@macula-io/martha 1.0.0 → 1.0.1

package/README.md

@@ -1,6 +1,17 @@
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/macula-io/martha/main/assets/martha-full-dark.svg">
+    <img src="https://raw.githubusercontent.com/macula-io/martha/main/assets/martha-full-light.svg" alt="Macula Martha" width="320">
+  </picture>
+</p>
+
 # @macula-io/martha
 
-Installs [Martha](https://github.com/macula-io/martha) from its signed public package, with nothing but Node.
+**Goal:** one developer, or a whole team, runs a crew of coding agents that plans, builds, reviews and releases
+software, with one method and one tool.
+
+This is the installer for [Martha](https://github.com/macula-io/martha): it installs Martha from its signed public
+package, with nothing but Node.
 
 ```sh
 npx -y --ignore-scripts @macula-io/martha@<exact version> [<martha version>]
@@ -34,26 +45,8 @@ martha-install [<version>] [--downgrade] [--digest sha256:<hex>]
 
 ## How a release is made
 
-1. The release dry run (`release-dry-run.yml`, started by hand on a branch) pushes the packed tree into the release
-   package under a `dry-run-<run>-<attempt>` tag, which is never a version, so no install ever takes it. It signs it
-   through the same signing workflow, then checks that the signature verifies for that branch and is refused for
-   `refs/tags/v<version>`, that an unsigned image is refused, and that the layer is exactly the committed tree.
-   Its two tags are kept in the public package, not pruned: one pair per run, and runs are started by hand.
-   Neither is ever installed: no tag of that shape is a version, and the signature is for a branch, so an install,
-   which demands `refs/tags/v<version>`, refuses it. Pruning would need a workflow that can delete package versions,
-   and none of Martha's workflows holds that power. A maintainer may delete old ones by hand in the package settings.
-2. The first dry run is what makes the release package. The maintainers then link it to this repository and make it
-   public, before any release tag: every install pulls anonymously, and a refused pull must never read as
-   "unsigned".
-3. `installer-v<version>` publishes this installer to npm, with provenance, through trusted publishing.
-4. `v<version>` publishes a signed Martha release into the package, pinning that installer.
-
-Neither tag publishes while a dependency of Martha or of this installer carries a known published advisory
-(`advisories.yml`, which also runs on every pull request). An advisory is fixed or waived by a dated, named, expiring
-row in `.github/advisories-waivers.txt`; there is no baseline. The `overrides` in `package.json` are such fixes:
-sigstore 5.0.0 resolves glob 13 and minimatch 10, which carry GHSA-3g3m-2fjr-6pw4 and GHSA-g3hv-75wg-m249, so the
-installer pins their first patched releases. Its callers use only `glob(pattern, options)` and
-`minimatch(path, pattern)`, which both majors keep. Drop an override once sigstore resolves a patched release itself.
+For maintainers: how a release is built, signed and published, and what stops one, is in
+[the repository's docs](https://github.com/macula-io/martha/tree/main/docs), in `how-a-release-is-made.md`.
 
 ## License
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@macula-io/martha",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@macula-io/martha",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "bundleDependencies": [
         "sigstore"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@macula-io/martha",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Install Martha from its signed public package: verifies the release's sigstore signature, then installs it",
   "type": "module",
   "license": "Apache-2.0",