Verify published 0.8.0 and close out release documentation

.github/scripts/verify-release-0.8.0.mjs

@@ -0,0 +1,119 @@
+// Read-only publication verification. Run on an authorized network-enabled runner.
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+const expected = JSON.parse(readFileSync(new URL('../release-v0.8.0-fingerprint.json', import.meta.url), 'utf8'));
+const { manifest, releaseCommit } = expected;
+const spec = `${manifest.name}@${manifest.version}`;
+const root = mkdtempSync(join(tmpdir(), 'dejavu-registry-0.8.0-'));
+const packCache = join(root, 'pack-cache');
+const installCache = join(root, 'install-cache');
+const installRoot = join(root, 'install');
+mkdirSync(installRoot);
+assert.equal(existsSync(packCache), false);
+assert.equal(existsSync(installCache), false);
+const npmCli = [
+  join(dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js'),
+  join(dirname(process.execPath), '../lib/node_modules/npm/bin/npm-cli.js'),
+].find(existsSync);
+assert.ok(npmCli, 'Use the npm bundled with the selected Node runtime');
+
+function run(file, args, cwd = root) {
+  try {
+    return execFileSync(file, args, { cwd, encoding: 'utf8', timeout: 120_000, maxBuffer: 8 * 1024 * 1024 });
+  } catch (error) {
+    // Keep the original execution error and both streams; do not parse failures as JSON.
+    console.error({ file, args, status: error.status, signal: error.signal, code: error.code,
+      stdout: error.stdout?.toString(), stderr: error.stderr?.toString() });
+    throw error;
+  }
+}
+const npm = (args, cache) => run(process.execPath, [npmCli, ...args,
+  '--registry=https://registry.npmjs.org', `--cache=${cache}`, '--fetch-retries=0', '--fetch-timeout=30000']);
+
+const metadata = JSON.parse(npm(['view', spec, 'version', 'gitHead', 'dist', '--json'], packCache));
+const distTags = JSON.parse(npm(['view', manifest.name, 'dist-tags', '--json'], packCache));
+assert.equal(metadata.version, manifest.version);
+assert.equal(distTags.latest, manifest.version, 'This closeout checks 0.8.0 as current latest; future releases may supersede it');
+assert.equal(metadata.gitHead, releaseCommit);
+assert.equal(metadata.dist.integrity, manifest.integrity);
+assert.equal(metadata.dist.shasum, manifest.shasum);
+assert.equal(metadata.dist.fileCount, manifest.entryCount);
+assert.equal(metadata.dist.unpackedSize, manifest.unpackedSize);
+assert.equal(metadata.dist.tarball, 'https://registry.npmjs.org/@focaxisdev/deja-vu/-/deja-vu-0.8.0.tgz');
+console.log('Verified registry metadata:', JSON.stringify({ metadata, distTags }));
+
+// A registry spec downloads the published archive. It does not pack this checkout.
+const packed = JSON.parse(npm(['pack', spec, '--json', '--ignore-scripts', '--pack-destination', root], packCache));
+assert.equal(packed.length, 1);
+assert.deepEqual(packed[0], manifest, 'Full downloaded manifest must equal the original release CI fingerprint');
+const archive = readFileSync(join(root, packed[0].filename));
+assert.equal(archive.length, manifest.size);
+assert.equal(createHash('sha1').update(archive).digest('hex'), manifest.shasum);
+assert.equal(`sha512-${createHash('sha512').update(archive).digest('base64')}`, manifest.integrity);
+console.log('Verified actual registry tarball:', JSON.stringify({ files: manifest.entryCount,
+  unpackedSize: manifest.unpackedSize, shasum: manifest.shasum, integrity: manifest.integrity }));
+
+// Independent empty cache, exact registry version, normal installation (no script bypass).
+assert.equal(existsSync(installCache), false);
+writeFileSync(join(installRoot, 'package.json'), JSON.stringify({ private: true, type: 'module' }));
+console.log(npm(['install', '--prefix', installRoot, '--save-exact', '--no-audit', '--no-fund', spec], installCache));
+const lock = JSON.parse(readFileSync(join(installRoot, 'package-lock.json'), 'utf8'));
+const installedEntry = lock.packages['node_modules/@focaxisdev/deja-vu'];
+assert.equal(installedEntry.version, manifest.version);
+assert.equal(installedEntry.integrity, manifest.integrity);
+assert.equal(installedEntry.resolved, metadata.dist.tarball);
+const installed = join(installRoot, 'node_modules/@focaxisdev/deja-vu');
+const installedManifest = JSON.parse(readFileSync(join(installed, 'package.json'), 'utf8'));
+assert.equal(installedManifest.version, manifest.version);
+const cli = (name, args) => JSON.parse(run(process.execPath, [join(installed, 'scripts', name), ...args], installRoot));
+assert.equal(cli('deja-vu.mjs', ['init', '--project-id', 'project:published-smoke', '--json']).ready, true);
+assert.equal(cli('deja-vu.mjs', ['doctor', '--json']).ok, true);
+const explanation = cli('deja-vu.mjs', ['explain', '--json']).explanation;
+for (const text of ['3-file', 'AGENTS.md', 'memory/summary.md', 'memory/impressions.jsonl']) assert.ok(explanation.includes(text));
+assert.equal(cli('dejavu-lint-memory.mjs', []).ok, true);
+assert.equal(cli('dejavu-scan-memory.mjs', ['project constraints']).ok, true);
+assert.equal(cli('dejavu-feedback-report.mjs', []).ok, true);
+
+// Execute the existing installed-package API assertions without duplicating or weakening them.
+const packageTest = readFileSync(new URL('../../tests/package-pack.test.ts', import.meta.url), 'utf8');
+const smokeStart = 'const smoke = execFileSync(process.execPath, ["--input-type=module", "-e", `';
+const start = packageTest.indexOf(smokeStart);
+assert.notEqual(start, -1, 'Installed API smoke marker must remain present');
+const from = start + smokeStart.length;
+const to = packageTest.indexOf('`], { cwd: installRoot, encoding: "utf8" });', from);
+assert.ok(to > from, 'Installed API smoke closing marker must remain present');
+const smoke = packageTest.slice(from, to);
+assert.equal(smoke.includes('${'), false, 'Use a literal standalone smoke body');
+const smokePath = join(installRoot, 'installed-api-smoke.mjs');
+writeFileSync(smokePath, smoke);
+assert.equal(run(process.execPath, [smokePath], installRoot).trim(), 'ok');
+console.log('Clean version-pinned installation, CLI init/doctor/explain/lint/scan/feedback and existing installed API smoke: passed');
+
+async function github(path) {
+  const response = await fetch(`https://api.github.com/repos/focaxisdev/deja-vu/${path}`, {
+    headers: { Accept: 'application/vnd.github+json' }, signal: AbortSignal.timeout(30_000),
+  });
+  assert.equal(response.status, 200, `Public GitHub read failed: ${path}`);
+  return response.json();
+}
+const tag = await github('git/ref/tags/v0.8.0');
+const release = await github('releases/416213665');
+assert.equal(tag.object.type, 'commit');
+assert.equal(tag.object.sha, releaseCommit);
+assert.equal(release.tag_name, 'v0.8.0');
+assert.equal(release.target_commitish, releaseCommit);
+assert.equal(release.draft, false);
+assert.equal(release.prerelease, false);
+assert.ok(release.published_at);
+const evidence = { node: process.version, npm: run(process.execPath, [npmCli, '--version']).trim(),
+  version: manifest.version, latest: distTags.latest, gitHead: metadata.gitHead, tag: tag.object.sha,
+  release: release.html_url, releaseId: release.id, publishedAt: release.published_at,
+  fingerprintSource: expected.ci, integrity: manifest.integrity, shasum: manifest.shasum,
+  files: manifest.entryCount, unpackedSize: manifest.unpackedSize, allGatesPassed: true };
+writeFileSync(join(root, 'verification.json'), JSON.stringify(evidence, null, 2));
+console.log('Published release verification:', JSON.stringify(evidence));

