From 978eb6a24a27cd0334deeb89144ab0e1e271d1c5 Mon Sep 17 00:00:00 2001 From: BL Date: Wed, 16 Sep 2026 10:26:20 +0000 Subject: [PATCH 1/3] docs: brief engine 0.4.0 adapter release --- ...he-web-adapter-against-engine-sdk-0-4-0.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md diff --git a/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md b/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md new file mode 100644 index 0000000..6546d59 --- /dev/null +++ b/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md @@ -0,0 +1,29 @@ +# Release the web adapter against engine SDK 0.4.0 + +## Product outcome + +Publish one immutable dependency-only `@misofm/engine-web-adapter` release that pins the verified public `@misofm/engine@0.4.0` package. This lets the app resolve one physical SDK containing engine #844 and the accepted ordinary-host observation closure. The adapter already lends callers the same SDK engine; no runtime wrapper, codec, storage, cache, control, or protected-EQ behavior changes are required. + +Engine 0.4.0 is public from source `89288333961713b3adaea0ad3050fcbb5e35d748`. Its registry archive SHA256 is `5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744`, npm integrity is `sha512-UZVdQrqJWUZVd07F0OkW3kCFeUrjMDc4ZM2/eEq83NHG2EMwvfxrjyRIWpyDNRWGSW9kPsQMAp2xHzbnLssymw==`, and verify-only workflow 35084369532 passed after the single publish request's delayed propagation. + +## Bounded implementation + +Freeze unused adapter patch 0.5.10 after live registry absence proof. One Luna MAX tranche may update only this issue spec, `package.json`, `package-lock.json`, `.github/workflows/npm-publish.yml`, `src/provenance.ts`, identity-only assertions in `scripts/check-package.mjs` and `tests/foundation.test.ts`, plus exact dependency/release prose in `README.md` and `NOTICE`. Preserve historical `safeBaselines` and copied-source attribution. + +No production TypeScript/runtime, API, decoder, codec 0.1.1, OPFS/cache, Worker/AudioWorklet, test harness, generated binary, or publisher redesign. The adapter contract remains compatible; the release patch changes its exact engine dependency and authenticated provenance only. + +## Objective gates and delivery + +Run locked install, full `npm run check`, `npm run publish:dry-run`, and existing packed indexed-sparse browser proof with the pinned browser toolchain. Prove an ordinary fresh tarball consumer can import runtime and TypeScript public entries with exactly one installed engine 0.4.0. Fresh Astra MEDIUM must PASS the frozen candidate. Required macOS packed OPFS/Chromium/WebKit CI must pass before merge. + +Hold the accepted merged adapter main SHA unchanged through the existing OIDC publish workflow and any verify-only recovery. Publish once, independently compare registry archive to the reviewed tarball, verify exact engine dependency/provenance, one SDK resolution, public imports/types, and trusted source/workflow attestation. Only then synchronize evidence and close this issue. App adoption starts only from verified public engine and adapter identities. + +This is ordinary-host adoption. It does not claim combined protected/ordinary preparation, protected-EQ coexistence, or repair of app fixture #231. + +## Workflow + +Fresh Astra XHIGH scope and adversarial review approved this second slice. One fresh Luna MAX owns the bounded dependency/provenance tranche; after two unsatisfactory Luna rounds escalate once to Sol HIGH, then Astra XHIGH. Root owns checkpoints, GitHub delivery, publication and evidence synchronization. + +## Evidence + +Starting source is synchronized adapter main `4dd1cefbe20842892ce96b45da929b6cc3b69144`. The primary checkout remains on unrelated research branch `research/77-lossless-delivery` and is untouched. Public adapter 0.5.9 pins engine 0.3.0; live registry lookup returns parsed E404 for adapter 0.5.10. No adapter source, package or external publication has changed. From 29c84f0e12df1212e8fb686549460af9eb914418 