@outcomeeng/spx 0.6.3 → 0.6.6

package/README.md

@@ -54,7 +54,7 @@ spx validation literal           # Source/test literal reuse detection
 # Scope and targeting
 spx validation all --scope production        # Exclude tests/scripts
 spx validation all --fix                     # Auto-fix across all checks
-spx validation all --files src/session/      # Validate specific files or directories
+spx validation all src/session/              # Validate specific files or directories
 ```
 
 All validation commands support `--quiet` for CI and `--json` for machine-readable output.
@@ -170,18 +170,29 @@ A Lefthook **pre-push** hook runs `sonar analyze --base origin/main` so SonarQub
 
 The project uses GitHub Actions for continuous integration and publishing:
 
-- `ci.yml` — Runs validate, test, and build on Node 22 and 24 for every push to `main` and every pull request. Includes dependency review to block PRs introducing vulnerable dependencies.
-- `publish.yml` — Triggered by `v*` tags. Uses OIDC Trusted Publishing (no stored npm tokens) with Sigstore provenance attestation. Requires manual approval via the `npm-publish` GitHub Environment.
+- `deterministic-verification.yml` — Runs the deterministic verification suite (validation, circular dependencies, tests with the status projection, and packaged-CLI checks) as parallel jobs on Node 24 for every push to `main` and every pull request, skipping root instruction docs. Includes dependency review on pull requests to block PRs introducing vulnerable dependencies.
+- `agentic-verification.yml` — Runs agentic verification (audit and review) over each pull request.
+- `publish.yml` — Triggered by `v*` tags. Gates on `deterministic-verification.yml` and publishes its verified build via OIDC Trusted Publishing (no stored npm tokens) with Sigstore provenance attestation. Requires manual approval via the `npm-publish` GitHub Environment.
 - `scorecard.yml` — Weekly OpenSSF Scorecard assessment, results published to the GitHub Security tab.
 
 ### Publishing a Release
 
-1. Run `pnpm run publish:check`
-2. Bump the version in `package.json`
-3. Commit and tag: `git tag vX.Y.Z`
-4. Push: `git push origin main && git push origin vX.Y.Z`
-5. Approve the deployment in the GitHub Actions `npm-publish` environment
-6. Verify provenance with `npm audit signatures`
+1. Sync `main` with `origin/main`: `git pull --ff-only origin main`
+2. Bump the version with `pnpm version patch --no-git-tag-version`, unless the
+   release request specifies `minor`, `major`, or an exact version
+3. Run `pnpm run publish:check`
+4. Commit and tag:
+   `git add package.json`
+   `git commit -m "build(release): bump version to X.Y.Z"`
+   `git tag vX.Y.Z`
+5. Push: `git push origin main && git push origin vX.Y.Z`
+6. Approve the deployment in the GitHub Actions `npm-publish` environment
+7. Confirm the published version and provenance:
+
+```bash
+npm view @outcomeeng/spx version
+npm audit signatures
+```
 
 ## Technical Stack