Release adapter 0.5.10 against Engine 0.4.0

.github/ISSUE_SPECS/114-release-the-web-adapter-against-engine-sdk-0-4-0.md

@@ -0,0 +1,68 @@
+# Release the web adapter against engine SDK 0.4.0
+
+## Product outcome
+
+Publish one immutable dependency-only `@misofm/engine-web-adapter` release that pins the verified public `@misofm/engine@0.4.0` package. This lets the app resolve one physical SDK containing engine #844 and the accepted ordinary-host observation closure. The adapter already lends callers the same SDK engine; no runtime wrapper, codec, storage, cache, control, or protected-EQ behavior changes are required.
+
+Engine 0.4.0 is public from source `89288333961713b3adaea0ad3050fcbb5e35d748`. Its registry archive SHA256 is `5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744`, npm integrity is `sha512-UZVdQrqJWUZVd07F0OkW3kCFeUrjMDc4ZM2/eEq83NHG2EMwvfxrjyRIWpyDNRWGSW9kPsQMAp2xHzbnLssymw==`, and verify-only workflow 35084369532 passed after the single publish request's delayed propagation.
+
+## Bounded implementation
+
+Freeze unused adapter patch 0.5.10 after live registry absence proof. One Luna MAX tranche may update only this issue spec, `package.json`, `package-lock.json`, `.github/workflows/npm-publish.yml`, `src/provenance.ts`, identity-only assertions in `scripts/check-package.mjs` and `tests/foundation.test.ts`, plus exact dependency/release prose in `README.md` and `NOTICE`. Preserve historical `safeBaselines` and copied-source attribution.
+
+No production TypeScript/runtime, API, decoder, codec 0.1.1, OPFS/cache, Worker/AudioWorklet, test harness, generated binary, or publisher redesign. The adapter contract remains compatible; the release patch changes its exact engine dependency and authenticated provenance only.
+
+## Objective gates and delivery
+
+Run locked install, full `npm run check`, `npm run publish:dry-run`, and existing packed indexed-sparse browser proof with the pinned browser toolchain. Prove an ordinary fresh tarball consumer can import runtime and TypeScript public entries with exactly one installed engine 0.4.0. Fresh Astra MEDIUM must PASS the frozen candidate. Required macOS packed OPFS/Chromium/WebKit CI must pass before merge.
+
+Hold the accepted merged adapter main SHA unchanged through the existing OIDC publish workflow and any verify-only recovery. Publish once, independently compare registry archive to the reviewed tarball, verify exact engine dependency/provenance, one SDK resolution, public imports/types, and trusted source/workflow attestation. Only then synchronize evidence and close this issue. App adoption starts only from verified public engine and adapter identities.
+
+This is ordinary-host adoption. It does not claim combined protected/ordinary preparation, protected-EQ coexistence, or repair of app fixture #231.
+
+## Workflow
+
+Fresh Astra XHIGH scope and adversarial review approved this second slice. One fresh Luna MAX owns the bounded dependency/provenance tranche; after two unsatisfactory Luna rounds escalate once to Sol HIGH, then Astra XHIGH. Root owns checkpoints, GitHub delivery, publication and evidence synchronization.
+
+## Evidence
+
+Starting source is synchronized adapter main `4dd1cefbe20842892ce96b45da929b6cc3b69144`. The primary checkout remains on unrelated research branch `research/77-lossless-delivery` and is untouched. Public adapter 0.5.9 pins engine 0.3.0; live registry lookup returns parsed E404 for adapter 0.5.10. No adapter source, package or external publication has changed.
+
+### Luna round 1 implementation tranche
+
+Frozen adapter `0.5.10` to exact `@misofm/engine@0.4.0`, with provenance bound to
+source `89288333961713b3adaea0ad3050fcbb5e35d748` and archive SHA256
+`5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744`.
+Updated only the release identity/provenance surfaces listed above; codec `0.1.1`,
+safe baselines, copied-source attribution, runtime/API, and publisher semantics
+remain unchanged. `npm ci --ignore-scripts` PASS; focused package policy PASS
+(`247` files, `474766` bytes); focused foundation identity PASS (`7/7`); full
+`npm run check` PASS (`380/380` tests, package policy `247` files/`474766`
+bytes); `npm run publish:dry-run` PASS (`0.5.10`, `247` files). No publication,
+browser qualification, or GitHub state change was performed in this tranche.
+
+
+### Root qualification and independent candidate review
+
+Root checkpointed the identity-only tranche at
+`29c84f0e12df1212e8fb686549460af9eb914418`. The packed indexed-sparse
+Chromium gate passed with Chromium `151.0.7922.34`, including cold ingest,
+warm verified reuse, three concurrent warm workers, serial/concurrent cold
+paths, exact sparse windows, clean worker termination, and no request or
+console errors. The retained package archive is
+`misofm-engine-web-adapter-0.5.10.tgz`: SHA256
+`d87a8f59b322e84fb4bfa1770b41803ce800bea52501c474ddc398ffc226bf7f`,
+SHA1 `39cb19c1f312af81c9905d4f50811107d093d3ee`, npm integrity
+`sha512-ZzVf9FsEK3tJXZo8zxcWQlVgp3/0omvvJhvQDnyqdYDFjcHfQ1kPZkob4qrHJ6zz61hHq3dwswWDoTQGcnO95A==`,
+`247` files, `474766` packed bytes, and `2636641` unpacked bytes.
+
+A fresh consumer installed only that archive, imported the package root,
+`/stems`, and `/assets`, passed strict TypeScript declaration checking with
+`skipLibCheck: false`, and proved exactly one physical
+`@misofm/engine@0.4.0`. Fresh Astra MEDIUM adversarial review independently
+verified the complete diff, public Engine archive and lock integrity, all 247
+candidate archive files, foundation tests (`7/7`), strict consumer imports and
+types, one-engine resolution, and provenance. Verdict: **PASS**, with no
+candidate blockers. Remaining delivery gates are the required macOS packed
+OPFS/Chromium/WebKit CI, immutable OIDC publication, registry/archive and
+attestation verification, then remote issue synchronization and closure.

