@ai-ecoverse/slicc-bios 1.31.17 → 1.32.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -506,7 +506,7 @@ Seven certifies a gated package (slicc-kernel, slicc-cdp, slicc-clipboard, slicc
|
|
|
506
506
|
|
|
507
507
|
**release-state** ([`scripts/cert/release-state.mjs`](scripts/cert/release-state.mjs), code only) judges each gated pin and each `certs.json` line that a change adds, against the registry and its own repository's certification:
|
|
508
508
|
- **Always:** the registry's integrity equals the lockfile's (or the line's).
|
|
509
|
-
- **slicc-kernel, slicc-jsh, mcpcat, wasi-slicc (slicc-cli's):** npm provenance names the tarball and `<repo>/.github/workflows/release.yml` at `refs/heads/main`; that commit is on main and carries `cert-review` success,
|
|
509
|
+
- **slicc-kernel, slicc-jsh, mcpcat, wasi-slicc (slicc-cli's):** npm provenance names the tarball and `<repo>/.github/workflows/release.yml` at `refs/heads/main`; that commit is on main and carries `cert-review` success: a `cert-review` commit status from `github-actions[bot]` (what cert-review v2 writes from slicc-shared-web v1.27.1, and what these repos' own merge groups wrote before), or a v1.27.0 check run from app 15368 whose `external_id` names a `merge_group` run of `.github/workflows/cert-review.yml` (its plain path or the org-required `@refs/heads/main` one) on that commit. A version-only release commit is judged by its parent. The kernel also passes on its npm `certified` tag. wasi-slicc counts only from 1.44.1, its first PR-certified version, and never 1.44.4, whose release run failed (slicc-cli coordinator). A status whose `target_url` is a run attempt counts only if that run is a `merge_group` run of the repository's `cert-review.yml` on that commit; once a repository is listed in `V2_STATUS` (when it moves to v1.27.1), only such statuses count. Residual until then: the bare commit-status rule trusts any same-repo workflow with `statuses: write`, so it trusts that repo's collaborators; the org require-workflows ruleset and the cert-path guard are what bind it.
|
|
510
510
|
- **slicc-cdp, slicc-clipboard, wasm-tailscale:** the npm `certified` dist-tag is this version.
|
|
511
511
|
- **homescoop (`wasm-*`, `wasi-*`, `wasix-*`, `py-*`):** npm provenance names the tarball and homescoop's `ladder-build.yml` (or `publish.yml`) at `refs/heads/main`, any version, and homescoop's `certification-exceptions.json`, read at the commit pinned in `release-state.mjs`, neither fails the version (`verdict: fail`) nor requires a kernel bios doesn't pin (`verdict: requires`). An unreadable or unknown-shaped file fails closed.
|
|
512
512
|
It runs twice: in `ci / test` for quick feedback, and as cert-review's code check, from main's tree with the pull request's head as data, so the pull request's own code can't make it pass. A failure names the package and why, and the PR stays red until it pins a certified version. An `@ai-ecoverse` lockfile entry that doesn't resolve to a registry tarball with its integrity (a `tarball:` resolution, an alias, a link) fails it.
