@ai-ecoverse/slicc-bios 1.42.5 → 1.42.6

package/README.md

@@ -569,7 +569,7 @@ Seven certifies a gated package (slicc-kernel, slicc-cdp, slicc-clipboard, slicc
 
 ### The npm package
 
-`@ai-ecoverse/slicc-bios` on npm carries only the manifests a consumer needs to test against what seven ships: `src/packages/package.json`, `package-lock.json`, `pnpm-lock.yaml` and `certs.json`, `src/packages/agent/package.json` and `pnpm-lock.yaml`, and `src/packages/optional/catalog.json`, `sources.json` and `exceptions.json`. It has no runtime code and no dependencies, and those paths stay where they are. `ci.yml` releases it from `main` only, after lint, through slicc-shared-web's pipeline: semantic-release reads the conventional commits, tags `v<version>`, writes the GitHub release and publishes to npm with provenance through npm's trusted publishing (`fledgling.workflow` is `ci.yml`). The deploy to seven (`deploy.yml`) is separate and doesn't wait for it.
+`@ai-ecoverse/slicc-bios` on npm carries only the manifests a consumer needs to test against what seven ships: `src/packages/package.json`, `package-lock.json`, `pnpm-lock.yaml` and `certs.json`, `src/packages/agent/package.json` and `pnpm-lock.yaml`, and `src/packages/optional/catalog.json`, `sources.json` and `exceptions.json`. It has no runtime code and no dependencies, and those paths stay where they are. `ci.yml` releases it from `main` only, after lint, through slicc-shared-web's pipeline: semantic-release reads the conventional commits, tags `v<version>`, writes the GitHub release and publishes to npm with provenance through npm's trusted publishing (`fledgling.workflow` is `ci.yml`). The same release job then publishes seven (see [Hosting](#hosting)).
 
 ## Develop
 
@@ -597,20 +597,21 @@ No test calls a real model. Every test serves an empty `packages/agent/` project
 [`.github/workflows/ci.yml`](.github/workflows/ci.yml) is one caller of [slicc-shared-web's pipeline](https://github.com/ai-ecoverse/slicc-shared-web#pipeline), pinned to the release `@ai-ecoverse/slicc-shared-web` has in `devDependencies` (Renovate moves both in one PR). It runs on pull requests, the merge queue and pushes to `main`:
 
 - **Pull requests and the merge queue:** lint, then every `test/integration/*.test.mjs` split by the last runs' JUnit timings over 12 pool shards (`ci / integration`), then on a pull request the Claude and Codex reviews (`ci / review`) with this repository's `review-prompt`. The shared guard vectors run as one file per path (extension, proxy), target group (`seven`, `vault`, `vault-x`, `apex` and the rest, `test/integration/guard-groups.mjs`) and detach variant (`lagging` or the others), 20 files of 2 to about 12 minutes, so the split can balance them. The slicc CLI tests use `node_modules/.bin/slicc` (or `SLICC_CLI`).
-- **`main`:** semantic-release publishes the npm package (see [The npm package](#the-npm-package)). [`deploy.yml`](.github/workflows/deploy.yml) deploys every push to `main` and `bb/**` (see [Hosting](#hosting)).
+- **`main`:** semantic-release publishes the npm package (see [The npm package](#the-npm-package)). When it releases, the pipeline's `after-release` publishes that version to seven, in the `production` environment (see [Hosting](#hosting)). [`deploy.yml`](.github/workflows/deploy.yml) publishes every push to a `bb/**` branch as a preview.
 
 Require `ci / integration` and `ci / review`. There is no retry: a flaky test fails the run.
 