.github/workflows/verify-release-0.8.0.yml

@@ -0,0 +1,33 @@
+name: Verify published 0.8.0
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main, release/verify-0.8.0]
+    paths:
+      - .github/workflows/verify-release-0.8.0.yml
+      - .github/scripts/verify-release-0.8.0.mjs
+      - .github/release-v0.8.0-fingerprint.json
+      - docs/release-v0.8.0.md
+      - docs/registry-v0.8.0-verification.md
+
+permissions:
+  contents: read
+
+jobs:
+  registry:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Verify registry metadata, actual tarball and clean installed CLI/API
+        run: node .github/scripts/verify-release-0.8.0.mjs

CHANGELOG.md

@@ -2,16 +2,25 @@
 
 All notable changes to this project will be documented in this file.
 
-## [0.8.0] - Unreleased
+## Unreleased
 
-Minor release preparation for the additive, opt-in engine APIs; includes the
-unpublished 0.7.1 reliability fixes. See [publication status](docs/release-v0.8.0.md).
+- Close out repository documentation after independently verifying the published
+  0.8.0 registry metadata, original CI fingerprint, clean installation and CLI/API
+  on Ubuntu and Windows. Add a read-only, version-specific verification workflow;
+  these repository follow-ups do not change the published package or tag. See
+  [publication evidence](docs/registry-v0.8.0-verification.md).
 
