From 2338bbca3245f27994aee5efd500dd7c5e579d07 Mon Sep 17 00:00:00 2001 From: BL Date: Thu, 17 Sep 2026 01:44:06 +0000 Subject: [PATCH 1/4] docs: brief adapter 0.5.12 release --- ...web-adapter-0-5-12-against-engine-0-4-2.md | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 .github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md diff --git a/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md b/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md new file mode 100644 index 0000000..c5e85ce --- /dev/null +++ b/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md @@ -0,0 +1,53 @@ +# Release web adapter 0.5.12 against Engine 0.4.2 + +## Product outcome + +Publish one immutable, dependency-only `@misofm/engine-web-adapter@0.5.12` release pinned exactly to the verified public `@misofm/engine@0.4.2`. Engine 0.4.2 carries the managed-spectrum publication-metadata fix required by app issue #262. The adapter already exposes the borrowed SDK engine, so this release changes package identity, dependency, and provenance metadata only. It must not change adapter runtime behavior. + +## Preconditions + +Starting source is synchronized adapter `main` at `cdda801342663c74ba88471604b6f1bf8fbae922`, where adapter 0.5.11 pins Engine 0.4.1. + +Do not begin implementation until public Engine 0.4.2 is independently verified. Record its source SHA, qualification/publish/verify run IDs, registry archive URL, shasum, SHA-256, SHA-512/integrity, file count and unpacked size. Require fresh public imports, strict types and CLI; `npm audit signatures --include-attestations`; SLSA provenance bound to `misofm/engine`, `.github/workflows/npm-publish.yml`, `refs/heads/main`, the accepted source SHA and original publication run; payload equivalence with the reviewed candidate; and a public-package H256 proof where a ready/available publication remains ready/available with the same result identity after a later nonpublishing pending read. A parsed registry lookup must also confirm adapter 0.5.12 is unused. + +As of 2026-09-17 01:42 UTC, both Engine 0.4.2 and adapter 0.5.12 returned parsed E404. Engine publication is the current blocker. + +## Smallest bounded implementation + +Change only this issue spec and these eight release surfaces: + +- `package.json`: adapter 0.5.11 to 0.5.12 and exact Engine dependency 0.4.1 to 0.4.2. +- `package-lock.json`: both root adapter versions, root Engine dependency, and the installed Engine version, registry URL and integrity generated from the public 0.4.2 package. +- `.github/workflows/npm-publish.yml`: package/job version and Engine dependency guard/registry assertion only. Preserve exact-main, parsed-E404, OIDC-only, concurrency, immutable-version and verify-recovery behavior. +- `src/provenance.ts`: Engine 0.4.2 package, authenticated source SHA and public archive SHA-256. +- `scripts/check-package.mjs`: adapter 0.5.12 and Engine 0.4.2 assertions. +- `tests/foundation.test.ts`: accepted Engine source SHA and public archive SHA-256. +- `README.md`: adapter/Engine install coordinates, exact Engine pin, accepted Engine source SHA and archive SHA-256. +- `NOTICE`: Engine 0.4.2 identity, source SHA and archive SHA-256. + +Preserve codec 0.1.1, Effect, hash-wasm, toolchains, unrelated dependency integrities, safe baselines, copied-source attribution, exports, generated assets, browser scripts and publisher semantics. Do not edit runtime TypeScript, APIs, workers, AudioWorklet code, DSP, codec/decoder, storage/cache, binary assets or test harness behavior. + +## Objective gates + +1. Under Node 22.23.2, run `npm ci --ignore-scripts` and `npm run check`. +2. Run `npm run publish:dry-run`, `npm run test:browser`, and `node scripts/browser-packed.mjs --indexed-sparse`. +3. With npm 11.19.0, pack exactly one frozen candidate and record size, file count, shasum, SHA-256, SHA-512 and npm integrity. +4. Install that exact archive in a clean consumer. Verify root, `/stems`, `/assets` and `/package.json` imports; strict TypeScript with `skipLibCheck: false`; exactly one physical Engine; declared and installed Engine 0.4.2; installed Engine payload equality with the accepted public archive; and built provenance equality with the dependency, source SHA and archive SHA-256. +5. Obtain fresh adversarial review of the frozen commit/archive for exact paths/literals, registry integrity, package contents, public imports/types, one-Engine resolution, publisher controls and absence of runtime changes. +6. Require the PR `Packed OPFS qualification` workflow to pass macOS OPFS and indexed-sparse Chromium/WebKit on the reviewed SHA. + +## Immutable delivery + +Merge only the reviewed candidate after PR qualification. Freeze the resulting main SHA, repeat the parsed-E404 check for adapter 0.5.12, then dispatch `.github/workflows/npm-publish.yml` in `publish` mode exactly once from main with that exact SHA. Require exact checkout and identities, full qualification, parsed E404 immediately before publication, OIDC-only publication, exact Engine 0.4.2 registry dependency, public imports and signature/attestation verification. + +If publication may have succeeded but a later check fails, never retry publish. Inspect the registry and use only `verify` mode against the same SHA. Independently verify the public archive byte-for-byte against the reviewed candidate, imports, strict types, one physical Engine 0.4.2, metadata, signatures and SLSA provenance. + +Record candidate hashes, review, PR workflow, merge SHA, publication/verification run IDs, public registry metadata, archive comparison, consumer results and provenance acceptance here. Push the evidence, synchronize GitHub and close only after registry acceptance. + +## Stop rules + +Stop without publishing if Engine 0.4.2 is absent/untrusted, fails H256, or differs without explained payload equivalence; adapter 0.5.12 exists unexpectedly; runtime or harness changes are required; any full/browser/consumer/type/one-Engine/OPFS gate fails; paths exceed the allowlist; review fails; the merged SHA changes; or publication is ambiguous. + +## Workflow + +One bounded Luna max agent implements the eight metadata files and evidence. A fresh Astra medium reviewer verifies the frozen candidate. Root owns checkpoints, PR delivery, the single publish dispatch, registry verification, evidence synchronization and closure. From f85fb6dc5ab550268b1690754cb7f0b94b218c61 Mon Sep 17 00:00:00 2001 From: BL Date: Thu, 17 Sep 2026 01:59:06 +0000 Subject: [PATCH 2/4] release: prepare web adapter 0.5.12 --- ...elease-web-adapter-0-5-12-against-engine-0-4-2.md | 12 +++++++++++- .github/workflows/npm-publish.yml | 8 ++++---- NOTICE | 6 +++--- README.md | 12 ++++++------ package-lock.json | 12 ++++++------ package.json | 4 ++-- scripts/check-package.mjs | 4 ++-- src/provenance.ts | 6 +++--- tests/foundation.test.ts | 4 ++-- 9 files changed, 39 insertions(+), 29 deletions(-) diff --git a/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md b/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md index c5e85ce..398e566 100644 --- a/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md +++ b/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md @@ -10,7 +10,13 @@ Starting source is synchronized adapter `main` at `cdda801342663c74ba88471604b6f Do not begin implementation until public Engine 0.4.2 is independently verified. Record its source SHA, qualification/publish/verify run IDs, registry archive URL, shasum, SHA-256, SHA-512/integrity, file count and unpacked size. Require fresh public imports, strict types and CLI; `npm audit signatures --include-attestations`; SLSA provenance bound to `misofm/engine`, `.github/workflows/npm-publish.yml`, `refs/heads/main`, the accepted source SHA and original publication run; payload equivalence with the reviewed candidate; and a public-package H256 proof where a ready/available publication remains ready/available with the same result identity after a later nonpublishing pending read. A parsed registry lookup must also confirm adapter 0.5.12 is unused. -As