 420 + }, + { + "path": "dist/src/plugins/cached-embedding-provider.js", + "size": 4294, + "mode": 420 + }, + { + "path": "dist/src/plugins/create-in-memory-engine.d.ts", + "size": 273, + "mode": 420 + }, + { + "path": "dist/src/plugins/create-in-memory-engine.js", + "size": 1169, + "mode": 420 + }, + { + "path": "dist/src/plugins/mock-embedding-provider.d.ts", + "size": 253, + "mode": 420 + }, + { + "path": "dist/src/plugins/mock-embedding-provider.js", + "size": 1254, + "mode": 420 + }, + { + "path": "dist/src/retrieval/cue-aliases.d.ts", + "size": 490, + "mode": 420 + }, + { + "path": "dist/src/retrieval/cue-aliases.js", + "size": 973, + "mode": 420 + }, + { + "path": "dist/src/retrieval/prompt-projection.d.ts", + "size": 927, + "mode": 420 + }, + { + "path": "dist/src/retrieval/prompt-projection.js", + "size": 4866, + "mode": 420 + }, + { + "path": "dist/src/retrieval/threshold-gate.d.ts", + "size": 259, + "mode": 420 + }, + { + "path": "dist/src/retrieval/threshold-gate.js", + "size": 231, + "mode": 420 + }, + { + "path": "dist/src/scoring/hybrid-scoring-strategy.d.ts", + "size": 797, + "mode": 420 + }, + { + "path": "dist/src/scoring/hybrid-scoring-strategy.js", + "size": 1645, + "mode": 420 + }, + { + "path": "dist/src/storage/in-memory-storage.d.ts", + "size": 1321, + "mode": 420 + }, + { + "path": "dist/src/storage/in-memory-storage.js", + "size": 5109, + "mode": 420 + }, + { + "path": "dist/src/storage/in-memory-vector-store.d.ts", + "size": 783, + "mode": 420 + }, + { + "path": "dist/src/storage/in-memory-vector-store.js", + "size": 1524, + "mode": 420 + }, + { + "path": "dist/src/types/memory.d.ts", + "size": 3014, + "mode": 420 + }, + { + "path": "dist/src/types/memory.js", + "size": 11, + "mode": 420 + }, + { + "path": "dist/src/types/plugins.d.ts", + "size": 4042, + "mode": 420 + }, + { + "path": "dist/src/types/plugins.js", + "size": 11, + "mode": 420 + }, + { + "path": "dist/src/utils/id.d.ts", + "size": 58, + "mode": 420 + }, + { + "path": "dist/src/utils/id.js", + "size": 104, + "mode": 420 + }, + { + "path": "dist/src/utils/limits.d.ts", + "size": 238, + "mode": 420 + }, + { + "path": "dist/src/utils/limits.js", + "size": 368, + "mode": 420 + }, + { + "path": "dist/src/utils/math.d.ts", + "size": 158, + "mode": 420 + }, + { + "path": "dist/src/utils/math.js", + "size": 528, + "mode": 420 + }, + { + "path": "dist/src/utils/text.d.ts", + "size": 154, + "mode": 420 + }, + { + "path": "dist/src/utils/text.js", + "size": 929, + "mode": 420 + }, + { + "path": "dist/src/utils/time.d.ts", + "size": 116, + "mode": 420 + }, + { + "path": "dist/src/utils/time.js", + "size": 243, + "mode": 420 + }, + { + "path": "docs/actions-acceptance-results.json", + "size": 5425, + "mode": 420 + }, + { + "path": "docs/actions-acceptance-results.md", + "size": 6933, + "mode": 420 + }, + { + "path": "docs/actions-acceptance.md", + "size": 7970, + "mode": 420 + }, + { + "path": "docs/actions-publication-evidence.json", + "size": 8512, + "mode": 420 + }, + { + "path": "docs/agent-compatibility.md", + "size": 1749, + "mode": 420 + }, + { + "path": "docs/agent-handshake.md", + "size": 2206, + "mode": 420 + }, + { + "path": "docs/architecture.md", + "size": 1722, + "mode": 420 + }, + { + "path": "docs/assets/deja-vu-preview.svg", + "size": 5912, + "mode": 420 + }, + { + "path": "docs/assets/deja-vu-social-preview.png", + "size": 250897, + "mode": 420 + }, + { + "path": "docs/assets/deja-vu-terminal-demo.gif", + "size": 128064, + "mode": 420 + }, + { + "path": "docs/bootstrap-instructions.md", + "size": 2673, + "mode": 420 + }, + { + "path": "docs/comparison.md", + "size": 2710, + "mode": 420 + }, + { + "path": "docs/demo-walkthrough.md", + "size": 3837, + "mode": 420 + }, + { + "path": "docs/diagrams/deja-vu-flow.md", + "size": 823, + "mode": 420 + }, + { + "path": "docs/engine/protocol-to-engine.md", + "size": 1469, + "mode": 420 + }, + { + "path": "docs/engine/recall-benchmark.json", + "size": 6625, + "mode": 420 + }, + { + "path": "docs/engine/recall-cache-ownership-benchmark.json", + "size": 887, + "mode": 420 + }, + { + "path": "docs/engine/recall-efficiency.md", + "size": 9781, + "mode": 420 + }, + { + "path": "docs/engine/recall-evaluation.json", + "size": 50393, + "mode": 420 + }, + { + "path": "docs/engine/recall-lifecycle.md", + "size": 10104, + "mode": 420 + }, + { + "path": "docs/engine/recall-round2-benchmark.json", + "size": 24221, + "mode": 420 + }, + { + "path": "docs/engine/semantic-engine.md", + "size": 3374, + "mode": 420 + }, + { + "path": "docs/examples/settings-project/AGENTS.md", + "size": 1619, + "mode": 420 + }, + { + "path": "docs/examples/settings-project/memory/decisions/settings-sync.md", + "size": 684, + "mode": 420 + }, + { + "path": "docs/examples/settings-project/memory/impressions.jsonl", + "size": 561, + "mode": 420 + }, + { + "path": "docs/examples/settings-project/memory/open-loops/settings-migration.md", + "size": 468, + "mode": 420 + }, + { + "path": "docs/examples/settings-project/memory/summary.md", + "size": 452, + "mode": 420 + }, + { + "path": "docs/impression-layer.md", + "size": 2987, + "mode": 420 + }, + { + "path": "docs/launch-copy.md", + "size": 3216, + "mode": 420 + }, + { + "path": "docs/project-rules-template.md", + "size": 661, + "mode": 420 + }, + { + "path": "docs/protocol.md", + "size": 8566, + "mode": 420 + }, + { + "path": "docs/recall-update.md", + "size": 5215, + "mode": 420 + }, + { + "path": "docs/release-recall-efficiency.md", + "size": 7060, + "mode": 420 + }, + { + "path": "docs/release-recall-lifecycle.md", + "size": 10340, + "mode": 420 + }, + { + "path": "docs/release-v0.1.0.md", + "size": 1375, + "mode": 420 + }, + { + "path": "docs/release-v0.2.0.md", + "size": 1096, + "mode": 420 + }, + { + "path": "docs/release-v0.2.1.md", + "size": 878, + "mode": 420 + }, + { + "path": "docs/release-v0.2.2.md", + "size": 827, + "mode": 420 + }, + { + "path": "docs/release-v0.3.0.md", + "size": 865, + "mode": 420 + }, + { + "path": "docs/release-v0.3.1.md", + "size": 666, + "mode": 420 + }, + { + "path": "docs/release-v0.4.0.md", + "size": 1977, + "mode": 420 + }, + { + "path": "docs/release-v0.4.1.md", + "size": 1671, + "mode": 420 + }, + { + "path": "docs/release-v0.5.0.md", + "size": 1494, + "mode": 420 + }, + { + "path": "docs/release-v0.6.0.md", + "size": 1834, + "mode": 420 + }, + { + "path": "docs/release-v0.7.0.md", + "size": 1906, + "mode": 420 + }, + { + "path": "docs/release-v0.7.1.md", + "size": 4074, + "mode": 420 + }, + { + "path": "docs/release-v0.8.0.md", + "size": 4889, + "mode": 420 + }, + { + "path": "docs/reliability.md", + "size": 2630, + "mode": 420 + }, + { + "path": "docs/scripted-recall.md", + "size": 4967, + "mode": 420 + }, + { + "path": "docs/social-recall-lifecycle-draft.md", + "size": 1481, + "mode": 420 + }, + { + "path": "docs/storage-markdown.md", + "size": 4272, + "mode": 420 + }, + { + "path": "docs/templates/AGENTS.template.md", + "size": 3008, + "mode": 420 + }, + { + "path": "docs/templates/memory/context/project-context.md", + "size": 346, + "mode": 420 + }, + { + "path": "docs/templates/memory/decisions/decision-template.md", + "size": 522, + "mode": 420 + }, + { + "path": "docs/templates/memory/events/YYYY-MM.md", + "size": 256, + "mode": 420 + }, + { + "path": "docs/templates/memory/impressions.jsonl", + "size": 295, + "mode": 420 + }, + { + "path": "docs/templates/memory/index.md", + "size": 500, + "mode": 420 + }, + { + "path": "docs/templates/memory/open-loops/open-loop-template.md", + "size": 587, + "mode": 420 + }, + { + "path": "docs/templates/memory/recall-feedback.jsonl", + "size": 177, + "mode": 420 + }, + { + "path": "docs/templates/memory/summary.md", + "size": 610, + "mode": 420 + }, + { + "path": "docs/verification-loop-evidence.json", + "size": 4840, + "mode": 420 + }, + { + "path": "docs/verification-loop.md", + "size": 11120, + "mode": 420 + }, + { + "path": "docs/workflow.md", + "size": 4866, + "mode": 420 + }, + { + "path": "package.json", + "size": 3672, + "mode": 420 + }, + { + "path": "scripts/benchmark-cache-ownership.mjs", + "size": 2023, + "mode": 420 + }, + { + "path": "scripts/benchmark-recall.mjs", + "size": 5304, + "mode": 420 + }, + { + "path": "scripts/check-markdown-links.mjs", + "size": 2059, + "mode": 420 + }, + { + "path": "scripts/deja-vu.mjs", + "size": 17088, + "mode": 420 + }, + { + "path": "scripts/dejavu-feedback-report.mjs", + "size": 2507, + "mode": 420 + }, + { + "path": "scripts/dejavu-lint-memory.mjs", + "size": 8338, + "mode": 420 + }, + { + "path": "scripts/dejavu-scan-memory.mjs", + "size": 5084, + "mode": 420 + }, + { + "path": "scripts/evaluate-recall.mjs", + "size": 3828, + "mode": 420 + }, + { + "path": "scripts/fixtures/recall-evaluation.json", + "size": 12258, + "mode": 420 + }, + { + "path": "scripts/lib/init-files.mjs", + "size": 5414, + "mode": 420 + }, + { + "path": "scripts/lib/memory-validation.mjs", + "size": 9951, + "mode": 420 + }, + { + "path": "starter-kit/AGENTS.md", + "size": 1696, + "mode": 420 + }, + { + "path": "starter-kit/memory/decisions/.gitkeep", + "size": 1, + "mode": 420 + }, + { + "path": "starter-kit/memory/impressions.jsonl", + "size": 276, + "mode": 420 + }, + { + "path": "starter-kit/memory/open-loops/.gitkeep", + "size": 1, + "mode": 420 + }, + { + "path": "starter-kit/memory/recall-feedback.jsonl", + "size": 1, + "mode": 420 + }, + { + "path": "starter-kit/memory/summary.md", + "size": 813, + "mode": 420 + }, + { + "path": "starter-kit/prompts/chatgpt.md", + "size": 782, + "mode": 420 + }, + { + "path": "starter-kit/prompts/claude-code.md", + "size": 671, + "mode": 420 + }, + { + "path": "starter-kit/prompts/codex.md", + "size": 665, + "mode": 420 + }, + { + "path": "starter-kit/prompts/cursor.md", + "size": 666, + "mode": 420 + }, + { + "path": "starter-kit/prompts/gemini-cli.md", + "size": 670, + "mode": 420 + }, + { + "path": "starter-kit/prompts/windsurf.md", + "size": 668, + "mode": 420 + }, + { + "path": "starter-kit/README.md", + "size": 1766, + "mode": 420 + } + ], + "entryCount": 138, + "bundled": [] + } +} diff --git a/.github/scripts/verify-release-0.8.0.mjs b/.github/scripts/verify-release-0.8.0.mjs new file mode 100644 index 0000000..ead9901 --- /dev/null +++ b/.github/scripts/verify-release-0.8.0.mjs @@ -0,0 +1,119 @@ +// Read-only publication verification. Run on an authorized network-enabled runner. +import assert from 'node:assert/strict'; +import { execFileSync } from 'node:child_process'; +import { createHash } from 'node:crypto'; +import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { dirname, join } from 'node:path'; + +const expected = JSON.parse(readFileSync(new URL('../release-v0.8.0-fingerprint.json', import.meta.url), 'utf8')); +const { manifest, releaseCommit } = expected; +const spec = `${manifest.name}@${manifest.version}`; +const root = mkdtempSync(join(tmpdir(), 'dejavu-registry-0.8.0-')); +const packCache = join(root, 'pack-cache'); +const installCache = join(root, 'install-cache'); +const installRoot = join(root, 'install'); +mkdirSync(installRoot); +assert.equal(existsSync(packCache), false); +assert.equal(existsSync(installCache), false); +const npmCli = [ + join(dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js'), + join(dirname(process.execPath), '../lib/node_modules/npm/bin/npm-cli.js'), +].find(existsSync); +assert.ok(npmCli, 'Use the npm bundled with the selected Node runtime'); + +function run(file, args, cwd = root) { + try { + return execFileSync(file, args, { cwd, encoding: 'utf8', timeout: 120_000, maxBuffer: 8 * 1024 * 1024 }); + } catch (error) { + // Keep the original execution error and both streams; do not parse failures as JSON. + console.error({ file, args, status: error.status, signal: error.signal, code: error.code, + stdout: error.stdout?.toString(), stderr: error.stderr?.toString() }); + throw error; + } +} +const npm = (args, cache) => run(process.execPath, [npmCli, ...args, + '--registry=https://registry.npmjs.org', `--cache=${cache}`, '--fetch-retries=0', '--fetch-timeout=30000']); + +const metadata = JSON.parse(npm(['view', spec, 'version', 'gitHead', 'dist', '--json'], packCache)); +const distTags = JSON.parse(npm(['view', manifest.name, 'dist-tags', '--json'], packCache)); +assert.equal(metadata.version, manifest.version); +assert.equal(distTags.latest, manifest.version, 'This closeout checks 0.8.0 as current latest; future releases may supersede it'); +assert.equal(metadata.gitHead, releaseCommit); +assert.equal(metadata.dist.integrity, manifest.integrity); +assert.equal(metadata.dist.shasum, manifest.shasum); +assert.equal(metadata.dist.fileCount, manifest.entryCount); +assert.equal(metadata.dist.unpackedSize, manifest.unpackedSize); +assert.equal(metadata.dist.tarball, 'https://registry.npmjs.org/@focaxisdev/deja-vu/-/deja-vu-0.8.0.tgz'); +console.log('Verified registry metadata:', JSON.stringify({ metadata, distTags })); + +// A registry spec downloads the published archive. It does not pack this checkout. +const packed = JSON.parse(npm(['pack', spec, '--json', '--ignore-scripts', '--pack-destination', root], packCache)); +assert.equal(packed.length, 1); +assert.deepEqual(packed[0], manifest, 'Full downloaded manifest must equal the original release CI fingerprint'); +const archive = readFileSync(join(root, packed[0].filename)); +assert.equal(archive.length, manifest.size); +assert.equal(createHash('sha1').update(archive).digest('hex'), manifest.shasum); +assert.equal(`sha512-${createHash('sha512').update(archive).digest('base64')}`, manifest.integrity); +console.log('Verified actual registry tarball:', JSON.stringify({ files: manifest.entryCount, + unpackedSize: manifest.unpackedSize, shasum: manifest.shasum, integrity: manifest.integrity })); + +// Independent empty cache, exact registry version, normal installation (no script bypass). +assert.equal(existsSync(installCache), false); +writeFileSync(join(installRoot, 'package.json'), JSON.stringify({ private: true, type: 'module' })); +console.log(npm(['install', '--prefix', installRoot, '--save-exact', '--no-audit', '--no-fund', spec], installCache)); +const lock = JSON.parse(readFileSync(join(installRoot, 'package-lock.json'), 'utf8')); +const installedEntry = lock.packages['node_modules/@focaxisdev/deja-vu']; +assert.equal(installedEntry.version, manifest.version); +assert.equal(installedEntry.integrity, manifest.integrity); +assert.equal(installedEntry.resolved, metadata.dist.tarball); +const installed = join(installRoot, 'node_modules/@focaxisdev/deja-vu'); +const installedManifest = JSON.parse(readFileSync(join(installed, 'package.json'), 'utf8')); +assert.equal(installedManifest.version, manifest.version); +const cli = (name, args) => JSON.parse(run(process.execPath, [join(installed, 'scripts', name), ...args], installRoot)); +assert.equal(cli('deja-vu.mjs', ['init', '--project-id', 'project:published-smoke', '--json']).ready, true); +assert.equal(cli('deja-vu.mjs', ['doctor', '--json']).ok, true); +const explanation = cli('deja-vu.mjs', ['explain', '--json']).explanation; +for (const text of ['3-file', 'AGENTS.md', 'memory/summary.md', 'memory/impressions.jsonl']) assert.ok(explanation.includes(text)); +assert.equal(cli('dejavu-lint-memory.mjs', []).ok, true); +assert.equal(cli('dejavu-scan-memory.mjs', ['project constraints']).ok, true); +assert.equal(cli('dejavu-feedback-report.mjs', []).ok, true); + +// Execute the existing