-- Introduce the source update on the repository homepage, with [opt-in examples, migration guidance and scoped measurements](docs/recall-update.md). No new npm package or GitHub Release is published.
+## [0.8.0] - 2026-10-18
+
+Additive, opt-in engine APIs and the previously unpublished 0.7.1 reliability
+fixes. [Published on npm and GitHub](docs/release-v0.8.0.md) from commit
+`42221805bdb1853b4cc347d7bfba29532594b3f2`.
+
+- Introduce the source update on the repository homepage, with [opt-in examples, migration guidance and scoped measurements](docs/recall-update.md). The update is included in package 0.8.0.
 - Reuse the complete synthetic-data acceptance workflow for main and pull requests, including fresh-project lint/readiness checks, without reading project memory.
 - Preserve original CLI subprocess failures in test helpers, retain execution/parse causes for invalid error responses, and add ten diagnostic regressions without weakening product assertions.
 - Append general acceptance/evidence/repair-loop rules to AGENTS.md and preserve the historical [Cloud blocker checkpoint](docs/verification-loop.md).
-- Verify complete source, compiled, installed-package, type, recall-quality and cache gates on Ubuntu and Windows in [branch-only Actions](docs/actions-acceptance-results.md). Fix workflow context/path/newline handling and freeze the recall tie fixture's clock without changing product assertions. These changes remain unreleased.
+- Verify complete source, compiled, installed-package, type, recall-quality and cache gates on Ubuntu and Windows in [branch-only Actions](docs/actions-acceptance-results.md). Fix workflow context/path/newline handling and freeze the recall tie fixture's clock without changing product assertions. The release commit passed complete main CI before publication.
 
 - Add opt-in exact query aliases, managed per-memory/revision embedding scopes, and serialized reads; digest cache keys avoid retained plaintext input keys.
 - Compensate failed deletions, add explicit recoverable `supersedeMemory`, and return defensive summary/chunk copies from the in-memory adapter.

README.md

@@ -13,7 +13,9 @@ No database. No vector store. No embeddings. No SaaS. No daemon. No required npm
 
 ## Latest update: more reliable, bounded recall
 
-**Available in repository source; [v0.8.0 is prepared for publication](./docs/release-v0.8.0.md), but is not yet on npm.**
+**[v0.8.0 is published on npm](https://www.npmjs.com/package/@focaxisdev/deja-vu/v/0.8.0) and [GitHub](https://github.com/focaxisdev/deja-vu/releases/tag/v0.8.0).**
+Published-artifact and clean-install checks pass on Ubuntu and Windows; see the
+[release notes](./docs/release-v0.8.0.md) and [registry verification evidence](./docs/registry-v0.8.0-verification.md).
 
 The optional TypeScript engine now keeps eligible memories from being hidden by
 less relevant ranking winners. It also adds bounded prompt excerpts, recoverable
@@ -215,7 +217,7 @@ Read the [engine guide](./docs/engine/semantic-engine.md) or run the [basic exam
 
 Repository source includes eligible-candidate selection, bounded prompt output,
 and opt-in embedding reuse, [explicit aliases, cache ownership and provenance](docs/engine/recall-lifecycle.md).
-These additions are prepared for v0.8.0 and are not yet published on npm. See the
+These additions are available in the published v0.8.0 package. See the
 [update and migration overview](docs/recall-update.md),
 [usage examples](docs/engine/recall-efficiency.md), and
 [complete hosted acceptance results](docs/actions-acceptance-results.md).

docs/recall-update.md

@@ -1,10 +1,10 @@
 # More reliable recall, with explicit budgets and opt-ins
 
-These changes are available in repository source and prepared for package v0.8.0.
-Npm publication and the GitHub Release are still pending; see the
-[release status and final verification checklist](release-v0.8.0.md). The existing
-npm setup instructions still describe the three-file protocol; do not assume an
-npm install already includes every source addition below.
+These changes are available in repository source and the published
+[`@focaxisdev/deja-vu@0.8.0`](https://www.npmjs.com/package/@focaxisdev/deja-vu/v/0.8.0)
+package. See the [release notes](release-v0.8.0.md) and independent
+[registry artifact and clean-install verification](registry-v0.8.0-verification.md).
+The three-file protocol still requires no npm installation.
 
