@functional-systems/lambdadb-cli 0.1.3 → 0.1.4-dev.16

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+### Maintenance
+
+- Synchronize the 0.1.3 release history and start the 0.1.4 development line.
+- Prepare the Homebrew formula for verified stable 0.1.3 and record publication evidence.
+
 ## [0.1.3] - 2026-10-06
 
 ### Added

package/README.md

@@ -19,7 +19,7 @@ lambdadb --help
 ```
 
 For reproducible CI runs, pin an exact published version such as
-`@functional-systems/lambdadb-cli@0.1.2`. To try development builds, explicitly use
+`@functional-systems/lambdadb-cli@0.1.3`. To try development builds, explicitly use
 `@functional-systems/lambdadb-cli@dev`; this moving channel contains prereleases.
 Installed CLIs do not update themselves. See
 [RELEASING.md](RELEASING.md#current-status) for release status and

package/RELEASING.md

@@ -2,17 +2,25 @@
 
 ## Current status
 
-CLI 0.1.3 is prepared on `release/0.1.3` from reviewed develop commit
-`caee1bcb6ce864c33647673b54a48f7cc06dcf84` ([PR #18](https://github.com/lambdadb/lambdadb-cli/pull/18)).
-It pins SDK 0.8.0 and adds Bayesian JSON queries, native embedding configuration
-and Collection index updates. Existing search defaults and error/output contracts
-are preserved. See [candidate validation](VALIDATION.md#cli-013-release-preparation-2026-10-06).
-This is release preparation; stable npm and the public Homebrew tap remain at
-0.1.2. Merge the release PR with a merge commit to preserve develop ancestry.
-Tag creation, GitHub Release publication and npm latest promotion require the
-explicit authorization described below.
-
-### Latest published stable release
+CLI 0.1.3 was published on 2026-10-06 from merged main commit
+`90628ed3648aea0ae381c061a95aebbbf48e9259` through
+[GitHub Release v0.1.3](https://github.com/lambdadb/lambdadb-cli/releases/tag/v0.1.3)
+and the [successful OIDC workflow](https://github.com/lambdadb/lambdadb-cli/actions/runs/37466450036).
+It pins SDK 0.8.0 and adds Bayesian queries, native embedding configuration and
+Collection index updates, preserving existing query defaults and error/output contracts.
+
+An independent unqualified npm installation selected 0.1.3 and SDK 0.8.0, passed
+all 54 CLI contracts and verified integrity, four registry signatures and three
+attestations. Decoded provenance identifies the release commit, tag and workflow.
+The published tarball is byte-identical to the reviewed candidate, whose installed
+runtime passed development-service validation. At verification, latest=0.1.3 and
+dev=0.1.3-dev.15. See [publication evidence](VALIDATION.md#cli-013-publication-2026-10-06).
+
+The post-release synchronization starts the `0.1.4-dev.1` development base and
+prepares the 0.1.3 Homebrew formula. The public tap remains at 0.1.2 until its
+separate PR is reviewed and merged; CLI publication does not update that tap.
+
+## CLI 0.1.2 publication
 
 CLI 0.1.2 was published on 2026-10-04 from merged main commit
 `6628fe0ed1f405c88fbd91d591e5223d3250dd73` through

package/VALIDATION.md

@@ -1,5 +1,58 @@
 # Validation record
 
+## CLI 0.1.3 publication (2026-10-06)
+
+With explicit release authorization, annotated tag `v0.1.3` was created on main
+commit `90628ed3648aea0ae381c061a95aebbbf48e9259` and the stable
+[GitHub Release](https://github.com/lambdadb/lambdadb-cli/releases/tag/v0.1.3)
+triggered [OIDC publication](https://github.com/lambdadb/lambdadb-cli/actions/runs/37466450036).
+The workflow succeeded on attempt 1, repeating Node 22/24 validation and
+installed-tarball tests before publishing the exact tested artifact.
+
+- Registry reads confirmed `latest=0.1.3`, `dev=0.1.3-dev.15`.
+- `node /tmp/lambdadb-cli-release013/main/verify-publication.mjs` fetched registry
+  metadata, downloaded the tarball and verified its SHA-512 integrity. Its bytes
+  exactly match the final reviewed main candidate described below.
+- A clean, unqualified `npm install --prefer-online --cache <isolated-cache>
+  --no-audit --no-fund @functional-systems/lambdadb-cli` selected CLI 0.1.3 and
+  SDK 0.8.0. Version and query/update help passed. All 54 CLI contract tests
+  executed against this registry-installed binary, with no failures or skips.
+- `npm audit signatures --prefer-online --cache <isolated-cache>` verified four
+  registry signatures and three attestations. The isolated cache avoids stale
+  local npm metadata; the user's global installation was not changed.
+- Decoded [SLSA provenance](https://registry.npmjs.org/-/npm/v1/attestations/@functional-systems%2flambdadb-cli@0.1.3)
+  matches the downloaded artifact's digest, release commit, `refs/tags/v0.1.3`,
+  repository and `.github/workflows/publish.yaml` run 37466450036.
+- The registry's full metadata, npm installation metadata and signature lookup
+  became visible at different times. Initial reads returned 404, selected the
+  older latest package or returned ETARGET during audit. Only reads and isolated
+  installation were retried; publication was not repeated and no tag was moved.
+
+Published tarball SHA-256:
+`ef98f935c5274ee6b4c7991669e46648fee4070a1105b1a265df6a6faf791b07`.
+Its SHA-512 integrity is
+`sha512-vgS5U+dVBVpjpi1KVhHr6XL/VPj6gJ3nHxWg8osGwK2ZiDP8CzZ4o3ebMzEP13Pg+G98akZKTiitiM2prvCWsw==`.
+The matching immutable release `package-lock.json` has SHA-256
+`4e1a5028be3b610e3c55f2e91954270ae767e1d958810a3ac469f056f82d1c81`.
+These values prepare the 0.1.3 Homebrew formula; they do not publish the public tap.
+`bash scripts/test-homebrew.sh` passed locally on macOS arm64: formula style,
+installation, brew test, wrapper isolation from ambient Node and all 54 released
+CLI contracts. The test uninstalled its CLI and removed its disposable tap.
+This was a fresh local installation, not an existing-user upgrade.
+
+The post-release PR brings main history into develop, starts `0.1.4-dev.1`, and
+updates publication records and the local Homebrew formula. Source/query behavior
+is unchanged. Homebrew CI results are recorded in that PR; the public tap still
+serves 0.1.2 pending its separate reviewed update. No production validation,
+server deployment, billing verification or new search-default promotion occurred.
+The installed-candidate live smoke and verified Collection cleanup below remain
+applicable because the published runtime is byte-identical.
+
+Sanitized original logs, registry metadata, provenance, the publication tarball
+and the isolated consumer are retained under `/tmp/lambdadb-cli-release013/main/`.
+No scratch artifacts or credentials are committed.
+
+
 ## CLI 0.1.3 release preparation (2026-10-06)
 
 Prepared from reviewed develop `caee1bcb6ce864c33647673b54a48f7cc06dcf84`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@functional-systems/lambdadb-cli",
-  "version": "0.1.3",
+  "version": "0.1.4-dev.16",
   "private": false,
   "description": "Project-scoped LambdaDB command-line tools",
   "type": "module",
@@ -52,5 +52,6 @@
   "bugs": {
     "url": "https://github.com/lambdadb/lambdadb-cli/issues"
   },
-  "license": "Apache-2.0"
+  "license": "Apache-2.0",
+  "gitHead": "bf7bb3abd26ef1f77d198b1ddee40509fc98100e"
 }