installed-package API assertions without duplicating or weakening them. +const packageTest = readFileSync(new URL('../../tests/package-pack.test.ts', import.meta.url), 'utf8'); +const smokeStart = 'const smoke = execFileSync(process.execPath, ["--input-type=module", "-e", `'; +const start = packageTest.indexOf(smokeStart); +assert.notEqual(start, -1, 'Installed API smoke marker must remain present'); +const from = start + smokeStart.length; +const to = packageTest.indexOf('`], { cwd: installRoot, encoding: "utf8" });', from); +assert.ok(to > from, 'Installed API smoke closing marker must remain present'); +const smoke = packageTest.slice(from, to); +assert.equal(smoke.includes('${'), false, 'Use a literal standalone smoke body'); +const smokePath = join(installRoot, 'installed-api-smoke.mjs'); +writeFileSync(smokePath, smoke); +assert.equal(run(process.execPath, [smokePath], installRoot).trim(), 'ok'); +console.log('Clean version-pinned installation, CLI init/doctor/explain/lint/scan/feedback and existing installed API smoke: passed'); + +async function github(path) { + const response = await fetch(`https://api.github.com/repos/focaxisdev/deja-vu/${path}`, { + headers: { Accept: 'application/vnd.github+json' }, signal: AbortSignal.timeout(30_000), + }); + assert.equal(response.status, 200, `Public GitHub read failed: ${path}`); + return response.json(); +} +const tag = await github('git/ref/tags/v0.8.0'); +const release = await github('releases/416213665'); +assert.equal(tag.object.type, 'commit'); +assert.equal(tag.object.sha, releaseCommit); +assert.equal(release.tag_name, 'v0.8.0'); +assert.equal(release.target_commitish, releaseCommit); +assert.equal(release.draft, false); +assert.equal(release.prerelease, false); +assert.ok(release.published_at); +const evidence = { node: process.version, npm: run(process.execPath, [npmCli, '--version']).trim(), + version: manifest.version, latest: distTags.latest, gitHead: metadata.gitHead, tag: tag.object.sha, + release: release.html_url, releaseId: release.id, publishedAt: release.published_at, + fingerprintSource: expected.ci, integrity: manifest.integrity, shasum: manifest.shasum, + files: manifest.entryCount, unpackedSize: manifest.unpackedSize, allGatesPassed: true }; +writeFileSync(join(root, 'verification.json'), JSON.stringify(evidence, null, 2)); +console.log('Published release verification:', JSON.stringify(evidence)); diff --git a/.github/workflows/verify-release-0.8.0.yml b/.github/workflows/verify-release-0.8.0.yml new file mode 100644 index 0000000..c9bf1bf --- /dev/null +++ b/.github/workflows/verify-release-0.8.0.yml @@ -0,0 +1,33 @@ +name: Verify published 0.8.0 + +on: + workflow_dispatch: + push: + branches: [main, release/verify-0.8.0] + paths: + - .github/workflows/verify-release-0.8.0.yml + - .github/scripts/verify-release-0.8.0.mjs + - .github/release-v0.8.0-fingerprint.json + - docs/release-v0.8.0.md + - docs/registry-v0.8.0-verification.md + +permissions: + contents: read + +jobs: + registry: + strategy: + fail-fast: false + matrix: + os: [ubuntu-latest, windows-latest] + runs-on: ${{ matrix.os }} + timeout-minutes: 15 + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: actions/setup-node@v4 + with: + node-version: 22 + - name: Verify registry metadata, actual tarball and clean installed CLI/API + run: node .github/scripts/verify-release-0.8.0.mjs From fb2f810c83041bb60008297236eb5b556fccb84a Mon Sep 17 00:00:00 2001 From: focaxisdev <263514337+focaxisdev@users.noreply.github.com> Date: Sun, 18 Oct 2026 13:51:29 +0800 Subject: [PATCH 2/2] docs: record independently verified 0.8.0 publication Exact source local commit: 03660076325ce7eedc6d85ac5bfff6cc38d7dfd7 Verified tracked tree: e39754ec9088fc3f5e5af4a239a143fbd99145cb Original local history retained; remote SHA intentionally differs. --- CHANGELOG.md | 19 ++++-- README.md | 6 +- docs/recall-update.md | 12 ++-- docs/registry-v0.8.0-verification.md | 75 +++++++++++++++++++++++ docs/release-recall-efficiency.md | 5 +- docs/release-recall-lifecycle.md | 8 +-- docs/release-v0.7.1.md | 2 +- docs/release-v0.8.0.md | 87 +++++++++++++-------------- docs/social-recall-lifecycle-draft.md | 10 +-- 9 files changed, 155 insertions(+), 69 deletions(-) create mode 100644 docs/registry-v0.8.0-verification.md diff --git a/CHANGELOG.md b/CHANGELOG.md index a2e687c..870e707 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,16 +2,25 @@ All notable changes to this project will be documented in this file. -## [0.8.0] - Unreleased +## Unreleased -Minor release preparation for the additive, opt-in engine APIs; includes the -unpublished 0.7.1 reliability fixes. See [publication status](docs/release-v0.8.0.md). +- Close out repository documentation after independently verifying the published + 0.8.0 registry metadata, original CI fingerprint, clean installation and CLI/API + on Ubuntu and Windows. Add a read-only, version-specific verification workflow; + these repository follow-ups do not change the published package or tag. See + [publication evidence](docs/registry-v0.8.0-verification.md). -- Introduce the source update on the repository homepage, with [opt-in examples, migration guidance and scoped measurements](docs/recall-update.md). No new npm package or GitHub Release is published. +## [0.8.0] - 2026-10-18 + +Additive, opt-in engine APIs and the previously unpublished 0.7.1 reliability +fixes. [Published on npm and GitHub](docs/release-v0.8.0.md) from commit +`42221805bdb1853b4cc347d7bfba29532594b3f2`. + +- Introduce the source update on the repository homepage, with [opt-in examples, migration guidance and scoped measurements](docs/recall-update.md). The update is included in package 0.8.0. - Reuse the complete synthetic-data acceptance workflow for main and pull requests, including fresh-project lint/readiness checks, without reading project memory. - Preserve original CLI subprocess failures in test helpers, retain execution/parse causes for invalid error responses, and add ten diagnostic regressions without weakening product assertions. - Append general acceptance/evidence/repair-loop rules to AGENTS.md and preserve the historical [Cloud blocker checkpoint](docs/verification-loop.md). -- Verify complete source, compiled, installed-package, type, recall-quality and cache gates on Ubuntu and Windows in [branch-only Actions](docs/actions-acceptance-results.md). Fix workflow context/path/newline handling and freeze the recall tie fixture's clock without changing product assertions. These changes remain unreleased. +- Verify complete source, compiled, installed-package, type, recall-quality and cache gates on Ubuntu and Windows in [branch-only Actions](docs/actions-acceptance-results.md). Fix workflow context/path/newline handling and freeze the recall tie fixture's clock without changing product assertions. The release commit passed complete main CI before publication. - Add opt-in exact query aliases, managed per-memory/revision embedding scopes, and serialized reads; digest cache keys avoid retained plaintext input keys. - Compensate failed deletions, add explicit recoverable `supersedeMemory`, and return defensive summary/chunk copies from the in-memory adapter. diff --git a/README.md b/README.md index d2e1192..a4b8370 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,9 @@ No database. No vector store. No embeddings. No SaaS. No daemon. No required npm ## Latest update: more reliable, bounded recall -**Available in repository source; [v0.8.0 is prepared for publication](./docs/release-v0.8.0.md), but is not yet on npm.** +**[v0.8.0 is published on npm](https://www.npmjs.com/package/@focaxisdev/deja-vu/v/0.8.0) and [GitHub](https://github.com/focaxisdev/deja-vu/releases/tag/v0.8.0).** +Published-artifact and clean-install checks pass on Ubuntu and Windows; see the +[release notes](./docs/release-v0.8.0.md) and [registry verification evidence](./docs/registry-v0.8.0-verification.md). The optional TypeScript engine now keeps eligible memories from being hidden by less relevant ranking winners. It also adds bounded prompt excerpts, recoverable @@ -215,7 +217,7 @@ Read the [engine guide](./docs/engine/semantic-engine.md) or run the [basic exam Repository source includes eligible-candidate selection, bounded prompt output, and opt-in embedding reuse, [explicit aliases, cache ownership and provenance](docs/engine/recall-lifecycle.md). -These additions are prepared for v0.8.0 and are not yet published on npm. See the +These additions are available in the published v0.8.0 package. See the [update and migration overview](docs/recall-update.md), [usage examples](docs/engine/recall-efficiency.md), and [complete hosted acceptance results](docs/actions-acceptance-results.md). diff --git a/docs/recall-update.md b/docs/recall-update.md index 9181a73..2d719d3 100644 --- a/docs/recall-update.md +++ b/docs/recall-update.md @@ -1,10 +1,10 @@ # More reliable recall, with explicit budgets and opt-ins -These changes are available in repository source and prepared for package v0.8.0. -Npm publication and the GitHub Release are still pending; see the -[release status and final verification checklist](release-v0.8.0.md). The existing -npm setup instructions still describe the three-file protocol; do not assume an -npm install already includes every source addition below. +These changes are available in repository source and the published +[`@focaxisdev/deja-vu@0.8.0`](https://www.npmjs.com/package/@focaxisdev/deja-vu/v/0.8.0) +package. See the [release notes](release-v0.8.0.md) and independent +[registry artifact and clean-install verification](registry-v0.8.0-verification.md). +The three-file protocol still requires no npm installation. ## What improves @@ -22,7 +22,7 @@ These are optional engine features, not new requirements for file-first adoption ## Enable only what your host needs -With the repository build, exact aliases can route familiar wording to an existing +With package v0.8.0 or the repository build, exact aliases can route familiar wording to an existing distinctive cue, while candidate search and prompt output have separate budgets: ```ts diff --git a/docs/registry-v0.8.0-verification.md b/docs/registry-v0.8.0-verification.md new file mode 100644 index 0000000..0ca6409 --- /dev/null +++ b/docs/registry-v0.8.0-verification.md @@ -0,0 +1,75 @@ +# Published 0.8.0: independent registry verification + +Verified on 2026-10-18 using public registry and GitHub reads from GitHub Actions. +[Run 39101806633](https://github.com/focaxisdev/deja-vu/actions/runs/39101806633) +completed successfully on Ubuntu and Windows at verification commit +`eb642db63cfa9f97746d589863f2146ab53268ae`. This follow-up commit is not the +published package's source revision. + +| Identity or artifact | Verified value | +| --- | --- | +| npm package version / observed latest | 0.8.0 / 0.8.0 | +| npm gitHead, v0.8.0 tag, Release target | `42221805bdb1853b4cc347d7bfba29532594b3f2` | +| GitHub Release ID | 416213665, public, not a prerelease | +| File count / unpacked size | 138 files / 822,678 bytes | +| Tarball SHA-1 | `9e09a7067f2a56ebbeefaee89933ad5487276d31` | + +Tarball SHA-512 integrity: + +```text +sha512-QPwz0brkGf7Ip1P7xnfcB1XwKeI3DvLjApccKP+H+CULWkOxtIqdFglMLhN62X5XcawdGyL03aLVigmTaL4H3w== +``` + +The complete expected manifest was captured from the original release commit's +[main CI](https://github.com/focaxisdev/deja-vu/actions/runs/39093665904), before +registry verification. Its fixed [fingerprint](https://github.com/focaxisdev/deja-vu/blob/eb642db63cfa9f97746d589863f2146ab53268ae/.github/release-v0.8.0-fingerprint.json) +includes every file's path, size and mode. Verification compares that entire +manifest and independently hashes the bytes downloaded from the real registry. +It does not substitute a newly packed local checkout. + +## Gates and logs + +Both jobs used Node v22.23.3 and npm 10.9.9: +[Ubuntu log](https://github.com/focaxisdev/deja-vu/actions/runs/39101806633/job/117599436397), +[Windows log](https://github.com/focaxisdev/deja-vu/actions/runs/39101806633/job/117599436532). + +| Gate | Ubuntu | Windows | +| --- | --- | --- | +| Registry version, latest, gitHead and distribution metadata | Passed | Passed | +| Downloaded archive: complete manifest, SHA-1 and SHA-512 | Passed | Passed | +| New directory/cache, version-pinned registry installation | Passed | Passed | +| Installed lockfile version, resolved URL and integrity | Passed | Passed | +| CLI init, doctor, explain, lint, scan and feedback | Passed | Passed | +| Existing installed API smoke, including new opt-in APIs | Passed | Passed | +| Public tag and Release target correspondence | Passed | Passed | + +The installation uses a separate, initially absent cache from the registry-pack +cache and installs `@focaxisdev/deja-vu@0.8.0`, not a local tarball. The normal +installation does not disable lifecycle scripts. API assertions are reused from +the existing package test, including eligible alias recall, byte-bounded projection, +metadata update, supersession, raw retrieval and zero retained managed-cache entries +after deletion. All data is synthetic; no paid embedding service is used. + +The [original full-suite results](https://github.com/focaxisdev/deja-vu/actions/runs/39093665904) +cover 119 source and the same 119 compiled cases plus one package/install/use case +per platform, with zero failures or skips. Registry verification is additional +installed-artifact evidence, not another full run of those source tests. Later +repository changes receive their own [main CI](https://github.com/focaxisdev/deja-vu/actions/workflows/ci.yml). + +## Scope and reproducibility + +The version-specific workflow has only `contents: read`, does not persist checkout +credentials, and cannot publish or move tags. It checks 0.8.0 as `latest` at this +closeout; a later release may legitimately supersede that dist-tag and make this +historical latest assertion fail. That does not retroactively invalidate these logs. + +The published archive retains preparation-era pending text. Current repository +documentation records the completed publication; those newer documentation commits +must not be mistaken for npm `gitHead`. The original tag and tarball are unchanged. +These checks establish artifact correspondence and exercised behavior, not npm +provenance attestation or compatibility with every supported Node version. + +The workload-specific [performance and recall limitations](recall-update.md#benefits-and-limits-measured-separately) +still apply. Neither this clean-install check nor matching hashes measures a new +product-wide speedup. The earlier Cloud execution/network restrictions remain a +separate environment limitation and were not bypassed for this verification. diff --git a/docs/release-recall-efficiency.md b/docs/release-recall-efficiency.md index c3cb6a6..0465476 100644 --- a/docs/release-recall-efficiency.md +++ b/docs/release-recall-efficiency.md @@ -1,7 +1,8 @@ # More reliable, bounded engine recall: first-batch evidence -Included in the [v0.8.0 preparation](release-v0.8.0.md); package publication is -pending. These historical measurements are not a publication record. Start with the +Included in the published [v0.8.0 release](release-v0.8.0.md). These historical +measurements retain their original scope; publication is independently checked +in the [registry verification report](registry-v0.8.0-verification.md). Start