diff --git a/.github/ISSUE_SPECS/95-expose-the-same-sdk-engine-and-delegate-browser-session-measurements-and-control.md b/.github/ISSUE_SPECS/95-expose-the-same-sdk-engine-and-delegate-browser-session-measurements-and-control.md index e0082e7..02dbd24 100644 --- a/.github/ISSUE_SPECS/95-expose-the-same-sdk-engine-and-delegate-browser-session-measurements-and-control.md +++ b/.github/ISSUE_SPECS/95-expose-the-same-sdk-engine-and-delegate-browser-session-measurements-and-control.md @@ -247,3 +247,44 @@ Durable independent report: `/tmp/miso-796-audit/verify-adapter95-published-verd registry archive: `/tmp/miso-796-audit/misofm-engine-web-adapter-0.5.7-registry.tgz`. All source, package and published-adoption gates are PASS. Root synchronizes this evidence upstream and the matching GitHub issue before verified closure. + +## Exact SDK dependency correction release + +Reopened after app#210's required real-browser proof established engine#801: +published SDK 0.2.5 live spectrum repeatedly gaps despite valid uninterrupted +audio. Previous adapter 0.5.7 source/provenance PASS remains valid for its bytes. +The bounded next slice changes only the exact SDK dependency to the verified +engine#794 correction release and adapter patch metadata/lock/necessary existing +guards. Candidate versions are SDK 0.2.6 and adapter 0.5.8; re-audit availability +before freezing. No adapter backend, ownership, cache, PCM or Wasm changes. + +Luna XHIGH implements metadata; separate fresh Astra MEDIUM verifies. Root +checkpoints, integrates latest main, runs existing package/type/test and packed +fresh-consumer gates with exactly one SDK resolution, then required browser CI +and the existing OIDC release. Verify registry archive/integrity/provenance and +provide exact identities to app#210. Existing packed browser scenario must retain +same-engine measurements and corrected live spectrum. No republishing existing +versions, dependency overrides or deployment on local-only identities. Record +new source/run/archive identities separately, sync GitHub, close after verification. + +## Adapter 0.5.8 candidate PASS + +Checkpoint `d0f7db8` changes only the eight dependency/version/provenance guard +paths: adapter 0.5.8 adopts published SDK 0.2.6 from source +`cdf629d6bfd0224b3532dd0abd04b9581240da56`, SDK archive SHA256 +`8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb`. +No adapter runtime/backend/Wasm changes. Luna's terminal evidence reports full +check 380/380 tests, 247 package files, packed Chromium spectrum/response proof +and publish dry-run PASS; those implementation gate runs have no saved log files. + +Fresh Astra MEDIUM independently reviewed the diff and rebuilt the same archive, +then passed normal fresh tarball installation, strict public types/imports and +exactly one registry SDK 0.2.6. Actual SDK archive/source provenance matches the +pins. Candidate adapter SHA256 +`ad740867c1c80d2594d96364d646a135490e1f9a03c73fec5b9601346507d948`; +SHA1 `d8546f99d955d9687d934b0119a2d8a8b3374805`; +integrity `sha512-rWOffhfIjwquuIpnI3S3jBYdxeZYD5MqG33Y9VpRGGBaKLRsN9Gf3ci1i2peveCYuvf3HE0VH77WOitq2qHRJQ==`. +Independent report `/tmp/miso-adapter058-verifier/candidate-verdict.md` clearly +separates independent results from implementation-reported terminal gates. +Required CI, immutable publication and published archive/signature/attestation +verification remain pending; no completion claimed for corrected adapter bytes. diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index de08939..b239009 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -23,12 +23,12 @@ concurrency: env: PACKAGE_NAME: "@misofm/engine-web-adapter" - PACKAGE_VERSION: "0.5.7" + PACKAGE_VERSION: "0.5.8" NPM_CONFIG_REGISTRY: "https://registry.npmjs.org" jobs: publish: - name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.7 + name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.8 runs-on: ubuntu-24.04 steps: - name: Refuse a non-main or mismatched dispatch @@ -63,7 +63,7 @@ jobs: [[ "$(node -p "require('./package.json').version")" == "$PACKAGE_VERSION" ]] [[ "$(node -p "require('./package-lock.json').name")" == "$PACKAGE_NAME" ]] [[ "$(node -p "require('./package-lock.json').version")" == "$PACKAGE_VERSION" ]] - [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.2.5" ]] + [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.2.6" ]] [[ "$(node -p "require('./package.json').repository.url")" == "git+https://github.com/misofm/engine-web-adapter.git" ]] - name: Install dependencies @@ -138,7 +138,7 @@ jobs: [[ "$attempt" == 60 ]] && { echo "registry did not converge" >&2; exit 1; } sleep 5 done - [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.2.5" ]] + [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.2.6" ]] consumer=$(mktemp -d) trap 'rm -rf -- "$consumer"' EXIT cd "$consumer" diff --git a/NOTICE b/NOTICE index 143192f..ddf06c9 100644 --- a/NOTICE +++ b/NOTICE @@ -1,10 +1,10 @@ @misofm/engine-web-adapter Copyright 2026 Miso -This product depends on @misofm/engine@0.2.5. The reviewed integration archive +This product depends on @misofm/engine@0.2.6. The reviewed integration archive was packed from misofm/engine commit -1646a6a1bd0011cc2b5480283bf498b27be460e5 with SHA256 -c26208470b5409ad789085d251d94bdf1117b32dcd3b5e544f8696dffffe3d4d. +cdf629d6bfd0224b3532dd0abd04b9581240da56 with SHA256 +8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb. This records reviewed source/archive identity, not registry publication. The transport SHA-256 implementation and verified-store/session-gate invariants diff --git a/README.md b/README.md index ebe693b..5844dd5 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # @misofm/engine-web-adapter Headless, framework-neutral browser session hosting for -`@misofm/engine@0.2.5`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC +`@misofm/engine@0.2.6`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC through bounded HTTP ranges and a one-stem universal `@misofm/codec@0.1.1` Wasm Worker, verifies canonical PCM into OPFS, then feeds the Engine through bounded shared-memory @@ -10,15 +10,15 @@ rings. URL, authentication, and request mapping remain caller-owned. ## Install ```sh -npm install @misofm/engine-web-adapter@0.5.7 @misofm/engine@0.2.5 +npm install @misofm/engine-web-adapter@0.5.8 @misofm/engine@0.2.6 ``` -The package is ESM-only and remains pinned to exactly Engine `0.2.5` and +The package is ESM-only and remains pinned to exactly Engine `0.2.6` and `@misofm/codec` `0.1.1`. The codec currently supports Node `>=22.23.2 <23` and Bun `>=1.4.2 <1.5`; browser consumers use the bundled public codec asset. -The integration uses the published Engine 0.2.5 archive -from commit `1646a6a1bd0011cc2b5480283bf498b27be460e5`, SHA256 -`c26208470b5409ad789085d251d94bdf1117b32dcd3b5e544f8696dffffe3d4d`. +The integration uses the published Engine 0.2.6 archive +from commit `cdf629d6bfd0224b3532dd0abd04b9581240da56`, SHA256 +`8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb`. This release adds indexed full-response stem acquisition: active FLAC chunks are decoded once into verified sparse PCM, and timeline gaps are generated as zeroes when the Engine reads them. The existing native-FLAC path remains available. diff --git a/package-lock.json