|
|
@@ -521,7 +521,7 @@ It runs twice: in `ci / test` for quick feedback, and as cert-review's code chec
|
|
|
521
521
|
|
|
522
522
|
### Certification review
|
|
523
523
|
|
|
524
|
-
[`.github/workflows/cert-review.yml`](.github/workflows/cert-review.yml) calls slicc-shared-web's cert-review v2 on every non-draft pull request into main and every merge group, and sets one `cert-review`
|
|
524
|
+
[`.github/workflows/cert-review.yml`](.github/workflows/cert-review.yml) calls slicc-shared-web's cert-review v2 on every non-draft pull request into main and every merge group, and sets one `cert-review` commit status on the head (by `github-actions[bot]`, linked to its run attempt; slicc-shared-web v1.28.0). Pull-request code runs only in CI: the `ci / cert evidence` job (`pull_request`, a read-only token, no secrets) re-runs each test file the shards failed on the head's tree until it passes (at most three times) and, only if it failed every time, on main's, each with its own slicc CLI, within a 20-minute budget for all re-runs and scenarios (files with an open `flaky-test` issue are skipped, except those covering data integrity, security or the guard: `CLASSES` in evidence.mjs), so it never holds the CI run for hours. A file a shard failed and a re-run passed is a head flake, a finding, and a fail in those three classes. A spent budget or a missing result fails `ci / cert evidence` (`evidence.mjs check`), and `ci / test` needs that job, runs each changed gated pin's scenario ([`scripts/cert/scenarios/<package>.txt`](scripts/cert/scenarios/), one command per line, with `# pass:` lines saying what output passes) in seven on both trees through `test:cert`, all in the `cert-evidence` artifact ([`scripts/cert/evidence.mjs`](scripts/cert/evidence.mjs)). A separate `ci / cert inspect` job runs no pull-request code: from main's scripts, with the head checked out only as data, it inspects each changed pin's registry tarballs and records release-state in the `cert-inspect` artifact, which the caller marks as upstream data (`evidence-notes`), so injection-shaped text in a dependency's code is a note for the review, not a failure. cert-review fetches that artifact and the shards' artifacts, from this PR's CI run and main's, by id and digest; the review reads them with Read, Glob and Grep only, against the rules in [`scripts/cert/review.txt`](scripts/cert/review.txt). A gated pin with no scenario is a known gap ("can't judge <package> in seven"). Changes to `scripts/cert/**`, `scripts/ci/**` or any workflow need the coordinator's `cert-review-approved`.
|
|
525
525
|
|
|
526
526
|
### Canary
|
|
527
527
|
|
package/package.json
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
"private": true,
|
|
4
4
|
"description": "SLICC's agent, which the UI installs with pnpm in the background into /opt/agent in OPFS",
|
|
5
5
|
"dependencies": {
|
|
6
|
-
"@ai-ecoverse/slicc-agent": "6.
|
|
6
|
+
"@ai-ecoverse/slicc-agent": "6.15.1",
|
|
7
7
|
"@ai-ecoverse/slicc-kernel": "1.136.1"
|
|
8
8
|
}
|
|
9
9
|
}
|
|
@@ -14,34 +14,34 @@ importers:
|
|
|
14
14
|
.:
|
|
15
15
|
dependencies:
|
|
16
16
|
'@ai-ecoverse/slicc-agent':
|
|
17
|
-
specifier: 6.
|
|
18
|
-
version: 6.
|
|
17
|
+
specifier: 6.15.1
|
|
18
|
+
version: 6.15.1(@ai-ecoverse/slicc-kernel@1.136.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
|
|
19
19
|
'@ai-ecoverse/slicc-kernel':
|
|
20
20
|
specifier: 1.136.1
|
|
21
21
|
version: 1.136.1
|
|
22
22
|
|
|
23
23
|
packages:
|
|
24
24
|
|
|
25
|
-
'@ai-ecoverse/slicc-agent@6.
|
|
26
|
-
resolution: {integrity: sha512-
|
|
25
|
+
'@ai-ecoverse/slicc-agent@6.15.1':
|
|
26
|
+
resolution: {integrity: sha512-zDoFTj4EHIzFHFwwXFn2bo1/XjTMDZTeSn9myCmj8TBb5TY94wSNqUrWu1//V5owLtF/BK8SLEBmBUE5Sf5DDw==}
|
|
27
27
|
engines: {node: '>=24'}
|
|
28
28
|
peerDependencies:
|
|
29
29
|
'@ai-ecoverse/slicc-kernel': '>=1.110.0 <2'
|
|
30
|
-
'@ai-ecoverse/slicc-spectrum': ^1.
