Release adapter 0.5.9 with live-filter SDK 0.3.0

.github/ISSUE_SPECS/111-release-the-adapter-with-the-live-filter-engine-sdk.md

@@ -0,0 +1,66 @@
+# Release the adapter with the live-filter engine SDK
+
+Astra XHIGH approved scope; user requests bounded Luna XHIGH implementation and independent Astra MEDIUM verification. Prerequisite: misofm/engine#809 verified immutable SDK release including #147/#804 capabilities. Starting main d2492ef898c9285864eebf6903503a5fb73069e3; refresh before implementation. Work in isolated /tmp/miso-adapter-804, preserve primary research work.
+
+## Adapter child: adopt the exact released SDK
+
+The adapter already exposes the same borrowed `session.engine`; no new cut wrapper, analysis delegate, decoder/backend/cache behavior or second engine is needed. After the accepted SDK registry identity exists, update exact dependency and unused adapter release version in `package.json`, `package-lock.json`, existing `.github/workflows/npm-publish.yml` guards, `src/provenance.ts`, `scripts/check-package.mjs`, `tests/foundation.test.ts`, `NOTICE` and `README.md` only where their current exact pins require it. Re-audit version availability at freeze; preserve 0.5.8 immutable bytes.
+
+Run existing `npm run check`, `npm run publish:dry-run`, packed browser `node scripts/browser-packed.mjs --indexed-sparse` and required macOS Chromium/WebKit OPFS qualification. Add a bounded new-cut call to the existing public-console/type or packed scenario if the app browser gate does not already exercise that exact archive. Require an ordinary fresh tarball consumer installation with exactly one SDK resolution and public imports/types, followed by the same proof from the actual registry archive. Existing Worker/Worklet URLs and same-engine ownership must remain valid after packing. Do not rely on the packed harness's copied development node_modules as proof of registry dependency resolution.
+
+
+## Bounded delivery
+
+One dependency/provenance adoption tranche, then root checkpoint and focused source/package review. Root runs existing required CI and macOS OPFS qualification, publishes the exact accepted archive through existing OIDC workflow, verifies actual registry archive/provenance and a fresh one-SDK consumer. Do not republish following ambiguous publication: verify the original qualified archive. Do not replace immutable 0.5.8 or choose a new version until registry availability is checked at freeze. App adoption follows verified publication; no new adapter control facade is required.
+
+## Evidence
+
+Implementation, qualification and publication pending. Record accepted source SHA, SDK and adapter versions, archive hashes, registry provenance, fresh consumer result and workflow IDs before closure.
+
+### Accepted dependency and release freeze
+
+Root refreshed origin/main (unchanged d2492ef8) and audited all49 local numbered
+specs against56 remote issues: none missing; #111 number/title/open state match.
+Engine SDK **0.3.0** is published and verified from source
+`51e03cfdde61802fc8456872a6637a265fae5979`. Required mainCI34880226665 and
+immutable qualification34880929687 pass. Publication34881586727 was accepted by
+npm but exceeded registry propagation time; verify-only34881963287 then passed
+fresh public imports/CLI and cryptographic SLSA archive/source/workflow checks,
+without republishing. Root independently downloaded the registry archive: SHA256
+`0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804`, integrity
+`sha512-56Xwu7K/k7gRSGGLpNz7Vo1WSwaaP2F2to6Ahb/iMZM21GTFsgk24ZXVTVpdVsG1Q8fme/VbEPNjtm50tpRFLQ==`.
+Wasm remains7e925d939234b67d14be41a647b4cc6de23099501a763d27e8a56c77524999e7.
+
+Root freezes unused adapter **0.5.9** after a fresh registry version check
+(latest0.5.8). Luna XHIGH may implement the one exact-dependency/provenance
+tranche now. Existing local Emscripten6.0.9 and pinned Rust/browser tools are
+available. Keep runtime/API behavior unchanged; app#222 owns the live-cut browser
+episode against the same SDK bytes. Fresh tarball consumer, existing checks and
+packed indexed-sparse proof remain; root owns review, macOSCI and publication.
+
+### Bounded fixture compatibility correction
+
+The exact dependency/provenance update passes packed indexed-sparse Chromium,
+publish dry-run, package checks and foundation tests. Full check reaches373/380:
+seven existing controlled-port tests load the packaged SDK host through a data
+URL, which cannot resolve its new sibling prepared-control.js import. Root
+permits a narrow tests/console.test.ts loader correction using the actual
+packaged sibling/ABI identity, retaining all existing controlled-port assertions.
+No production SDK/adapter source or publishing mechanism changes. Complete the
+existing check and ordinary fresh tarball consumer before checkpoint/review.
+
+### Attempt1 implementation checkpoint
+
+Luna XHIGH completed exact SDK0.3.0/adapter0.5.9 dependency, provenance and
+existing release-guard updates. The existing console fixture now resolves the
+actual packaged helper and ABI JSON while preserving controlled-port assertions.
+No adapter runtime/API/decoder changes.
+
+PASS: full npm check380/380 tests and package policy247 files/474783 bytes,
+24 focused console fixtures,7 foundation tests, publish dry-run, existing packed
+indexed-sparse Chromium proof, and ordinary fresh tarball public imports with
+exactly one installed SDK0.3.0. Logs are /tmp/miso-adapter-804-{npm-check-final,
+console-focused,foundation,publish-dry-run,browser-packed,fresh-consumer}.log.
+Initial373/380 fixture-loader failure is preserved in npm-check.log. Fresh
+Astra MEDIUM review, required macOS OPFS qualification and registry publication
+remain; no adapter release is claimed yet.