of 2026-09-17 01:42 UTC, both Engine 0.4.2 and adapter 0.5.12 returned parsed E404. Engine publication is the current blocker. +As of 2026-09-17 01:42 UTC, Engine 0.4.2 and adapter 0.5.12 returned parsed E404. Engine 0.4.2 is now public and the adapter 0.5.12 lookup remains parsed E404. + +## Engine 0.4.2 verification record + +The public Engine 0.4.2 release was independently verified before this adapter tranche. The accepted source is `misofm/engine` commit `13351fe71c7d4594e5ff6ea170c2839514cb243e`. Qualification run `35171757674` passed. The single publication step in run `35172001155` succeeded, after which that run timed out waiting for registry propagation; publication was not retried. Verify-only recovery run `35172167003` passed once npm converged. The registry archive is `https://registry.npmjs.org/@misofm/engine/-/engine-0.4.2.tgz` with shasum `bf17c31d80129264bcc8d885b27818b7f8958c9b`, SHA-256 `8f28af09f1fb6f31295e82ba9cb97350cb2f56be21e1db1c5bb028d9e128880d`, and SHA-512/integrity `sha512-+wx0YgvvaDeKO50pPY4uHuNdAMMJOyrVf0fm3Hxazve1+w1YvJXD+wQkQeA06D06nOciXuoNydohe4Xo27F2Zg==`. The public package contains 98 files, is 1,331,339 bytes packed, and has an unpacked size of 5,460,488 bytes. + +Fresh public root, `/browser`, `/assets`, and CLI imports, strict TypeScript, signature/attestation verification, SLSA provenance binding to `misofm/engine`, `.github/workflows/npm-publish.yml`, `refs/heads/main`, the accepted source SHA and the original publication run, candidate payload equivalence, and the public H256 coalescing proof passed. A parsed registry lookup confirms `@misofm/engine-web-adapter@0.5.12` is unused. ## Smallest bounded implementation @@ -27,6 +33,10 @@ Change only this issue spec and these eight release surfaces: Preserve codec 0.1.1, Effect, hash-wasm, toolchains, unrelated dependency integrities, safe baselines, copied-source attribution, exports, generated assets, browser scripts and publisher semantics. Do not edit runtime TypeScript, APIs, workers, AudioWorklet code, DSP, codec/decoder, storage/cache, binary assets or test harness behavior. +Implementation record: the adapter release tranche updates only package identity, the exact Engine 0.4.2 dependency, registry-generated lock metadata, release guards, and the recorded Engine provenance/source/archive identities across the eight authorized release surfaces. Runtime TypeScript, APIs, workers, AudioWorklet code, DSP, codec/decoder, storage/cache, binary assets, and test harness behavior remain unchanged. + +Fast tranche validation passed under Node `v22.23.2` and npm `10.9.8`: `npm ci --ignore-scripts`, format check, TypeScript typecheck, `git diff --check`, and an exact-path/literal audit. The audit found exactly the issue spec plus the eight authorized release surfaces and verified the lockfile's registry URL, Engine 0.4.2 version, and published integrity. + ## Objective gates 1. Under Node 22.23.2, run `npm ci --ignore-scripts` and `npm run check`. diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 67fe3fd..175a03a 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -23,12 +23,12 @@ concurrency: env: PACKAGE_NAME: "@misofm/engine-web-adapter" - PACKAGE_VERSION: "0.5.11" + PACKAGE_VERSION: "0.5.12" NPM_CONFIG_REGISTRY: "https://registry.npmjs.org" jobs: publish: - name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.11 + name: ${{ inputs.mode }} @misofm/engine-web-adapter 0.5.12 runs-on: ubuntu-24.04 steps: - name: Refuse a non-main or mismatched dispatch @@ -63,7 +63,7 @@ jobs: [[ "$(node -p "require('./package.json').version")" == "$PACKAGE_VERSION" ]] [[ "$(node -p "require('./package-lock.json').name")" == "$PACKAGE_NAME" ]] [[ "$(node -p "require('./package-lock.json').version")" == "$PACKAGE_VERSION" ]] - [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.4.1" ]] + [[ "$(node -p "require('./package.json').dependencies['@misofm/engine']")" == "0.4.2" ]] [[ "$(node -p "require('./package.json').repository.url")" == "git+https://github.com/misofm/engine-web-adapter.git" ]] - name: Install dependencies @@ -138,7 +138,7 @@ jobs: [[ "$attempt" == 60 ]] && { echo "registry did not converge" >&2; exit 1; } sleep 5 done - [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.4.1" ]] + [[ "$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" dependencies.