@dailephd/my-frontend-observer 0.8.1 → 0.9.1

package/docs/reports/v0.9-pre-release-readiness.md

@@ -0,0 +1,170 @@
+# v0.9 Pre-release Readiness
+
+## 1. VERDICT
+
+`RUN_A` passed the configured candidate job and all three exact-candidate
+platform jobs. This is implementation-complete v0.9 readiness evidence, not a
+release. A second complete workflow run is required after this report is
+committed because the report is included in the npm package.
+
+## 2. Repository identity
+
+- Repository: `C:\Users\daile\Projects\my-frontend-observer`
+- Starting branch: `master`
+- Prompt 7 entry commit: `a78a058271564661e2f04a835db04071b135258a`
+- Package: `@dailephd/my-frontend-observer`
+- Package version: `0.8.1`
+- Viewer protocol: `1.3.0`
+- Visual annotation schema: `1.0.0`
+- Frontend-contract schema: `1.0.0`
+- External-reference schema: `1.0.0`
+
+## 3. Prompt 7 entry gate
+
+The required Prompt 7 verdict was present:
+`PASS_V0_9_BATCH7_INTEGRATED_IMPLEMENTATION_COMPLETE`.
+
+The entry commit was the required `a78a058...`, the tracked worktree was clean,
+and `docs/reports/v0.9-architecture-retrieval.md` retained its `S`
+skip-worktree state. The seven v0.9 batch reports were present. Prompt 7 states
+that v0.8.1 is the latest published release, v0.9 implementation is complete,
+and v0.9 is not released.
+
+## 4. Validation branch
+
+- Branch: `validation/v0.9-pre-release`
+- The branch was created from the required entry commit and pushed normally.
+- `master` was not pushed.
+
+## 5. Workflow architecture
+
+`.github/workflows/pre-release-readiness.yml` uses a Node 24 Ubuntu candidate
+job. It runs `npm ci`, Chromium installation, typecheck, lint, unit tests,
+real-Chromium browser tests, the security suite, build, documentation checks,
+and `npm pack`. It uploads one candidate tarball and its SHA-256 file.
+
+The Windows, Ubuntu, and macOS matrix jobs download that artifact, independently
+verify its SHA-256, install Chromium, and run the packed observation, viewer,
+and v0.9 annotation smokes. The workflow is triggered by `validation/**` and
+retains workflow dispatch support.
+
+## 6. Run A exact commit
+
+- Run ID: `35258547214`
+- URL: <https://github.com/dailephd/my-frontend-observer/actions/runs/35258547214>
+- Head: `a78a058271564661e2f04a835db04071b135258a`
+- Event: `push`
+- Result: `PASS`
+
+`RUN_A` passed all configured platforms. A second complete workflow run is
+required after this report is committed. The final run ID and exact candidate
+SHA are intentionally recorded outside the tracked package and in the terminal
+summary to avoid self-referential candidate drift.
+
+## 7. Candidate job
+
+The candidate job passed typecheck, lint, unit tests, real-Chromium browser
+tests, security tests, build, documentation checks, exact packaging, SHA-256
+calculation, and candidate artifact upload.
+
+## 8. Windows exact-candidate result
+
+The `windows-latest` matrix job passed. The smoke summaries reported platform
+`win32` and package version `0.8.1`.
+
+## 9. Linux exact-candidate result
+
+The `ubuntu-latest` matrix job passed. The smoke summaries reported platform
+`linux` and package version `0.8.1`.
+
+## 10. macOS exact-candidate result
+
+The `macos-latest` matrix job passed. The smoke summaries reported platform
+`darwin` and package version `0.8.1`.
+
+## 11. Packed observation smoke
+
+The packed observation smoke passed on Windows, Linux, and macOS. Its aggregate
+`pass` value was `true` on every platform. The protected and preserved failure
+values in the summary are the intentional negative-case contract evaluation,
+not smoke failure.
+
+## 12. Packed viewer smoke
+
+The packed viewer smoke reported `PASS` on Windows, Linux, and macOS. It
+verified the installed package's project/viewer behavior, real Chromium view,
+protocol `1.3.0`, provenance, media, PWA, and stale-evidence boundaries.
+
+## 13. Packed v0.9 annotation smoke
+
+The packed v0.9 annotation smoke reported `PASS` on Windows, Linux, and macOS.
+Package contents, public exports, consumer purity, project workflow, runtime
+annotation, runtime promotion, contract inspection, reference annotation,
+reference materialization, new-reference inspection, and the read-only
+boundary passed on each platform.
+
+## 14. Candidate SHA verification procedure
+
+The candidate artifact downloaded from Run A contained:
+
+- `dailephd-my-frontend-observer-0.8.1.tgz`
+- `candidate.sha256.txt`
+
+The independently computed SHA-256 was
+`bd40d2e83704e435d8647f5004ab29fd3a523540256ac67e10fec995c6f7d443`, equal to
+the SHA recorded by the candidate job. The matrix jobs consumed this same
+candidate artifact and independently verified its digest.
+
+## 15. Cross-platform defects and fixes, if any
+
+No product, packaging, test, documentation, portability, workflow, or
+infrastructure defect was exposed by Run A. No remediation commit was needed.
+
+## 16. Public API audit
+
+- `materializeVisualAnnotationReference`: public export, as required by Prompt 6.
+- `promoteVisualAnnotationContract`: public export `no`, intentional.
+
+The promotion service remains an application service behind the supported
+viewer-server promotion route. Prompt 5 did not freeze it as a package public
+API, while Prompt 6 explicitly required the materialization service to be
+exported. No new public surface was added during readiness.
+
+## 17. Version/release-state audit
+
+- `package.json` version: `0.8.1`.
+- `package-lock.json` version: `0.8.1`.
+- README, CHANGELOG, `docs/CURRENT_STATE.md`, and `docs/ROADMAP.md` state that
+  v0.8.1 is the latest published release and v0.9 is implementation-complete
+  but unreleased.
+- No v0.9.0 tag was created.
+- No npm publication or GitHub release was performed.
+
+## 18. Security/readiness audit
+
+The candidate security suite passed. The packed annotation smoke continued to
+prove the installed package's project-aware authoring surface without adding a
+new write capability. The `.tmp-*` discovery exclusion passed the candidate and
+packed validation; the existing Windows EPERM race description remains
+structurally mitigated by excluding writer temporary directories from viewer
+discovery, not a claim of deterministic impossibility.
+
+## 19. Remaining risks
+
+The final authoritative workflow must still run on the commit containing this
+report. PWA installation proof remains browser-level rather than OS-level, as
+already recorded by Prompt 7. The final candidate SHA must be recorded outside
+the packaged tracked report to avoid changing the validated package.
+
+## 20. Final authoritative rerun requirement
+
+After this report is committed and pushed, a complete new workflow run must
+pass the candidate job and Windows, Linux, and macOS exact-candidate matrix
+jobs on the same commit. That run is the authoritative final readiness run.
+
+## 21. Next step after final PASS
+
+`v0.9.0 controlled release preparation:` bump the package from `0.8.1` to
+`0.9.0`, reconcile release-version documentation and changelog state, build and
+validate the exact `0.9.0` candidate, then perform the controlled tag/npm/GitHub
+release workflow.