@functional-systems/lambdadb-cli 0.1.1 → 0.1.2-dev.11

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+### Fixed
+
+- A successful development publication no longer fails CI solely because registry
+  visibility exceeds the verification budget. Report a warning and explicit
+  `published-verification-pending` result; retain failures for publish errors,
+  invalid responses, authentication and artifact mismatches. Never retry writes.
+
+### Maintenance
+
+- Synchronize the 0.1.1 release history and start the 0.1.2 development line.
+- Prepare the Homebrew formula for verified stable 0.1.1 and record npm publication evidence.
+
 ## [0.1.1] - 2026-09-29
 
 ### Added

package/README.md

@@ -1,7 +1,7 @@
 # LambdaDB CLI
 
 A first, project-scoped CLI for developers, coding agents and CI. It uses
-`@functional-systems/lambdadb@0.5.1` for authentication, HTTP, read retries,
+`@functional-systems/lambdadb@0.6.0` for authentication, HTTP, read retries,
 pagination, bulk transfers and large response downloads.
 
 ## Install and run
@@ -19,7 +19,7 @@ lambdadb --help
 ```
 
 For reproducible CI runs, pin an exact published version such as
-`@functional-systems/lambdadb-cli@0.1.0`. To try development builds, explicitly use
+`@functional-systems/lambdadb-cli@0.1.1`. To try development builds, explicitly use
 `@functional-systems/lambdadb-cli@dev`; this moving channel contains prereleases.
 Installed CLIs do not update themselves. See
 [RELEASING.md](RELEASING.md#current-status) for release status and

package/RELEASING.md

@@ -1,24 +1,24 @@
 # Releasing LambdaDB CLI
 
-## 0.1.1 release candidate
-
-The `release/0.1.1` branch prepares a stable CLI release from develop
-`a65a2b198b484d2e4da4ca2ff438779806a87cce` (SDK 0.6.0 integration, PR #11).
-Version 0.1.1 retains the CLI command, JSON-envelope and exit-code contracts while
-adding optional keyword facets and the expanded SDK analyzer set.
-
-This is release preparation, not publication. Promote the reviewed release branch
-to `main` with a merge commit. After approval for publication, tag the verified
-main commit `v0.1.1` and publish a non-prerelease GitHub Release. The existing
-release workflow selects npm `latest`. Verify the exact package, provenance and
-installed CLI before updating the Homebrew formula/tap, which still selects 0.1.0.
-Synchronize release-only main history back into develop with the next development
-base (`0.1.2-dev.1`) through a separate PR.
-
-Facets require a supporting server and newly built keyword indexes. This release
-does not migrate existing Collections, update old indexes or upgrade installed
-CLIs automatically. Release-candidate evidence belongs in [VALIDATION.md](VALIDATION.md)
-and the promotion PR; do not treat earlier SDK integration tests as publication proof.
+## Current status
+
+CLI 0.1.1 was published on 2026-09-29 through
+[GitHub Release v0.1.1](https://github.com/lambdadb/lambdadb-cli/releases/tag/v0.1.1)
+and the [OIDC release workflow](https://github.com/lambdadb/lambdadb-cli/actions/runs/36557578359).
+Tag/main commit `80a4c10628ad2ad4ebf8d90a01924d27dcb4a790` has the same tree as
+reviewed candidate `0291970`. The workflow passed on attempt 1, including Node
+22/24 validation and tests of the exact publication tarball.
+
+Registry reads confirmed `latest=0.1.1`, while `dev=0.1.1-dev.10` remained unchanged.
+A clean unqualified npm installation selected CLI 0.1.1 and SDK 0.6.0, passed all
+40 CLI contracts and verified registry signatures and attestations. The published
+tarball is byte-identical to the tested final candidate; provenance identifies the
+release commit, tag and workflow. See [VALIDATION.md](VALIDATION.md#cli-011-publication).
+
+The post-release branch synchronizes main history into develop with `0.1.2-dev.1`
+and prepares the 0.1.1 Homebrew formula. The public tap update requires its separate
+review and merge. Facets still require a supporting server and newly built keyword
+indexes; publication does not migrate Collections or upgrade installed CLIs.
 
 ## Prior publication status
 
@@ -120,11 +120,13 @@ artifact conflicts remain fatal. Process termination or scheduling can delay
 reporting, but responses at or after the deadline cannot pass verification.
 