Mon Sep 17 00:00:00 2001 From: BL Date: Wed, 16 Sep 2026 10:33:15 +0000 Subject: [PATCH 2/3] release: prepare adapter 0.5.10 --- ...ease-the-web-adapter-against-engine-sdk-0-4-0.md | 13 +++++++++++++ .github/workflows/npm-publish.yml | 8 ++++---- NOTICE | 6 +++--- README.md | 12 ++++++------ package-lock.json | 12 ++++++------ package.json | 4 ++-- scripts/check-package.mjs | 4 ++-- src/provenance.ts | 6 +++--- tests/foundation.test.ts | 4 ++-- 9 files changed, 41 insertions(+), 28 deletions(-) diff --git a/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md b/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md index 6546d59..b6de3a1 100644 --- a/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md +++ b/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md @@ -27,3 +27,16 @@ Fresh Astra XHIGH scope and adversarial review approved this second slice. One f ## Evidence Starting source is synchronized adapter main `4dd1cefbe20842892ce96b45da929b6cc3b69144`. The primary checkout remains on unrelated research branch `research/77-lossless-delivery` and is untouched. Public adapter 0.5.9 pins engine 0.3.0; live registry lookup returns parsed E404 for adapter 0.5.10. No adapter source, package or external publication has changed. + +### Luna round 1 implementation tranche + +Frozen adapter `0.5.10` to exact `@misofm/engine@0.4.0`, with provenance bound to +source `89288333961713b3adaea0ad3050fcbb5e35d748` and archive SHA256 +`5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744`. +Updated only the release identity/provenance surfaces listed above; codec `0.1.1`, +safe baselines, copied-source attribution, runtime/API, and publisher semantics +remain unchanged. `npm ci --ignore-scripts` PASS; focused package policy PASS +(`247` files, `474766` bytes); focused foundation identity PASS (`7/7`); full +`npm run check` PASS (`380/380` tests, package policy `247` files/`474766` +bytes); `npm run publish:dry-run` PASS (`0.5.10`, `247` files). No publication, +browser qualification, or GitHub state change was performed in this tranche. diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index caa3fd0..5bb5a08 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -23,12 +23,12 @@ concurrency: env: PACKAGE_NAME: "@misofm/engine-web-adapter" - PACKAGE_VERSION: "0.5.9" + PACKAGE_VERSION: "0.5.10" NPM_CONFIG_REGISTRY: "https://registry.npmjs.org" jobs: publish: - name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.9 + name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.10 runs-on: ubuntu-24.04 steps: - name: Refuse a non-main or mismatched dispatch @@ -63,7 +63,7 @@ jobs: [[ "$(node -p "require('./package.json').version")" == "$PACKAGE_VERSION" ]] [[ "$(node -p "require('./package-lock.json').name")" == "$PACKAGE_NAME" ]] [[ "$(node -p "require('./package-lock.json').version")" == "$PACKAGE_VERSION" ]] - [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.3.0" ]] + [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.4.0" ]] [[ "$(node -p "require('./package.json').repository.url")" == "git+https://github.com/misofm/engine-web-adapter.git" ]] - name: Install dependencies @@ -138,7 +138,7 @@ jobs: [[ "$attempt" == 60 ]] && { echo "registry did not converge" >&2; exit 1; } sleep 5 done - [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.3.0" ]] + [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.4.0" ]] consumer=$(mktemp -d) trap 'rm -rf -- "$consumer"' EXIT cd "$consumer" diff --git a/NOTICE b/NOTICE index fe47d60..6740791 100644 --- a/NOTICE +++ b/NOTICE @@ -1,10 +1,10 @@ @misofm/engine-web-adapter Copyright 2026 Miso -This product depends on @misofm/engine@0.3.0. The reviewed integration archive +This product depends on @misofm/engine@0.4.0. The reviewed integration archive was packed from misofm/engine commit -51e03cfdde61802fc8456872a6637a265fae5979 with SHA256 -0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804. +89288333961713b3adaea0ad3050fcbb5e35d748 with SHA256 +5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744. This records reviewed source/archive identity, not registry publication. The transport SHA-256 implementation and verified-store/session-gate invariants diff --git a/README.md b/README.md index 71489cc..c7fbdde 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # @misofm/engine-web-adapter Headless, framework-neutral browser session hosting for -`@misofm/engine@0.3.0`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC +`@misofm/engine@0.4.0`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC through bounded HTTP ranges and a one-stem universal `@misofm/codec@0.1.1` Wasm Worker, verifies canonical PCM into OPFS, then feeds the Engine through bounded shared-memory @@ -10,15 +10,15 @@ rings. URL, authentication, and request mapping remain caller-owned. ## Install ```sh -npm install @misofm/engine-web-adapter@0.5.9 @misofm/engine@0.3.0 +npm install @misofm/engine-web-adapter@0.5.10 @misofm/engine@0.4.0 ``` -The package is ESM-only and remains pinned to exactly Engine `0.3.0` and +The package is ESM-only and remains pinned to exactly Engine `0.4.0` and `@misofm/codec` `0.1.1`. The codec currently supports Node `>=22.23.2 <23` and Bun `>=1.4.2 <1.5`; browser consumers use the bundled public codec asset. -The integration uses the published Engine 0.3.0 archive -from commit `51e03cfdde61802fc8456872a6637a265fae5979`, SHA256 -`0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804`. +The integration uses the published Engine 0.4.0 archive +from commit `89288333961713b3adaea0ad3050fcbb5e35d748`, SHA256 +`5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744`. This release adds indexed full-response stem acquisition: active FLAC chunks are decoded once into verified sparse PCM, and timeline gaps are generated as zeroes when the Engine reads them. The existing native-FLAC path remains available. diff --git a/package-lock.json b/package-lock.json index 7d2681f..b5d517c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,16 +1,16 @@ { "name": "@misofm/engine-web-adapter", - "version": "0.5.9", + "version": "0.5.10", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@misofm/engine-web-adapter", - "version": "0.5.9", + "version": "0.5.10", "license": "Apache-2.0", "dependencies": { "@misofm/codec": "0.1.1", - "@misofm/engine": "0.3.0", + "@misofm/engine": "0.4.0", "effect": "4.0.0-rc.112", "hash-wasm": "4.12.0" }, @@ -39,9 +39,9 @@ } }, "node_modules/@misofm/engine": { - "version": "0.3.0", - "resolved": "https://registry.npmjs.org/@misofm/engine/-/engine-0.3.0.tgz", - "integrity": "sha512-56Xwu7K/k7gRSGGLpNz7Vo1WSwaaP2F2to6Ahb/iMZM21GTFsgk24ZXVTVpdVsG1Q8fme/VbEPNjtm50tpRFLQ==", + "version": "0.4.0", + "resolved": "https://registry.npmjs.org/@misofm/engine/-/engine-0.4.0.tgz", + "integrity": "sha512-UZVdQrqJWUZVd07F0OkW3kCFeUrjMDc4ZM2/eEq83NHG2EMwvfxrjyRIWpyDNRWGSW9kPsQMAp2xHzbnLssymw==", "license": "Apache-2.0", "bin": { "enginectl": "dist/enginectl.js" diff --git a/package.json b/package.json index a98fc01..f48f59e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@misofm/engine-web-adapter", - "version": "0.5.9", + "version": "0.5.10", "description": "Bounded FLAC browser session adapter for @misofm/engine using @misofm/codec", "license": "Apache-2.0", "repository": { @@ -62,7 +62,7 @@ }, "dependencies": { "@misofm/codec": "0.1.1", - "@misofm/engine": "0.3.0", + "@misofm/engine": "0.4.0", "effect": "4.0.0-rc.112", "hash-wasm": "4.12.0" }, diff --git a/scripts/check-package.mjs b/scripts/check-package.mjs index 6cc5e1a..935fe9c 100644 --- a/scripts/check-package.mjs +++ b/scripts/check-package.mjs @@ -6,10 +6,10 @@ import { tmpdir } from "node:os"; import { spawnSync } from "node:child_process"; const packageJson = JSON.parse(await readFile("package.json", "utf8")); -assert.equal(packageJson.version, "0.5.9"); +assert.equal(packageJson.version, "0.5.10"); assert.deepEqual(packageJson.dependencies, { "@misofm/codec": "0.1.1", - "@misofm/engine": "0.3.0", + "@misofm/engine": "0.4.0", effect: "4.0.0-rc.112", "hash-wasm": "4.12.0", }); diff --git a/src/provenance.ts b/src/provenance.ts index 0d87753..0aeca3d 100644 --- a/src/provenance.ts +++ b/src/provenance.ts @@ -1,9 +1,9 @@ export const ADAPTER_PROVENANCE = Object.freeze({ engine: Object.freeze({ - package: "@misofm/engine@0.3.0", + package: "@misofm/engine@0.4.0", repository: "misofm/engine", - archiveSha256: "0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804", - commit: "51e03cfdde61802fc8456872a6637a265fae5979", + archiveSha256: "5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744", + commit: "89288333961713b3adaea0ad3050fcbb5e35d748", }), safeBaselines: Object.freeze({ stemStore: "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c", diff --git a/tests/foundation.test.ts b/tests/foundation.test.ts index cc1d89a..50bd043 100644 --- a/tests/foundation.test.ts +++ b/tests/foundation.test.ts @@ -18,11 +18,11 @@ test("foundation is pinned to the exact public Engine release", async () => { assert.equal(ADAPTER_PROVENANCE.engine.package, `@misofm/engine@${packageJson.dependencies["@misofm/engine"]}`); assert.equal( ADAPTER_PROVENANCE.engine.commit, - "51e03cfdde61802fc8456872a6637a265fae5979", + "89288333961713b3adaea0ad3050fcbb5e35d748", ); assert.equal( ADAPTER_PROVENANCE.engine.archiveSha256, - "0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804", + "5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744", ); assert.equal(ADAPTER_PROVENANCE.safeBaselines.stemStore, "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c"); }); From 7fa201edde68dda1c091180c7d713b571eb87f5c Mon Sep 17 00:00:00 2001 From: BL Date: Wed, 16 Sep 2026 10:36:43 +0000 Subject: [PATCH 3/3] docs: record adapter 0.5.10 candidate evidence --- ...he-web-adapter-against-engine-sdk-0-4-0.md | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md b/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md index b6de3a1..f3ce5f5 100644 --- a/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md +++ b/.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md @@ -40,3 +40,29 @@ remain unchanged. `npm ci --ignore-scripts` PASS; focused package policy PASS `npm run check` PASS (`380/380` tests, package policy `247` files/`474766` bytes); `npm run publish:dry-run` PASS (`0.5.10`, `247` files). No publication, browser qualification, or GitHub state change was performed in this tranche. + + +### Root qualification and independent candidate review + +Root checkpointed the identity-only tranche at +`29c84f0e12df1212e8fb686549460af9eb914418`. The packed indexed-sparse +Chromium gate passed with Chromium `151.0.7922.34`, including cold ingest, +warm verified reuse, three concurrent warm workers, serial/concurrent cold +paths, exact sparse windows, clean worker termination, and no request or +console errors. The retained package archive is +`misofm-engine-web-adapter-0.5.10.tgz`: SHA256 +`d87a8f59b322e84fb4bfa1770b41803ce800bea52501c474ddc398ffc226bf7f`, +SHA1 `39cb19c1f312af81c9905d4f50811107d093d3ee`, npm integrity +`sha512-ZzVf9FsEK3tJXZo8zxcWQlVgp3/0omvvJhvQDnyqdYDFjcHfQ1kPZkob4qrHJ6zz61hHq3dwswWDoTQGcnO95A==`, +`247` files, `474766` packed bytes, and `2636641` unpacked bytes. + +A fresh consumer installed only that archive, imported the package root, +`/stems`, and `/assets`, passed strict TypeScript declaration checking with +`skipLibCheck: false`, and proved exactly one physical +`@misofm/engine@0.4.0`. Fresh Astra MEDIUM adversarial review independently +verified the complete diff, public Engine archive and lock integrity, all 247 +candidate archive files, foundation tests (`7/7`), strict consumer imports and +types, one-engine resolution, and provenance. Verdict: **PASS**, with no +candidate blockers. Remaining delivery gates are the required macOS packed +OPFS/Chromium/WebKit CI, immutable OIDC publication, registry/archive and +attestation verification, then remote issue synchronization and closure.