@misofm/engine)" == "0.4.2" ]] consumer=$(mktemp -d) trap 'rm -rf -- "$consumer"' EXIT cd "$consumer" diff --git a/NOTICE b/NOTICE index 0f1ae61..82db284 100644 --- a/NOTICE +++ b/NOTICE @@ -1,10 +1,10 @@ @misofm/engine-web-adapter Copyright 2026 Miso -This product depends on @misofm/engine@0.4.1. The reviewed integration archive +This product depends on @misofm/engine@0.4.2. The reviewed integration archive was packed from misofm/engine commit -1f754cb415e5f39123333c526c75110e33ad24df with SHA256 -251ba94b46cfc648ff867a1191e3d28e1cf18b910fc651c0c87de3d18111a7bc. +13351fe71c7d4594e5ff6ea170c2839514cb243e with SHA256 +8f28af09f1fb6f31295e82ba9cb97350cb2f56be21e1db1c5bb028d9e128880d. This records reviewed source/archive identity, not registry publication. The transport SHA-256 implementation and verified-store/session-gate invariants diff --git a/README.md b/README.md index 63dbe3d..5065ddc 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # @misofm/engine-web-adapter Headless, framework-neutral browser session hosting for -`@misofm/engine@0.4.1`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC +`@misofm/engine@0.4.2`. Version 0.5 identifies canonical PCM with BLAKE3-256 and streams standards-compliant native FLAC through bounded HTTP ranges and a one-stem universal `@misofm/codec@0.1.1` Wasm Worker, verifies canonical PCM into OPFS, then feeds the Engine through bounded shared-memory @@ -10,15 +10,15 @@ rings. URL, authentication, and request mapping remain caller-owned. ## Install ```sh -npm install @misofm/engine-web-adapter@0.5.11 @misofm/engine@0.4.1 +npm install @misofm/engine-web-adapter@0.5.12 @misofm/engine@0.4.2 ``` -The package is ESM-only and remains pinned to exactly Engine `0.4.1` and +The package is ESM-only and remains pinned to exactly Engine `0.4.2` and `@misofm/codec` `0.1.1`. The codec currently supports Node `>=22.23.2 <23` and Bun `>=1.4.2 <1.5`; browser consumers use the bundled public codec asset. -The integration uses the published Engine 0.4.1 archive -from commit `1f754cb415e5f39123333c526c75110e33ad24df`, SHA256 -`251ba94b46cfc648ff867a1191e3d28e1cf18b910fc651c0c87de3d18111a7bc`. +The integration uses the published Engine 0.4.2 archive +from commit `13351fe71c7d4594e5ff6ea170c2839514cb243e`, SHA256 +`8f28af09f1fb6f31295e82ba9cb97350cb2f56be21e1db1c5bb028d9e128880d`. This release adds indexed full-response stem acquisition: active FLAC chunks are decoded once into verified sparse PCM, and timeline gaps are generated as zeroes when the Engine reads them. The existing native-FLAC path remains available. diff --git a/package-lock.json b/package-lock.json index e68ff98..ad12cdf 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,16 +1,16 @@ { "name": "@misofm/engine-web-adapter", - "version": "0.5.11", + "version": "0.5.12", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@misofm/engine-web-adapter", - "version": "0.5.11", + "version": "0.5.12", "license": "Apache-2.0", "dependencies": { "@misofm/codec": "0.1.1", - "@misofm/engine": "0.4.1", + "@misofm/engine": "0.4.2", "effect": "4.0.0-rc.112", "hash-wasm": "4.12.0" }, @@ -39,9 +39,9 @@ } }, "node_modules/@misofm/engine": { - "version": "0.4.1", - "resolved": "https://registry.npmjs.org/@misofm/engine/-/engine-0.4.1.tgz", - "integrity": "sha512-hTRdb1SOyRngbnte21QwaSMiPZ1Y90FgXkehSDG2Hk37hBZQ2qtgIZL0H2s1NtpgZ+8pd4AsmhdLneBjj6IgOw==", + "version": "0.4.2", + "resolved": "https://registry.npmjs.org/@misofm/engine/-/engine-0.4.2.tgz", + "integrity": "sha512-+wx0YgvvaDeKO50pPY4uHuNdAMMJOyrVf0fm3Hxazve1+w1YvJXD+wQkQeA06D06nOciXuoNydohe4Xo27F2Zg==", "license": "Apache-2.0", "bin": { "enginectl": "dist/enginectl.js" diff --git a/package.json b/package.json index 71d9426..830ac19 