.github/workflows/npm-publish.yml

@@ -23,12 +23,12 @@ concurrency:
 
 env:
   PACKAGE_NAME: "@misofm/engine-web-adapter"
-  PACKAGE_VERSION: "0.5.9"
+  PACKAGE_VERSION: "0.5.10"
   NPM_CONFIG_REGISTRY: "https://registry.npmjs.org"
 
 jobs:
   publish:
-    name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.9
+    name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.10
     runs-on: ubuntu-24.04
     steps:
       - name: Refuse a non-main or mismatched dispatch
@@ -63,7 +63,7 @@ jobs:
           [[ "$(node -p "require('./package.json').version")" == "$PACKAGE_VERSION" ]]
           [[ "$(node -p "require('./package-lock.json').name")" == "$PACKAGE_NAME" ]]
           [[ "$(node -p "require('./package-lock.json').version")" == "$PACKAGE_VERSION" ]]
-          [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.3.0" ]]
+          [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.4.0" ]]
           [[ "$(node -p "require('./package.json').repository.url")" == "git+https://github.com/misofm/engine-web-adapter.git" ]]
 
       - name: Install dependencies
@@ -138,7 +138,7 @@ jobs:
             [[ "$attempt" == 60 ]] && { echo "registry did not converge" >&2; exit 1; }
             sleep 5
           done
-          [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.3.0" ]]
+          [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.4.0" ]]
           consumer=$(mktemp -d)
           trap 'rm -rf -- "$consumer"' EXIT
           cd "$consumer"

NOTICE

@@ -1,10 +1,10 @@
 @misofm/engine-web-adapter
 Copyright 2026 Miso
 
-This product depends on @misofm/engine@0.3.0. The reviewed integration archive
+This product depends on @misofm/engine@0.4.0. The reviewed integration archive
 was packed from misofm/engine commit
-51e03cfdde61802fc8456872a6637a265fae5979 with SHA256
-0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804.
+89288333961713b3adaea0ad3050fcbb5e35d748 with SHA256
+5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744.
 This records reviewed source/archive identity, not registry publication.
 
