@functional-systems/srcx 0.1.0-dev.1 → 0.1.0-dev.4

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## [0.1.0-dev.1] - 2026-09-25
 
 ### Added
 
@@ -17,4 +17,6 @@
 - Pending imports resume without the previous local build artifact.
 - Search/read `--version` selects the corpus instead of printing the CLI version.
 
-No npm release has been published yet.
+Initial npm bootstrap published to the `dev` channel from commit
+`f94f947bf593b2f8498c07e130933b0ab444f868`. This local bootstrap has no
+GitHub Actions provenance. No stable release has been published.

package/README.md

@@ -4,10 +4,21 @@ Version-aware code search on LambdaDB. Import a committed Git tree, search its
 chunks, and read exact source pinned to a validated immutable version.
 
 This is an experimental development CLI. Local fixture, fault-injection, SDK transport,
-and opt-in live acceptance checks are available. The npm package is prepared for
-publication but remains unpublished. See [VALIDATION.md](VALIDATION.md) for the latest observed results and
+and opt-in live acceptance checks are available. Development builds are available
+on npm under `@functional-systems/srcx@dev`. See [VALIDATION.md](VALIDATION.md) for the latest observed results and
 remaining scope, and [DESIGN.md](DESIGN.md) for the full design.
 
+## Install a development build
+
+Requires Node.js 22.14+ and Git. These are experimental prereleases; there is no
+stable release yet. Select the `dev` channel explicitly:
+
+```sh
+npm install -g @functional-systems/srcx@dev
+srcx --version
+srcx --help
+```
+
 ## Run locally
 
 Requires Node.js 22.14+ and Git. The initial preset uses lexical search with
@@ -27,11 +38,11 @@ artifacts. It does not contact LambdaDB. The model's lexical matching is a test
 convenience, not a Lucene implementation or a relevance benchmark.
 
 All commands return JSON, except help and errors. Use `node dist/cli.js` in this
-checkout; `srcx` is the configured executable name for future distribution.
+checkout, or `srcx` after installing the npm package.
 
 For development branches, CI, and installed-package checks, see
 [CONTRIBUTING.md](CONTRIBUTING.md). Version channels, first-publication steps, and
-the initially disabled npm automation are documented in [RELEASING.md](RELEASING.md).
+npm automation are documented in [RELEASING.md](RELEASING.md).
 The project is licensed under [Apache-2.0](LICENSE).
 
 ## Preview a committed version without credentials

package/RELEASING.md

@@ -2,12 +2,19 @@
 
 ## Current state
 
-The source is prepared as `@functional-systems/srcx@0.1.0-dev.1` under Apache-2.0.
-It has not been published to npm. `private: false` permits a reviewed first
-publication; it does not establish registry availability or distribution readiness.
-`NPM_DEV_PUBLISH_ENABLED` is initially `false`. No stable/rc release or Homebrew
-formula has been published. Local/live application evidence is in
-[VALIDATION.md](VALIDATION.md); it is separate from package publication evidence.
+The initial `@functional-systems/srcx@0.1.0-dev.1` package was published publicly
+from reviewed commit `f94f947bf593b2f8498c07e130933b0ab444f868`. Its exact tarball
+passed clean-install and live LambdaDB checks. The local bootstrap has no GitHub
+Actions provenance. npm created both `dev` and `latest` at that prerelease; select
+`@dev` explicitly. No stable/rc release or Homebrew formula has been published.
+
+The package-specific Trusted Publisher is configured for `lambdadb/srcx` and
+`publish.yaml`, with direct publication allowed. `NPM_DEV_PUBLISH_ENABLED=true`.
+The first successful [OIDC publication](https://github.com/lambdadb/srcx/actions/runs/36035063463/attempts/3)
+produced `0.1.0-dev.3` from the same commit and moved `dev` to that version.
+Provenance identifies this repository, workflow, commit, and run. The current
+`latest` remains the bootstrap prerelease `0.1.0-dev.1`; it is not a stable release.
+See [VALIDATION.md](VALIDATION.md) for registry and consumer verification.
 
 This workflow follows [LambdaDB CLI](https://github.com/lambdadb/lambdadb-cli/blob/develop/RELEASING.md).
 The repository keeps Prettier plus strict TypeScript checks as its existing lint
@@ -26,7 +33,8 @@ version entries in `package-lock.json` together, for example using
 `npm version VERSION --no-git-tag-version`. CLI `--version` reads package metadata.
 For explicit releases, add a dated `## [VERSION] - YYYY-MM-DD` changelog section.
 The GitHub tag must match the version, and the prerelease flag must match its channel.
-`latest`, not the tip of `main`, identifies the stable npm release.
+After the first stable release, `latest` identifies the stable npm release;
+the bootstrap exception is recorded above.
 
 The checked-in development base starts at `0.1.0-dev.1`. During an eligible push,
 `scripts/dev-release.mjs` replaces `N` with the full history's first-parent commit
@@ -64,7 +72,8 @@ Do not republish, overwrite versions, or move release tags to work around lag.
 