 ## What improves
 
@@ -22,7 +22,7 @@ These are optional engine features, not new requirements for file-first adoption
 
 ## Enable only what your host needs
 
-With the repository build, exact aliases can route familiar wording to an existing
+With package v0.8.0 or the repository build, exact aliases can route familiar wording to an existing
 distinctive cue, while candidate search and prompt output have separate budgets:
 
 ```ts

docs/registry-v0.8.0-verification.md

@@ -0,0 +1,75 @@
+# Published 0.8.0: independent registry verification
+
+Verified on 2026-10-18 using public registry and GitHub reads from GitHub Actions.
+[Run 39101806633](https://github.com/focaxisdev/deja-vu/actions/runs/39101806633)
+completed successfully on Ubuntu and Windows at verification commit
+`eb642db63cfa9f97746d589863f2146ab53268ae`. This follow-up commit is not the
+published package's source revision.
+
+| Identity or artifact | Verified value |
+| --- | --- |
+| npm package version / observed latest | 0.8.0 / 0.8.0 |
+| npm gitHead, v0.8.0 tag, Release target | `42221805bdb1853b4cc347d7bfba29532594b3f2` |
+| GitHub Release ID | 416213665, public, not a prerelease |
+| File count / unpacked size | 138 files / 822,678 bytes |
+| Tarball SHA-1 | `9e09a7067f2a56ebbeefaee89933ad5487276d31` |
+
+Tarball SHA-512 integrity:
+
+```text
+sha512-QPwz0brkGf7Ip1P7xnfcB1XwKeI3DvLjApccKP+H+CULWkOxtIqdFglMLhN62X5XcawdGyL03aLVigmTaL4H3w==
+```
+
+The complete expected manifest was captured from the original release commit's
+[main CI](https://github.com/focaxisdev/deja-vu/actions/runs/39093665904), before
+registry verification. Its fixed [fingerprint](https://github.com/focaxisdev/deja-vu/blob/eb642db63cfa9f97746d589863f2146ab53268ae/.github/release-v0.8.0-fingerprint.json)
+includes every file's path, size and mode. Verification compares that entire
+manifest and independently hashes the bytes downloaded from the real registry.
+It does not substitute a newly packed local checkout.
+
+## Gates and logs
+
+Both jobs used Node v22.23.3 and npm 10.9.9:
+[Ubuntu log](https://github.com/focaxisdev/deja-vu/actions/runs/39101806633/job/117599436397),
+[Windows log](https://github.com/focaxisdev/deja-vu/actions/runs/39101806633/job/117599436532).
+
+| Gate | Ubuntu | Windows |
+| --- | --- | --- |
+| Registry version, latest, gitHead and distribution metadata | Passed | Passed |
+| Downloaded archive: complete manifest, SHA-1 and SHA-512 | Passed | Passed |
+| New directory/cache, version-pinned registry installation | Passed | Passed |
+| Installed lockfile version, resolved URL and integrity | Passed | Passed |
+| CLI init, doctor, explain, lint, scan and feedback | Passed | Passed |
+| Existing installed API smoke, including new opt-in APIs | Passed | Passed |
+| Public tag and Release target correspondence | Passed | Passed |
+
+The installation uses a separate, initially absent cache from the registry-pack
+cache and installs `@focaxisdev/deja-vu@0.8.0`, not a local tarball. The normal
+installation does not disable lifecycle scripts. API assertions are reused from
+the existing package test, including eligible alias recall, byte-bounded projection,
+metadata update, supersession, raw retrieval and zero retained managed-cache entries
+after deletion. All data is synthetic; no paid embedding service is used.
+
+The [original full-suite results](https://github.com/focaxisdev/deja-vu/actions/runs/39093665904)
+cover 119 source and the same 119 compiled cases plus one package/install/use case
+per platform, with zero failures or skips. Registry verification is additional
+installed-artifact evidence, not another full run of those source tests. Later
+repository changes receive their own [main CI](https://github.com/focaxisdev/deja-vu/actions/workflows/ci.yml).
+
+## Scope and reproducibility
+
+The version-specific workflow has only `contents: read`, does not persist checkout
+credentials, and cannot publish or move tags. It checks 0.8.0 as `latest` at this
+closeout; a later release may legitimately supersede that dist-tag and make this
+historical latest assertion fail. That does not retroactively invalidate these logs.
+
+The published archive retains preparation-era pending text. Current repository
+documentation records the completed publication; those newer documentation commits
+must not be mistaken for npm `gitHead`. The original tag and tarball are unchanged.
+These checks establish artifact correspondence and exercised behavior, not npm
+provenance attestation or compatibility with every supported Node version.
+
+The workload-specific [performance and recall limitations](recall-update.md#benefits-and-limits-measured-separately)
+still apply. Neither this clean-install check nor matching hashes measures a new
+product-wide speedup. The earlier Cloud execution/network restrictions remain a
+separate environment limitation and were not bypassed for this verification.

docs/release-recall-efficiency.md

@@ -1,7 +1,8 @@
 # More reliable, bounded engine recall: first-batch evidence
 
-Included in the [v0.8.0 preparation](release-v0.8.0.md); package publication is
-pending. These historical measurements are not a publication record. Start with the
+Included in the published [v0.8.0 release](release-v0.8.0.md). These historical
+measurements retain their original scope; publication is independently checked
+in the [registry verification report](registry-v0.8.0-verification.md). Start with the
 [combined update and opt-in overview](recall-update.md).
 
 These measurements and validation counts describe the first implementation batch