@mean-weasel/lineage 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.1.3
+
+- Add a managed Swissifier rich-demo media download flow that verifies the release archive and restored PNG checksums before loading the demo.
+- Add durable local startup helpers and default Lineage CLI hosts for `lineage.localhost` and `lineage-dev.localhost`.
+- Ship the lightweight Swissifier fixture manifest while keeping generated demo media outside git and package contents.
+
+## 0.1.2
+
+- Fix packaged Lineage handoff commands so copied `next`, `inspect`, and `link-child` commands run through the published package.
+- Add packaged CLI regression coverage for custom SQLite database handoffs.
+
 ## 0.1.1
 
 - Fix first-run demo lineage loading and catalog-root lineage workspace creation.

package/README.md

@@ -4,14 +4,21 @@ Lineage is a local-first workspace for reviewing creative assets, branching vari
 
 ## Package Channels
 
-Lineage is packaged as `@mean-weasel/lineage`. Use the stable npm tag when you want the current public package, and use the `next` tag when you intentionally want a development channel build:
+Lineage is packaged as `@mean-weasel/lineage`. Use `latest` for the stable dogfood or production install, and use `next` when you intentionally want the development or release-candidate channel:
 
 ```bash
-npm install -g @mean-weasel/lineage
+npm install -g @mean-weasel/lineage@latest
 npm install -g @mean-weasel/lineage@next
 ```
 
-The stable and development channels are intended to coexist conceptually, with `lineage` for stable installs and `lineage-dev` for development installs. The current public package includes the CLI bridge bins for help and version checks:
+The stable and development channels are intended to coexist conceptually:
+
+- `latest` is the version you should trust for day-to-day dogfooding.
+- `next` is the version to test before promotion.
+- `lineage` runs with stable runtime defaults.
+- `lineage-dev` runs with development runtime defaults.
+
+The package includes both CLI bridge bins for help and version checks:
 
 ```bash
 lineage --help
@@ -27,12 +34,26 @@ lineage start
 lineage-dev start
 ```
 
-By default, `lineage start` listens on `127.0.0.1:5197` and stores SQLite state in a stable Lineage runtime directory. `lineage-dev start` listens on `127.0.0.1:5198` and uses a separate development SQLite file. Override those defaults with `--port`, `--host`, `--db`, or `LINEAGE_HOME`:
+By default, `lineage start` listens on `lineage.localhost:5197` and stores SQLite state in a stable Lineage runtime directory. `lineage-dev start` listens on `lineage-dev.localhost:5198` and uses a separate development SQLite file. Override those defaults with `--port`, `--host`, `--db`, or `LINEAGE_HOME`:
 
 ```bash
 lineage start --port 6123 --db ~/.lineage/lineage.sqlite
 ```
 
+## Codex Plugin
+
+The versioned Codex plugin lives in `plugins/lineage-codex-plugin`. Install the
+plugin that matches the resolved `@mean-weasel/lineage` package version with:
+
+```bash
+npx @mean-weasel/lineage-plugin-installer install --channel latest
+```
+
+The installer verifies the plugin artifact checksum and rejects plugin manifests
+whose version or `lineage.version` does not exactly match the resolved Lineage
+package version. The plugin artifact and installer package are released from
+this public repository.
+
 ## Local Development
 
 ```bash
@@ -43,9 +64,32 @@ npm run ci
 
 `npm run dev` starts the local development server from source. `npm run ci` runs the full local verification gate.
 
+## Command Shortcuts
+
+The root `Makefile` provides memorable wrappers for common setup, startup, and
+verification commands. Run `make` or `make help` to list the available targets.
+
+```bash
+make install-prod
+make install-plugin-prod
+make start-prod
+make check
+make smoke
+```
+
+The Makefile is only a convenience layer. npm scripts, the packaged CLIs, and
+GitHub release workflows remain the source of truth for build, test, and release
+behavior.
+
 ## Release Checks
 
-Use `next` for dogfooding builds and `latest` for the stable public channel:
+Use `next` for candidate builds and `latest` for the stable public channel. Check the current local, npm, and workflow state with:
+
+```bash
+npm run release:status
+```
+
+For local release validation:
 
 ```bash
 npm run release:dry-run -- --tag next
@@ -54,7 +98,15 @@ npm run release:dry-run -- --tag latest
 npm run release:latest
 ```
 
-The release script verifies package metadata, changelog version coverage, public-readiness scans, install smoke, browser smoke, audit, and package contents before publishing. GitHub Actions runs CI on pull requests and `main`; publishing is manual through the Release workflow using npm trusted publishing and provenance. The GitHub workflow publishes new dogfood versions to `next` and new stable versions to `latest`. `release:promote-latest` is kept for authenticated local/package-owner dist-tag maintenance, but the token-free trusted publishing path uses immutable publishes instead of mutating dist-tags.
+The release script verifies package metadata, changelog version coverage, public-readiness scans, install smoke, browser smoke, audit, and package contents before publishing. GitHub Actions runs CI on pull requests and `main`; publishing is manual through the Release workflow.
+
+Use the Release workflow operations this way:
+
+- `publish-next`: publish the current package version to npm with the `next` dist-tag using trusted publishing and provenance.
+- `promote-latest`: move the already-published `next` version to `latest` after dogfooding. This uses the repository `NPM_TOKEN` secret and refuses to promote unless npm's `next` tag points at the local package version.
+- `publish-latest`: publish the current package version directly to `latest` using trusted publishing and provenance, reserved for cases where the version should skip the `next` channel.
+
+The normal cadence is: bump version and changelog, merge to `main`, run `publish-next`, install or run `@mean-weasel/lineage@next`, dogfood it, then run `promote-latest`. After promotion, both npm tags point to the same version until the next development version is published to `next`.
 
 ## Demo Fixture
 
@@ -62,6 +114,20 @@ Source checkouts and installed packages include a synthetic public demo catalog
 
 If you create a real `demo-project/assets/catalog.json`, that root project catalog overrides the packaged fixture. The fixture keeps S3-shaped metadata for realistic catalog structure, but default previews are generated local SVG data URLs and do not call storage.
 
+Lineage also includes a lightweight Swissifier rich-demo manifest at `fixtures/demo-project/lineage/swissifier-rich-demo.json`. The manifest stores only synthetic metadata, checksums, graph edges, layout positions, and selected next-variation bases. It does not include generated PNG media or any local SQLite state.
+
+To hydrate the Swissifier demo with real images, use the Demo seed menu's Swissifier `Download media` control. Lineage downloads `swissifier-rich-demo-v1.tar.gz` from the [v0.1.2 GitHub release](https://github.com/mean-weasel/lineage/releases/tag/v0.1.2), verifies the archive checksum, safely unpacks the PNGs into local scratch storage, and then verifies each PNG checksum before loading the rich demo.
+
+For manual verification or offline restore, the expected archive checksum is:
+
+```sh
+shasum -a 256 swissifier-rich-demo-v1.tar.gz
+```
+
+`24edc5307d0932ddc8a151c6a8c1001a08c45075e3ae198082038c44519be0de`
+
+The previous manual path remains available: unpack the media pack yourself, set `LINEAGE_SWISSIFIER_MEDIA_DIR` to that folder, then use the Demo seed menu to restore media and load Swissifier.
+
 ## Data And Privacy
 
 Lineage stores local workspace state in a SQLite database on your machine. Public fixtures are synthetic and must not contain private names, credentials, presigned URLs, real customer content, private campaign data, or real media. Keep private catalogs and media outside public package fixtures.