 The transport SHA-256 implementation and verified-store/session-gate invariants

README.md

@@ -1,7 +1,7 @@
 # @misofm/engine-web-adapter
 
 Headless, framework-neutral browser session hosting for
-`@misofm/engine@0.3.0`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC
+`@misofm/engine@0.4.0`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC
 through bounded HTTP ranges and a one-stem universal `@misofm/codec@0.1.1`
 Wasm Worker, verifies
 canonical PCM into OPFS, then feeds the Engine through bounded shared-memory
@@ -10,15 +10,15 @@ rings. URL, authentication, and request mapping remain caller-owned.
 ## Install
 
 ```sh
-npm install @misofm/engine-web-adapter@0.5.9 @misofm/engine@0.3.0
+npm install @misofm/engine-web-adapter@0.5.10 @misofm/engine@0.4.0
 ```
 
-The package is ESM-only and remains pinned to exactly Engine `0.3.0` and
+The package is ESM-only and remains pinned to exactly Engine `0.4.0` and
 `@misofm/codec` `0.1.1`. The codec currently supports Node `>=22.23.2 <23`
 and Bun `>=1.4.2 <1.5`; browser consumers use the bundled public codec asset.
-The integration uses the published Engine 0.3.0 archive
-from commit `51e03cfdde61802fc8456872a6637a265fae5979`, SHA256
-`0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804`.
+The integration uses the published Engine 0.4.0 archive
+from commit `89288333961713b3adaea0ad3050fcbb5e35d748`, SHA256
+`5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744`.
 This release adds indexed full-response stem acquisition: active FLAC chunks are
 decoded once into verified sparse PCM, and timeline gaps are generated as zeroes
 when the Engine reads them. The existing native-FLAC path remains available.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@misofm/engine-web-adapter",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "description": "Bounded FLAC browser session adapter for @misofm/engine using @misofm/codec",
   "license": "Apache-2.0",
   "repository": {
@@ -62,7 +62,7 @@
   },
   "dependencies": {
     "@misofm/codec": "0.1.1",
-    "@misofm/engine": "0.3.0",
+    "@misofm/engine": "0.4.0",
     "effect": "4.0.0-rc.112",
     "hash-wasm": "4.12.0"
   },

scripts/check-package.mjs

@@ -6,10 +6,10 @@ import { tmpdir } from "node:os";
 import { spawnSync } from "node:child_process";
 
 const packageJson = JSON.parse(await readFile("package.json", "utf8"));
-assert.equal(packageJson.version, "0.5.9");
+assert.equal(packageJson.version, "0.5.10");
 assert.deepEqual(packageJson.dependencies, {
   "@misofm/codec": "0.1.1",
-  "@misofm/engine": "0.3.0",
+  "@misofm/engine": "0.4.0",
   effect: "4.0.0-rc.112",
   "hash-wasm": "4.12.0",
 });

src/provenance.ts

@@ -1,9 +1,9 @@
 export const ADAPTER_PROVENANCE = Object.freeze({
   engine: Object.freeze({
-    package: "@misofm/engine@0.3.0",
+    package: "@misofm/engine@0.4.0",
     repository: "misofm/engine",
-    archiveSha256: "0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804",
-    commit: "51e03cfdde61802fc8456872a6637a265fae5979",
+    archiveSha256: "5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744",
+    commit: "89288333961713b3adaea0ad3050fcbb5e35d748",
   }),
   safeBaselines: Object.freeze({
     stemStore: "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c",

tests/foundation.test.ts

@@ -18,11 +18,11 @@ test("foundation is pinned to the exact public Engine release", async () => {
   assert.equal(ADAPTER_PROVENANCE.engine.package, `@misofm/engine@${packageJson.dependencies["@misofm/engine"]}`);
   assert.equal(
     ADAPTER_PROVENANCE.engine.commit,
-    "51e03cfdde61802fc8456872a6637a265fae5979",
+    "89288333961713b3adaea0ad3050fcbb5e35d748",
   );
   assert.equal(
     ADAPTER_PROVENANCE.engine.archiveSha256,
-    "0da5f34d6d5e021f543acf21053b6176931548f3bbc584301c42c2f278f5b804",
+    "5ca46401c29b8206cea348be811ad30623c43807dbe1b33935d57534185e2744",
   );
   assert.equal(ADAPTER_PROVENANCE.safeBaselines.stemStore, "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c");
 });