with the [combined update and opt-in overview](recall-update.md). These measurements and validation counts describe the first implementation batch diff --git a/docs/release-recall-lifecycle.md b/docs/release-recall-lifecycle.md index 1e40fd9..744a99a 100644 --- a/docs/release-recall-lifecycle.md +++ b/docs/release-recall-lifecycle.md @@ -1,7 +1,7 @@ # Explicit recall cues and recoverable memory lifecycle: second-batch evidence -Included in the [v0.8.0 preparation](release-v0.8.0.md); package publication is -pending. These historical measurements are not a publication record. See the +Included in the published [v0.8.0 release](release-v0.8.0.md). These historical +measurements retain their original scope; see the [registry verification report](registry-v0.8.0-verification.md) and the [combined introduction and opt-ins](recall-update.md). This follows the [first recall-efficiency changes](release-recall-efficiency.md) and uses `bad6b527409a44a693562fbe60c41be74126e573` as its comparison baseline. @@ -10,8 +10,8 @@ These results describe the second implementation batch. The subsequent loss and records the historical native-execution blocker. Complete hosted [acceptance now passes on Ubuntu and Windows](actions-acceptance-results.md), including 119 source cases, 119 compiled cases and one package/install/use case -per platform, with no skipped tests. The source and these notes are public; the -package update and social draft remain unreleased. The original Cloud EPERM cause is +per platform, with no skipped tests. The source, package and release notes are +public; the social draft remains unpublished. The original Cloud EPERM cause is still unresolved, and the results below retain their original measurement scope. ## User introduction diff --git a/docs/release-v0.7.1.md b/docs/release-v0.7.1.md index 1ee93e8..f81c06b 100644 --- a/docs/release-v0.7.1.md +++ b/docs/release-v0.7.1.md @@ -1,6 +1,6 @@ # Deja Vu v0.7.1: historical release preparation -This unpublished patch candidate is superseded by the [v0.8.0 preparation](release-v0.8.0.md), +This unpublished patch candidate is superseded by the published [v0.8.0 release](release-v0.8.0.md), which includes these fixes and the later optional engine APIs. The current package manifest is 0.8.0; this page preserves the earlier candidate and its historical checks. diff --git a/docs/release-v0.8.0.md b/docs/release-v0.8.0.md index 7199122..a287dc7 100644 --- a/docs/release-v0.8.0.md +++ b/docs/release-v0.8.0.md @@ -1,8 +1,10 @@ -# Deja Vu v0.8.0 release preparation +# Deja Vu v0.8.0 release -**Status: prepared in source; npm publication, tag and GitHub Release are pending.** -No publication date is assigned. The package and lockfile target 0.8.0, a minor -increment for additive, opt-in engine APIs. The unpublished 0.7.1 candidate's +**Published on npm and GitHub; independently verified on 2026-10-18.** +The [npm package](https://www.npmjs.com/package/@focaxisdev/deja-vu/v/0.8.0), +[v0.8.0 tag and GitHub Release](https://github.com/focaxisdev/deja-vu/releases/tag/v0.8.0) +correspond to commit `42221805bdb1853b4cc347d7bfba29532594b3f2`. This minor +increment contains additive, opt-in engine APIs. The unpublished 0.7.1 candidate's reliability fixes are included; Protocol v0.4 and the three-file adoption path remain unchanged. No runtime dependency is added. @@ -21,7 +23,8 @@ CLI validation and initialization recovery include the earlier reliability fixes Use the existing [introduction, opt-in examples and migration guide](recall-update.md) and [changelog](../CHANGELOG.md) for details. No memory-file migration is required. -Do not treat an unpublished candidate as available through `npm install`. +For a version-pinned install, use `npm install @focaxisdev/deja-vu@0.8.0`. +The existing copy-first and CLI adoption paths remain available. ## Benefits and limits @@ -40,42 +43,38 @@ Do not treat an unpublished candidate as available through `npm install`. See the [first-batch measurements](release-recall-efficiency.md) and [second-batch measurements](release-recall-lifecycle.md) for workloads and caveats. -## Acceptance and publication gates - -Before a tag or package is published, verify the final main revision: - -1. Complete source and compiled suites, type checking, public Markdown links, - package/install/CLI/API checks on Ubuntu and Windows, with no skipped cases. -2. Frozen recall quality and cache lifecycle counts, projection regressions, - synthetic protocol lint/feedback and fresh-project readiness. -3. Full package paths and content review: only public distribution files and - synthetic examples; no project memory, credentials or private task material. - Check manifest/lock/installed version, tarball SHA-1 and SHA-512 integrity. -4. Read actual npm versions/dist-tags and Git tags immediately before publication; - confirm 0.8.0 and v0.8.0 are free. CI logs registry metadata without credentials. -5. Publish from the exact verified commit using an existing authenticated release - mechanism. Keep `prepublishOnly` and all assertions enabled. Do not overwrite - an existing tag/version or bypass