@ai-ecoverse/slicc-cdp 1.27.2 → 1.27.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +1 -1
  2. package/bin/curlwright.wasm +0 -0
  3. package/bin/playwright-cli.wasm +0 -0
  4. package/package.json +3 -3
package/README.md CHANGED
@@ -147,7 +147,7 @@ A developer's own Chrome listens on `127.0.0.1:9222-9229`, so no test touches th
147
147
 
148
148
  Release publishes its complete signed assets without an in-release behaviour-certification gate. The code-only `verify-release.yml` runs **after** `publish-release`, or independently from main with `gh workflow run verify-release.yml --ref main -f version=1.26.2`. It hashes the exact npm tarball, verifies registry integrity and signed SLSA v1 (GitHub-hosted `release.yml` on main), requires `gitCommit = gitHead = tag` on main, verifies all four macOS signatures and notarisation, and requires the full checksum inventory including the installer and notices. Missing evidence is red `INCOMPLETE`; a mismatch is a red supply-chain `FAIL`, with integrity failure taking precedence.
149
149
 
150
- A complete byte verification appends `certified @ai-ecoverse/slicc-cdp@<v> sha256=<hex> (...)` between `cert-verify` markers in the published release notes. It does not assert PR behaviour certification, change an npm dist-tag, move a tag or execute a model. **Interim:** until the required PR `cert-review` check is live, releases receive supply-chain verification only, not behavioural certification in CI. Identical notes are unchanged; an existing certificate for different bytes raises an alert rather than being overwritten. Historical releases with incomplete checksum inventories are not silently waived. All potentially developer-hosted cert jobs use `SLICC_CDP_PORTS=9300-9309`.
150
+ A complete byte verification appends `verified @ai-ecoverse/slicc-cdp@<v> sha256=<hex> (...)` between `cert-verify` markers in the published release notes. The `certified` prefix is reserved for the later required PR certification lane and its bound PR records. It does not assert PR behaviour certification, change an npm dist-tag, move a tag or execute a model. **Interim:** until the required PR `cert-review` check is live, releases receive supply-chain verification only, not behavioural certification in CI. Identical notes are unchanged; an existing certificate for different bytes raises an alert rather than being overwritten. Historical releases with incomplete checksum inventories are not silently waived. All potentially developer-hosted cert jobs use `SLICC_CDP_PORTS=9300-9309`.
151
151
 
152
152
  ## Historical behaviour-certification replay
153
153
 
package/bin/curlwright.wasm CHANGED
Binary file
package/bin/playwright-cli.wasm CHANGED
Binary file
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ai-ecoverse/slicc-cdp",
3
- "version": "1.27.2",
3
+ "version": "1.27.4",
4
4
  "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
5
5
  "type": "module",
6
6
  "license": "Apache-2.0",
@@ -68,8 +68,8 @@
68
68
  "chrome": "156.0.8078.4"
69
69
  },
70
70
  "devDependencies": {
71
- "@ai-ecoverse/slicc-kernel": "1.110.5",
72
- "@ai-ecoverse/slicc-shared-web": "1.23.0",
71
+ "@ai-ecoverse/slicc-kernel": "1.111.0",
72
+ "@ai-ecoverse/slicc-shared-web": "1.23.1",
73
73
  "@biomejs/biome": "2.5.15",
74
74
  "lefthook": "2.2.1",
75
75
  "semantic-release": "25.0.9",