 ## First publication and Trusted Publisher setup
 
-Complete these steps from a reviewed, validated commit after this setup PR merges:
+The initial bootstrap is complete. The procedure below documents first-time setup
+and the checks required before declaring automatic publication operational:
 
 1. Verify npm ownership for the `functional-systems` scope and the package name.
    GitHub organization membership does not establish npm permissions.

package/VALIDATION.md

@@ -4,12 +4,55 @@ Date: 2026-09-25 (Asia/Seoul).
 
 ## Evidence boundary
 
-This implementation has passed local fixtures/fault injection/SDK transport checks
-and a live synthetic A/B acceptance run against the user-supplied LambdaDB
-connection. Only generated test source was uploaded. No production repository
-source or paid embeddings were used, and no Git repository/npm package was
-published. Live evidence below is limited to this small fixture; it is not a
-throughput, general concurrency, or retrieval-quality benchmark.
+This implementation has passed local fixtures/fault injection/SDK transport checks,
+a live synthetic A/B acceptance run, and an exact-package self-index of the public
+srcx repository against the user-supplied LambdaDB connection. No private source
+or paid embeddings were used. These checks are not a throughput, general
+concurrency, or retrieval-quality benchmark. npm publication evidence is recorded
+separately below.
+
+## Initial npm package and live self-index
+
+The exact `0.1.0-dev.1` tarball from merged commit
+`f94f947bf593b2f8498c07e130933b0ab444f868` passed clean installation, CLI execution,
+WASM parsing, and the loopback import/search/read contract. Its installed CLI then
+imported that same Git commit into LambdaDB: **37 files, 260 chunks**, with
+inventory, content, and query validation passing. A `validateBuild` query returned
+three results from `src/build.ts`; the full-file read matched the pinned Git blob
+byte for byte. This was a lexical-only import (`embedding=none`).
+
+The first npm publication used this tested tarball with the `dev` dist-tag. The
+registry tarball's SHA-512 matched the candidate, and a clean installation of the
+downloaded registry tarball passed the same CLI contract. Registry signatures are
+present. The local bootstrap has no GitHub Actions provenance. npm also created
+`latest=0.1.0-dev.1`; that tag does not represent a stable release.
+
+Local evidence is retained under `.srcx/releases/0.1.0-dev.1-f94f947/` (ignored),
+including `candidate.json`, `live-publication.json`, `live-verification.json`,
+`registry-version.json`, and the exact candidate and downloaded tarballs.
+The source commit's [Node 22/24 CI](https://github.com/lambdadb/srcx/actions/runs/36035063463)
+also passed. Current distribution and automation status is in
+[RELEASING.md](RELEASING.md).
+
+## First automatic development publication
+
+[CI attempt 3](https://github.com/lambdadb/srcx/actions/runs/36035063463/attempts/3)
+published `0.1.0-dev.3` using npm Trusted Publishing from the same reviewed commit.
+The version suffix is the first-parent commit count. The registry's `gitHead`
+and SLSA provenance both identify `f94f947bf593b2f8498c07e130933b0ab444f868`;
+provenance also identifies `lambdadb/srcx`, `.github/workflows/publish.yaml`, and
+the GitHub-hosted workflow run. The downloaded tarball's SHA-512 matches registry
+metadata. A clean install by package name/version passed CLI execution and the
+loopback import/search/read contract. `npm audit signatures` verified all eight
+installed registry signatures and three attestations, including srcx provenance.
+`dev=0.1.0-dev.3`; `latest=0.1.0-dev.1` remains the bootstrap prerelease.
+
+The initial automatic attempt stopped during the pre-write metadata lookup while
+npm's full package listing still returned 404. After the listing became visible,
+only the failed publishing job was rerun. No publication write was retried to
+work around propagation. Local evidence is retained in `registry-dev3.json`,
+`attestations-dev3.json`, and `provenance-dev3.json` under the release directory
+above. No stable release, GitHub Release, or Homebrew formula was created.
 
 ## Local checks
 
@@ -76,11 +119,9 @@ The test suite covers:
   reruns. Simulated registry delays/failures verify bounded post-write reads and
   no automatic publication retry; no test writes to npm.
 
-Release infrastructure is prepared in `.github/workflows/publish.yaml` for Node
-22/24. Local validation does not establish GitHub Actions or npm publication
-success. Initial npm registration, package-specific Trusted Publisher setup, and
-enabling `NPM_DEV_PUBLISH_ENABLED` remain separate release steps. See
-[RELEASING.md](RELEASING.md); no npm or Homebrew release was performed in this setup.
+Release infrastructure is in `.github/workflows/publish.yaml` for Node 22/24.
+The local checks above are distinct from the CI, npm, and live-service evidence
+recorded separately. No stable/rc or Homebrew release has been performed.
 
 The demo writes [.srcx/demo-report.json](.srcx/demo-report.json). That generated
 report identifies the retained synthetic repository, A/B build artifacts, counts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@functional-systems/srcx",
-  "version": "0.1.0-dev.1",
+  "version": "0.1.0-dev.4",
   "private": false,
   "description": "Version-aware code search on LambdaDB",
   "type": "module",
@@ -54,5 +54,6 @@
   "bugs": {
     "url": "https://github.com/lambdadb/srcx/issues"
   },
-  "license": "Apache-2.0"
+  "license": "Apache-2.0",
+  "gitHead": "9612cf3c342dbcf898b0ed8ca1526c0c3a04648f"
 }