 ## Hosting
 
-`main` is live at <https://seven.sliccy.ai/>, and every `bb/**` branch at `https://<branch>.sliccy.ai/`, where the branch name is lowercased and runs of anything but letters and digits become `-` (`bb/edge-hosting` → <https://bb-edge-hosting.sliccy.ai/>). Other branches, Renovate's included, get no preview. Each host is its own origin, so a branch gets its own OPFS and service worker and can't disturb `seven`. `https://www.sliccy.ai/7/` serves the same `seven/` next to SLICC 6 (sliccy-ai#51, see [Next to SLICC 6](#next-to-slicc-6-wwwsliccyai7)).
+The newest release is live at <https://seven.sliccy.ai/>, and every `bb/**` branch at `https://<branch>.sliccy.ai/`, where the branch name is lowercased and runs of anything but letters and digits become `-` (`bb/edge-hosting` → <https://bb-edge-hosting.sliccy.ai/>). Other branches, Renovate's included, get no preview. Each host is its own origin, so a branch gets its own OPFS and service worker and can't disturb `seven`. `https://www.sliccy.ai/7/` serves the same `seven/` next to SLICC 6 (sliccy-ai#51, see [Next to SLICC 6](#next-to-slicc-6-wwwsliccyai7)).
 
 The hosts are served by the [sliccy-ai](https://github.com/ai-ecoverse/sliccy-ai) worker from the R2 bucket `slicc-bios`. This repo only publishes into that bucket:
 
 - [`edge/publish.mjs`](edge/publish.mjs) `<branch>` uploads `src/` to `seven/` for `main` and to `branches/<label>/` for every other branch, and deletes what the previous upload had and this one doesn't. A manifest next to it (`seven.json`, `branches/<label>.json`) records which branch owns the label, so two branches that map to the same label can't overwrite each other.
 - The bucket expires everything under `branches/` 30 days after upload. Every push uploads all files again, so a branch stays up while it's active and disappears a month after its last push. Nothing needs to be cleaned up when a branch is deleted.
-- [`.github/workflows/deploy.yml`](.github/workflows/deploy.yml) publishes on every push to `main` or a `bb/**` branch, on `ubuntu-latest`. A newer push to a `bb/**` branch cancels its running publish; a publish of `main` is never cancelled.
-  - **`main`** publishes `seven/` with `CLOUDFLARE_API_TOKEN`, an account token with Workers R2 Storage Write. That token could overwrite `seven/`, so it lives only in the `production` environment, whose deployment branch policy allows `main` alone. A branch that changes the workflow can't read it.
+- **seven** is published only by a release. On a push to `main`, the pipeline's release job runs semantic-release in the `production` environment, and when that tags a new `v<version>` its `after-release` command runs `edge/publish.mjs main`, which uploads `seven/`. A push that releases nothing (`chore:`, `ci:`, `docs:`, `test:` and the like) publishes nothing, so a change that only matters to seven needs a `fix:` or `feat:` commit to go live. A release job is never cancelled by a newer one.
+  - The upload uses `SLICC_BIOS_DEPLOY_TOKEN`, an account token with Workers R2 Storage Write, handed to wrangler as `CLOUDFLARE_API_TOKEN`. That token could overwrite `seven/`, so it lives only in the `production` environment, whose deployment branch policy allows `main` alone, and `ci.yml` gives it only to the release job (`release-secrets`). The pipeline keeps its own `CLOUDFLARE_API_TOKEN`, the reviewers' screenshot token, out of `after-release`, hence the separate name.
+- [`.github/workflows/deploy.yml`](.github/workflows/deploy.yml) publishes every push to a `bb/**` branch, on `ubuntu-latest`. A newer push to the branch cancels its running publish.
   - **A `bb/**` branch** holds no secret. It runs in the `preview` environment, with no approval step and `id-token: write`. `edge/publish.mjs` asks GitHub for the job's OIDC token (audience `https://sliccy.ai`) and publishes through the sliccy-ai worker's `/api/publish/*` route. The route checks the token's signature, issuer, audience, expiry, repository and branch, then derives `branches/<label>/` from the branch itself. A branch can only ever write its own prefix, and never `seven/`. It first writes a manifest listing both the previous upload's files and this one's, so a publish cancelled midway leaves every file it uploaded on the list for the next publish to delete. Then files go up eight at a time, then deletions, then the final manifest.
 
 ## Rules

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.42.5",
+  "version": "1.42.6",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",