|
|
30
|
+
'@ai-ecoverse/slicc-spectrum': ^1.98.0
|
|
31
31
|
peerDependenciesMeta:
|
|
32
32
|
'@ai-ecoverse/slicc-spectrum':
|
|
33
33
|
optional: true
|
|
34
34
|
|
|
35
|
-
'@ai-ecoverse/slicc-browsers@1.
|
|
36
|
-
resolution: {integrity: sha512-
|
|
35
|
+
'@ai-ecoverse/slicc-browsers@1.9.2':
|
|
36
|
+
resolution: {integrity: sha512-WVaDUiZbd5nwG03+2WoQ8YA8ATC2mkx1DRCWpLuMFBNnyN0cd5IRoGF6KYNjMkXvBQCvZZxP+gwffrpmHYJ/cQ==}
|
|
37
37
|
engines: {node: '>=24'}
|
|
38
38
|
|
|
39
39
|
'@ai-ecoverse/slicc-kernel@1.136.1':
|
|
40
40
|
resolution: {integrity: sha512-OIrL7sWfPIM+uyUQxqpwfYKiMX+lc58kcR8gx1zYi9R0I8UTcsMCKXJsW+VrFHcCqXY/7G3YE/9LB9I0VTJtXQ==}
|
|
41
41
|
engines: {node: '>=24'}
|
|
42
42
|
|
|
43
|
-
'@ai-ecoverse/slicc-vault@1.
|
|
44
|
-
resolution: {integrity: sha512
|
|
43
|
+
'@ai-ecoverse/slicc-vault@1.14.0':
|
|
44
|
+
resolution: {integrity: sha512-/0Z5dH10zc3S+Q+AtQvAVXohfezLTdj/Tmsh/ehLCrsCo9pRQZH843Te2h+OQSgAZq7aBiq+IYFWL7NS2fK/tA==}
|
|
45
45
|
engines: {node: '>=24'}
|
|
46
46
|
|
|
47
47
|
'@anthropic-ai/sdk@0.129.0':
|
|
@@ -346,11 +346,11 @@ packages:
|
|
|
346
346
|
|
|
347
347
|
snapshots:
|
|
348
348
|
|
|
349
|
-
'@ai-ecoverse/slicc-agent@6.
|
|
349
|
+
'@ai-ecoverse/slicc-agent@6.15.1(@ai-ecoverse/slicc-kernel@1.136.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
|
|
350
350
|
dependencies:
|
|
351
|
-
'@ai-ecoverse/slicc-browsers': 1.
|
|
351
|
+
'@ai-ecoverse/slicc-browsers': 1.9.2
|
|
352
352
|
'@ai-ecoverse/slicc-kernel': 1.136.1
|
|
353
|
-
'@ai-ecoverse/slicc-vault': 1.
|
|
353
|
+
'@ai-ecoverse/slicc-vault': 1.14.0
|
|
354
354
|
'@aws-sdk/middleware-websocket': 3.972.54
|
|
355
355
|
'@earendil-works/chord': 1.3.0
|
|
356
356
|
'@earendil-works/pi-ai': 1.3.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
|
|
@@ -370,11 +370,11 @@ snapshots:
|
|
|
370
370
|
- ws
|
|
371
371
|
- zod
|
|
372
372
|
|
|
373
|
-
'@ai-ecoverse/slicc-browsers@1.
|
|
373
|
+
'@ai-ecoverse/slicc-browsers@1.9.2': {}
|
|
374
374
|
|
|
375
375
|
'@ai-ecoverse/slicc-kernel@1.136.1': {}
|
|
376
376
|
|
|
377
|
-
'@ai-ecoverse/slicc-vault@1.
|
|
377
|
+
'@ai-ecoverse/slicc-vault@1.14.0': {}
|
|
378
378
|
|
|
379
379
|
'@anthropic-ai/sdk@0.129.0':
|
|
380
380
|
dependencies:
|