.github/workflows/npm-publish.yml

@@ -23,12 +23,12 @@ concurrency:
 
 env:
   PACKAGE_NAME: "@misofm/engine-web-adapter"
-  PACKAGE_VERSION: "0.5.8"
+  PACKAGE_VERSION: "0.5.9"
   NPM_CONFIG_REGISTRY: "https://registry.npmjs.org"
 
 jobs:
   publish:
-    name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.8
+    name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.9
     runs-on: ubuntu-24.04
     steps:
       - name: Refuse a non-main or mismatched dispatch
@@ -63,7 +63,7 @@ jobs:
           [[ "$(node -p "require('./package.json').version")" == "$PACKAGE_VERSION" ]]
           [[ "$(node -p "require('./package-lock.json').name")" == "$PACKAGE_NAME" ]]
           [[ "$(node -p "require('./package-lock.json').version")" == "$PACKAGE_VERSION" ]]
-          [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.2.6" ]]
+          [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.3.0" ]]
           [[ "$(node -p "require('./package.json').repository.url")" == "git+https://github.com/misofm/engine-web-adapter.git" ]]
 
       - name: Install dependencies
@@ -138,7 +138,7 @@ jobs:
             [[ "$attempt" == 60 ]] && { echo "registry did not converge" >&2; exit 1; }
             sleep 5
           done
-          [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.2.6" ]]
+          [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.3.0" ]]
           consumer=$(mktemp -d)
           trap 'rm -rf -- "$consumer"' EXIT
           cd "$consumer"

NOTICE

@@ -1,10 +1,10 @@
 @misofm/engine-web-adapter
 Copyright 2026 Miso
 
-This product depends on @misofm/engine@0.2.6. The reviewed integration archive
+This product depends on @misofm/engine@0.3.0. The reviewed integration archive
 was packed from misofm/engine commit
-cdf629d6bfd0224b3532dd0abd04b9581240da56 with SHA256
-8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb.
+51e03cfdde61802fc8456872a6637a265fae5979 with SHA256
+0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804.
 This records reviewed source/archive identity, not registry publication.
 
 The transport SHA-256 implementation and verified-store/session-gate invariants

README.md

@@ -1,7 +1,7 @@
 # @misofm/engine-web-adapter
 
 Headless, framework-neutral browser session hosting for
-`@misofm/engine@0.2.6`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC
+`@misofm/engine@0.3.0`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC
 through bounded HTTP ranges and a one-stem universal `@misofm/codec@0.1.1`
 Wasm Worker, verifies
 canonical PCM into OPFS, then feeds the Engine through bounded shared-memory
@@ -10,15 +10,15 @@ rings. URL, authentication, and request mapping remain caller-owned.
 ## Install
 
 ```sh
-npm install @misofm/engine-web-adapter@0.5.8 @misofm/engine@0.2.6
+npm install @misofm/engine-web-adapter@0.5.9 @misofm/engine@0.3.0
 ```
 