b/package-lock.json index f923898..1505b8b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,16 +1,16 @@ { "name": "@misofm/engine-web-adapter", - "version": "0.5.7", + "version": "0.5.8", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@misofm/engine-web-adapter", - "version": "0.5.7", + "version": "0.5.8", "license": "Apache-2.0", "dependencies": { "@misofm/codec": "0.1.1", - "@misofm/engine": "0.2.5", + "@misofm/engine": "0.2.6", "effect": "4.0.0-rc.112", "hash-wasm": "4.12.0" }, @@ -39,9 +39,9 @@ } }, "node_modules/@misofm/engine": { - "version": "0.2.5", - "resolved": "https://registry.npmjs.org/@misofm/engine/-/engine-0.2.5.tgz", - "integrity": "sha512-cNMuslg9t7NAkBrYFMl8jcd1fOy5/fN+FEeDE+WdiMj+8+DkWTkvbWvMo1UMWgC+MrnX4BKhYz2QrKmAstIWwQ==", + "version": "0.2.6", + "resolved": "https://registry.npmjs.org/@misofm/engine/-/engine-0.2.6.tgz", + "integrity": "sha512-IL3x8280+G75SlLxeznUwFwIve+uoHgf5OVXNid+PTsZneJX/k94rXGWhBTYwutCaWiLQf6N0cr9ZEH7AaTZ3g==", "license": "Apache-2.0", "bin": { "enginectl": "dist/enginectl.js" diff --git a/package.json b/package.json index bf75b8b..e9a2e3d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@misofm/engine-web-adapter", - "version": "0.5.7", + "version": "0.5.8", "description": "Bounded FLAC browser session adapter for @misofm/engine using @misofm/codec", "license": "Apache-2.0", "repository": { @@ -62,7 +62,7 @@ }, "dependencies": { "@misofm/codec": "0.1.1", - "@misofm/engine": "0.2.5", + "@misofm/engine": "0.2.6", "effect": "4.0.0-rc.112", "hash-wasm": "4.12.0" }, diff --git a/scripts/check-package.mjs b/scripts/check-package.mjs index 8c01256..1ddf808 100644 --- a/scripts/check-package.mjs +++ b/scripts/check-package.mjs @@ -6,10 +6,10 @@ import { tmpdir } from "node:os"; import { spawnSync } from "node:child_process"; const packageJson = JSON.parse(await readFile("package.json", "utf8")); -assert.equal(packageJson.version, "0.5.7"); +assert.equal(packageJson.version, "0.5.8"); assert.deepEqual(packageJson.dependencies, { "@misofm/codec": "0.1.1", - "@misofm/engine": "0.2.5", + "@misofm/engine": "0.2.6", effect: "4.0.0-rc.112", "hash-wasm": "4.12.0", }); diff --git a/src/provenance.ts b/src/provenance.ts index 4528aba..e268140 100644 --- a/src/provenance.ts +++ b/src/provenance.ts @@ -1,9 +1,9 @@ export const ADAPTER_PROVENANCE = Object.freeze({ engine: Object.freeze({ - package: "@misofm/engine@0.2.5", + package: "@misofm/engine@0.2.6", repository: "misofm/engine", - archiveSha256: "c26208470b5409ad789085d251d94bdf1117b32dcd3b5e544f8696dffffe3d4d", - commit: "1646a6a1bd0011cc2b5480283bf498b27be460e5", + archiveSha256: "8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb", + commit: "cdf629d6bfd0224b3532dd0abd04b9581240da56", }), safeBaselines: Object.freeze({ stemStore: "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c", diff --git a/tests/foundation.test.ts b/tests/foundation.test.ts index 67411b2..3328d17 100644 --- a/tests/foundation.test.ts +++ b/tests/foundation.test.ts @@ -18,11 +18,11 @@ test("foundation is pinned to the exact public Engine release", async () => { assert.equal(ADAPTER_PROVENANCE.engine.package, `@misofm/engine@${packageJson.dependencies["@misofm/engine"]}`); assert.equal( ADAPTER_PROVENANCE.engine.commit, - "1646a6a1bd0011cc2b5480283bf498b27be460e5", + "cdf629d6bfd0224b3532dd0abd04b9581240da56", ); assert.equal( ADAPTER_PROVENANCE.engine.archiveSha256, - "c26208470b5409ad789085d251d94bdf1117b32dcd3b5e544f8696dffffe3d4d", + "8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb", ); assert.equal(ADAPTER_PROVENANCE.safeBaselines.stemStore, "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c"); });