 The script reports successful publication before waiting. If propagation still
-exceeds the budget, it emits `result=published-verification-pending` and exits
-nonzero. This means the write succeeded but verification is incomplete; it does
-not authorize another publish. Retry registry reads first. Once the manifest and
-dev tag agree, rerun the failed job: an identical artifact reports
-`result=already-published` without another write. Newer dev versions and stale
+exceeds the budget, it emits `result=published-verification-pending`, a GitHub
+warning and a job summary, then exits successfully. This means publication
+succeeded but registry visibility is unverified. It does not authorize another
+publish or establish that installation/Homebrew updates can proceed. Retry reads
+before those downstream actions. Actual publish failures, authentication/schema
+errors and artifact mismatches still fail the job. Once the manifest and dev tag
+agree, an explicit rerun reports `result=already-published` without another write. Newer dev versions and stale
 commits are skipped without changing tags. A failed publish remains an uncertain
 write and is never automatically retried.
 

package/VALIDATION.md

@@ -3,6 +3,40 @@
 Updated: 2026-09-29. Local contract tests use loopback servers and synthetic
 credentials. Authenticated development-project evidence is recorded separately.
 
+## CLI 0.1.1 publication
+
+On 2026-09-29, [release v0.1.1](https://github.com/lambdadb/lambdadb-cli/releases/tag/v0.1.1)
+was published from tag/main commit `80a4c10628ad2ad4ebf8d90a01924d27dcb4a790`,
+whose tree equals candidate `0291970`. The
+[release workflow](https://github.com/lambdadb/lambdadb-cli/actions/runs/36557578359)
+passed on attempt 1, including Node 22/24 and exact publication-artifact tests.
+
+- Registry reads confirmed `latest=0.1.1`, `dev=0.1.1-dev.10`. The stable tarball
+  matches the final tested candidate byte-for-byte. SHA-512 integrity:
+  `sha512-5eYw4NSCDPQrJZVDwfAg9cPtdSuipPy6/FzTj08EDn94/rRJEFLb0Meih2hzbzOSqvNLOn+MJD8Ij0a+nXe99A==`.
+- Decoded provenance identifies the same release commit, `refs/tags/v0.1.1`,
+  `.github/workflows/publish.yaml`, run `36557578359`, attempt 1; its subject digest
+  matches the downloaded tarball. Stable metadata does not expose `gitHead`, so
+  source identity is established by provenance and the artifact comparison.
+- A clean unqualified consumer install selected CLI 0.1.1 and SDK 0.6.0 and passed
+  all 40 CLI contracts. `npm audit signatures` verified all four packages' registry
+  signatures and three packages' attestations. No publication was retried.
+- Credentialed live evidence remains the installed-candidate smoke below; no new
+  live call was needed for byte-identical published runtime/package contents.
+- The prepared Homebrew formula pins the verified 0.1.1 tarball and lockfile from
+  `80a4c10628ad2ad4ebf8d90a01924d27dcb4a790`. Local macOS checks passed formula
+  style, installation, `brew test`, managed Node selection and all 40 installed
+  CLI contracts. The harness removed its temporary installation and tap. Remote
+  tap publication and upgrade behavior await the separate tap PR.
+
+Post-release development changes preserve this release and start `0.1.2-dev.1`.
+The registry-verification change passes 13 focused tests, including the real script
+entrypoint with a synthetic npm command: successful publication plus timeout exits
+0 with an Actions warning/summary, while failed publication exits 1. Transient
+read failures remain bounded; authentication, schema and artifact mismatches fail.
+No live publication was used to test that change. The full local suite passed 65
+tests and the installed-package suite passed 40.
+
 ## CLI 0.1.1 release preparation
 
 On 2026-09-29, candidate commit `6f7bb23` prepared stable metadata from develop

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@functional-systems/lambdadb-cli",
-  "version": "0.1.1",
+  "version": "0.1.2-dev.11",
   "private": false,
   "description": "Project-scoped LambdaDB command-line tools",
   "type": "module",
@@ -52,5 +52,6 @@
   "bugs": {
     "url": "https://github.com/lambdadb/lambdadb-cli/issues"
   },
-  "license": "Apache-2.0"
+  "license": "Apache-2.0",
+  "gitHead": "3903531fe9a269d394fd43c833ed14840a86958e"
 }