-The package is ESM-only and remains pinned to exactly Engine `0.2.6` and
+The package is ESM-only and remains pinned to exactly Engine `0.3.0` and
 `@misofm/codec` `0.1.1`. The codec currently supports Node `>=22.23.2 <23`
 and Bun `>=1.4.2 <1.5`; browser consumers use the bundled public codec asset.
-The integration uses the published Engine 0.2.6 archive
-from commit `cdf629d6bfd0224b3532dd0abd04b9581240da56`, SHA256
-`8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb`.
+The integration uses the published Engine 0.3.0 archive
+from commit `51e03cfdde61802fc8456872a6637a265fae5979`, SHA256
+`0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804`.
 This release adds indexed full-response stem acquisition: active FLAC chunks are
 decoded once into verified sparse PCM, and timeline gaps are generated as zeroes
 when the Engine reads them. The existing native-FLAC path remains available.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@misofm/engine-web-adapter",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "Bounded FLAC browser session adapter for @misofm/engine using @misofm/codec",
   "license": "Apache-2.0",
   "repository": {
@@ -62,7 +62,7 @@
   },
   "dependencies": {
     "@misofm/codec": "0.1.1",
-    "@misofm/engine": "0.2.6",
+    "@misofm/engine": "0.3.0",
     "effect": "4.0.0-rc.112",
     "hash-wasm": "4.12.0"
   },

scripts/check-package.mjs

@@ -6,10 +6,10 @@ import { tmpdir } from "node:os";
 import { spawnSync } from "node:child_process";
 
 const packageJson = JSON.parse(await readFile("package.json", "utf8"));
-assert.equal(packageJson.version, "0.5.8");
+assert.equal(packageJson.version, "0.5.9");
 assert.deepEqual(packageJson.dependencies, {
   "@misofm/codec": "0.1.1",
-  "@misofm/engine": "0.2.6",
+  "@misofm/engine": "0.3.0",
   effect: "4.0.0-rc.112",
   "hash-wasm": "4.12.0",
 });

src/provenance.ts

@@ -1,9 +1,9 @@
 export const ADAPTER_PROVENANCE = Object.freeze({
   engine: Object.freeze({
-    package: "@misofm/engine@0.2.6",
+    package: "@misofm/engine@0.3.0",
     repository: "misofm/engine",
-    archiveSha256: "8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb",
-    commit: "cdf629d6bfd0224b3532dd0abd04b9581240da56",
+    archiveSha256: "0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804",
+    commit: "51e03cfdde61802fc8456872a6637a265fae5979",
   }),
   safeBaselines: Object.freeze({
     stemStore: "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c",

tests/console.test.ts

@@ -1,5 +1,7 @@
 import assert from "node:assert/strict";
 import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
 import test from "node:test";
 
 import { ABI_LAYOUT, encodeLaneEdits } from "@misofm/engine";
@@ -412,11 +414,16 @@ async function packedControl() {
     },
   };
   function frame(data: unknown) { port.onmessage?.({ data }); }
-  const asset = await readFile("node_modules/@misofm/engine/dist/assets/miso-engine-v1-audio-worklet-host.js", "utf8");
+  const asset = (await readFile("node_modules/@misofm/engine/dist/assets/miso-engine-v1-audio-worklet-host.js", "utf8"))
+    .replace(
+      'from "./prepared-control.js"',
+      `from ${JSON.stringify(pathToFileURL(resolve("node_modules/@misofm/engine/dist/assets/prepared-control.js")).href)}`,
+    );
+  const preparedAbiLayout = JSON.parse(await readFile("node_modules/@misofm/engine/dist/assets/miso-engine-v1-abi-layout.json", "utf8"));
   const sdk = await import(`data:text/javascript;base64,${Buffer.from(`${asset}\nexport { MisoAudioWorkletHost };`).toString("base64")}`) as {
     readonly MisoAudioWorkletHost: new (...args: readonly unknown[]) => BrowserEngine["host"];
   };
-  const host = new sdk.MisoAudioWorkletHost({ port, disconnect() {} }, "simd128", 48_000, 128, {}, 65_536, 8, 32, 1);
+  const host = new sdk.MisoAudioWorkletHost({ port, disconnect() {} }, "simd128", 48_000, 128, {}, 65_536, 8, 32, 1, undefined, preparedAbiLayout);
   const sdkConsole = await createBrowserConsole(host);
   const feeds = new TestMeasurementFeeds(host, TRACKS);
   const engine = {

tests/foundation.test.ts

@@ -18,11 +18,11 @@ test("foundation is pinned to the exact public Engine release", async () => {
   assert.equal(ADAPTER_PROVENANCE.engine.package, `@misofm/engine@${packageJson.dependencies["@misofm/engine"]}`);
   assert.equal(
     ADAPTER_PROVENANCE.engine.commit,
-    "cdf629d6bfd0224b3532dd0abd04b9581240da56",
+    "51e03cfdde61802fc8456872a6637a265fae5979",
   );
   assert.equal(
     ADAPTER_PROVENANCE.engine.archiveSha256,
-    "8219178d591c76d820d7ad2e2f7b894fe7f39185f89667f59c675fad603b81eb",
+    "0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804",
   );
   assert.equal(ADAPTER_PROVENANCE.safeBaselines.stemStore, "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c");
 });