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@misofm/engine-web-adapter", - "version": "0.5.11", + "version": "0.5.12", "description": "Bounded FLAC browser session adapter for @misofm/engine using @misofm/codec", "license": "Apache-2.0", "repository": { @@ -62,7 +62,7 @@ }, "dependencies": { "@misofm/codec": "0.1.1", - "@misofm/engine": "0.4.1", + "@misofm/engine": "0.4.2", "effect": "4.0.0-rc.112", "hash-wasm": "4.12.0" }, diff --git a/scripts/check-package.mjs b/scripts/check-package.mjs index c4ef9e2..bb82af9 100644 --- a/scripts/check-package.mjs +++ b/scripts/check-package.mjs @@ -6,10 +6,10 @@ import { tmpdir } from "node:os"; import { spawnSync } from "node:child_process"; const packageJson = JSON.parse(await readFile("package.json", "utf8")); -assert.equal(packageJson.version, "0.5.11"); +assert.equal(packageJson.version, "0.5.12"); assert.deepEqual(packageJson.dependencies, { "@misofm/codec": "0.1.1", - "@misofm/engine": "0.4.1", + "@misofm/engine": "0.4.2", effect: "4.0.0-rc.112", "hash-wasm": "4.12.0", }); diff --git a/src/provenance.ts b/src/provenance.ts index 4beb53b..e68978a 100644 --- a/src/provenance.ts +++ b/src/provenance.ts @@ -1,9 +1,9 @@ export const ADAPTER_PROVENANCE = Object.freeze({ engine: Object.freeze({ - package: "@misofm/engine@0.4.1", + package: "@misofm/engine@0.4.2", repository: "misofm/engine", - archiveSha256: "251ba94b46cfc648ff867a1191e3d28e1cf18b910fc651c0c87de3d18111a7bc", - commit: "1f754cb415e5f39123333c526c75110e33ad24df", + archiveSha256: "8f28af09f1fb6f31295e82ba9cb97350cb2f56be21e1db1c5bb028d9e128880d", + commit: "13351fe71c7d4594e5ff6ea170c2839514cb243e", }), safeBaselines: Object.freeze({ stemStore: "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c", diff --git a/tests/foundation.test.ts b/tests/foundation.test.ts index edb4c4f..da71cb3 100644 --- a/tests/foundation.test.ts +++ b/tests/foundation.test.ts @@ -18,11 +18,11 @@ test("foundation is pinned to the exact public Engine release", async () => { assert.equal(ADAPTER_PROVENANCE.engine.package, `@misofm/engine@${packageJson.dependencies["@misofm/engine"]}`); assert.equal( ADAPTER_PROVENANCE.engine.commit, - "1f754cb415e5f39123333c526c75110e33ad24df", + "13351fe71c7d4594e5ff6ea170c2839514cb243e", ); assert.equal( ADAPTER_PROVENANCE.engine.archiveSha256, - "251ba94b46cfc648ff867a1191e3d28e1cf18b910fc651c0c87de3d18111a7bc", + "8f28af09f1fb6f31295e82ba9cb97350cb2f56be21e1db1c5bb028d9e128880d", ); assert.equal(ADAPTER_PROVENANCE.safeBaselines.stemStore, "bd7f330a9773ce43bb077f0e6d5c8fc30fe9e27c"); }); From d350547211dbb51b8a47e08438a51f0e38497abb Mon Sep 17 00:00:00 2001 From: BL Date: Thu, 17 Sep 2026 02:06:55 +0000 Subject: [PATCH 3/4] docs: record adapter 0.5.12 qualification --- ...122-release-web-adapter-0-5-12-against-engine-0-4-2.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md b/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md index 398e566..9d1a6cb 100644 --- a/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md +++ b/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md @@ -37,6 +37,14 @@ Implementation record: the adapter release tranche updates only package identity Fast tranche validation passed under Node `v22.23.2` and npm `10.9.8`: `npm ci --ignore-scripts`, format check, TypeScript typecheck, `git diff --check`, and an exact-path/literal audit. The audit found exactly the issue spec plus the eight authorized release surfaces and verified the lockfile's registry URL, Engine 0.4.2 version, and published integrity. +## Candidate qualification record + +Frozen checkpoint `f85fb6dc5ab550268b1690754cb7f0b94b218c61` passed the complete `npm run check` suite (380 tests), `npm run publish:dry-run`, fresh install, package policy and clean-consumer verification under Node 22.23.2. npm 11.19.0 packed exactly one 474,775-byte, 247-file candidate at `/tmp/adapter-0512-candidate-20260917/misofm-engine-web-adapter-0.5.12.tgz`: shasum `c2436ee1d2226e741eeda9e8ff3b10dee1977267`, SHA-256 `65ff94fde2799d379fcece2dd4c9c8e2872c0bac753ae9fac63c7cf2d71a6f95`, SHA-512 `53cae9c10f9aa110d08dde0180aaa3f6677599c9bc6a8425a78a1696721558aade1d7cfc1bb99c4a2a313eddbdda7aee974746f44ea50dbb85c8a99b63e7de20`, and integrity `sha512-U8rpwQ+aoRDQjd4BgKqj9md1mcm8aoQlp4oWlnIVWKreHXz8G7mcSioxPt292nrul0dG9E6lDbuFyKmbY+feIA==`. + +The clean consumer imports root, `/stems`, `/assets` and `/package.json`; strict TypeScript with `skipLibCheck: false` passes; one physical Engine 0.4.2 is installed; its payload equals the independently verified public Engine archive; and built `ADAPTER_PROVENANCE` exactly identifies Engine 0.4.2, source `13351fe71c7d4594e5ff6ea170c2839514cb243e` and archive SHA-256 `8f28af09f1fb6f31295e82ba9cb97350cb2f56be21e1db1c5bb028d9e128880d`. + +The first browser invocations failed before launch because `CHROME_EXECUTABLE` was unset; this consumed Luna's two allowed rounds and was classified as infrastructure-only. One bounded Sol high escalation used the matching executable `/home/bl/.cache/ms-playwright/chromium-1243/chrome-linux64/chrome` (Chrome for Testing 153.0.8010.12). Both `npm run test:browser` and `node scripts/browser-packed.mjs --indexed-sparse` then passed with no request failures or console errors and all workers terminated. No source, harness, archive or package correction was made. Logs are retained under `/tmp/adapter-0512-qualification-20260917/`, `/tmp/adapter-0512-test-browser.log` and `/tmp/adapter-0512-browser-packed-indexed-sparse.log`. + ## Objective gates 1. Under Node 22.23.2, run `npm ci --ignore-scripts` and `npm run check`. From 58cb0eeb7ef4994b318e12442d03b2859313d9d5 Mon Sep 17 00:00:00 2001 From: BL Date: Thu, 17 Sep 2026 02:08:41 +0000 Subject: [PATCH 4/4] docs: record adapter 0.5.12 review --- .../122-release-web-adapter-0-5-12-against-engine-0-4-2.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md b/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md index 9d1a6cb..0928ddd 100644 --- a/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md +++ b/.github/ISSUE_SPECS/122-release-web-adapter-0-5-12-against-engine-0-4-2.md @@ -45,6 +45,10 @@ The clean consumer imports root, `/stems`, `/assets` and `/package.json`; strict The first browser invocations failed before launch because `CHROME_EXECUTABLE` was unset; this consumed Luna's two allowed rounds and was classified as infrastructure-only. One bounded Sol high escalation used the matching executable `/home/bl/.cache/ms-playwright/chromium-1243/chrome-linux64/chrome` (Chrome for Testing 153.0.8010.12). Both `npm run test:browser` and `node scripts/browser-packed.mjs --indexed-sparse` then passed with no request failures or console errors and all workers terminated. No source, harness, archive or package correction was made. Logs are retained under `/tmp/adapter-0512-qualification-20260917/`, `/tmp/adapter-0512-test-browser.log` and `/tmp/adapter-0512-browser-packed-indexed-sparse.log`. +## Fresh Astra medium review + +PASS at frozen clean checkpoint `d350547`, with no blockers. The reviewer independently confirmed the exact nine permitted paths; no runtime, asset, unrelated dependency or publisher-semantic changes; every candidate archive hash/count; frozen-tree payload equality; fresh public imports; strict TypeScript; exact provenance; one physical Engine 0.4.2; byte-for-byte Engine payload equality with the public archive; accepted signature/SLSA evidence; and the public H256 retained-publication behavior. Foundation tests passed 7/7 from the repository root. The recorded first foundation invocation used the clean consumer as its working directory and failed cwd-dependent assertions; the correct repository-root invocation passed without a source or archive change. Prior 380/380 tests and both successful browser logs were inspected. Exact-main, parsed-E404, OIDC-only, serialized publication and verify-only recovery controls remain intact. PR macOS OPFS and Chromium/WebKit qualification remains before publication. + ## Objective gates 1. Under Node 22.23.2, run `npm ci --ignore-scripts` and `npm run check`.