an authentication/OTP requirement. -6. Verify npm `version`, `gitHead`, `dist.integrity`, `dist.shasum` and `latest`; - download and compare the actual registry artifact. Perform a clean - `@focaxisdev/deja-vu@0.8.0` installation and repeat CLI/API smoke checks. -7. Verify v0.8.0 resolves to the same commit as npm `gitHead` and the GitHub - Release target. Record the real publication status/date only after success. - -The [hosted acceptance report](actions-acceptance-results.md) covers the earlier -source update. The final release-preparation PR and main CI must pass separately; -their checks are visible in [CI](https://github.com/focaxisdev/deja-vu/actions/workflows/ci.yml). - -## Current external blockers - -The Cloud shell's public-registry request was denied with `connect EPERM`; it was -not retried through another proxy or security configuration. Its existing GitHub -CLI authentication also reports an invalid token. The available connector can -publish verified branch trees and merge pull requests, but does not expose tag -or Release creation. Its fetch interface does not support listing Actions secrets. -No new credential, permission or publishing workflow has been configured. - -Release completion needs an existing authenticated npm and GitHub release -environment with normal registry connectivity. Until that is available, successful -CI and merged preparation are not evidence of npm publication or a GitHub Release. -Do not reuse an earlier tarball after changing the release files. +## Verified publication + +The original release commit passed [complete main CI](https://github.com/focaxisdev/deja-vu/actions/runs/39093665904) +on Ubuntu and Windows: 119 source cases, the same 119 compiled cases, one +package/install/use case, types, links, frozen recall quality, cache lifecycle, +synthetic protocol checks and fresh-project readiness. No cases were skipped. + +After maintainer publication, [independent registry verification](https://github.com/focaxisdev/deja-vu/actions/runs/39101806633) +passed on both platforms using Node 22.23.3 and npm 10.9.9: + +- Registry `version` and `latest` are 0.8.0 at verification time. +- Registry `gitHead`, v0.8.0 and Release target all identify the original release commit. +- The actual downloaded tarball matches the original CI's complete 138-file + manifest, 822,678 unpacked bytes, SHA-1 and SHA-512 integrity. +- An independent empty cache and new install directory successfully install the + exact registry version and run CLI init/doctor/explain, lint/scan/feedback, and + the existing installed API smoke covering aliases, projection, metadata update, + supersession and managed cache release. + +See the [full registry evidence and fingerprints](registry-v0.8.0-verification.md) +for log links and scope. This verification is read-only: it does not publish, +move a tag, create credentials or alter security settings. + +## Release commit and later documentation + +The package was published through the maintainer's existing npm login and the +GitHub Release through an existing web session. Cloud's earlier `connect EPERM` +was not retried or bypassed. Hosted verification resolves the publication checks; +it does not diagnose the earlier Cloud runtime failure. + +The published archive is immutable and retains the preparation-era README and +release-note wording. These current repository notes correct that wording after +verification. Later main documentation/verification commits are **not** npm +`gitHead`, and the v0.8.0 tag remains on the original release commit. No new +package version or republished tarball is implied by this closeout. diff --git a/docs/social-recall-lifecycle-draft.md b/docs/social-recall-lifecycle-draft.md index 0b4448b..745829d 100644 --- a/docs/social-recall-lifecycle-draft.md +++ b/docs/social-recall-lifecycle-draft.md @@ -1,8 +1,8 @@ # Local social draft: recall cues and lifecycle -Unpublished social draft only. Package v0.8.0 is prepared, with no publication date -assigned; see the [release status](release-v0.8.0.md). Hosted source acceptance -has passed; publishing the package or a social announcement remains a separate action. +Unpublished social draft only. Package v0.8.0 and its GitHub Release are public; +see the [release status](release-v0.8.0.md) and [registry verification](registry-v0.8.0-verification.md). +No social announcement has been posted as part of this closeout. See the [evidence and limitations](release-recall-lifecycle.md). ## Short introduction @@ -23,5 +23,5 @@ and this round did not improve measured latency. Direct offline packaging and installed smoke checks pass. Full source, compiled and installed-package tests also pass on Ubuntu and Windows in the verification branch's GitHub Actions. That does not explain the earlier Cloud runtime's native EPERM. The source is -public; the package update and this social draft remain unreleased. Usage, migration, -full measurements and remaining limits are in the release-note draft. +public, as is package v0.8.0; this social draft remains unpublished. Usage, migration, +full measurements and remaining limits are in the release notes.