@research-engineering/agentic-proofkit 0.1.136 → 0.1.137

package/BACKLOG.md

@@ -66,7 +66,7 @@ only when these criteria are satisfied or explicitly retired by owner decision:
 | DONE | IMPORT-05 | Historical design and plan cleanup | Durable claims from pre-cutover design and implementation-plan work are represented by deterministic specs, proof bindings, tests, package-public docs, or open backlog rows. No source-repository design documents or implementation plans are retained as current authority. |
 | DONE | IMPORT-06 | Remaining source-local code delta audit | Non-document source comparison found no old source file missing from the public source tree. Old source bytes remain candidate evidence only and are not imported over current hardening. |
 | DONE | RELEASE-01 | Public source release | `v0.1.135` was published from this public repository through npm Trusted Publisher, post-publish npm registry identity was captured, root-only installed-package proof passed, and GitHub Release assets were published. PyPI publication and GitHub artifact attestations were skipped by explicit optional-channel policy and are not claimed. |
-| OPEN | RELEASE-02 | Scoped npm package identity | Source is staged for `@research-engineering/agentic-proofkit@0.1.136` while preserving the `agentic-proofkit` CLI binary and Python package identities. Completion requires scoped npm Trusted Publisher configuration, a `v0.1.136` release from public source, post-publish scoped npm registry identity, root-only installed-package JSON CLI ABI proof, and an explicit compatibility or deprecation disposition for the unscoped npm package. |
+| OPEN | RELEASE-02 | Scoped npm package identity | `@research-engineering/agentic-proofkit@0.1.136` created the scoped public package namespace and Trusted Publisher settings without claiming workflow release provenance. Source is staged for `@research-engineering/agentic-proofkit@0.1.137` while preserving the `agentic-proofkit` CLI binary and Python package identities. Completion requires a `v0.1.137` release from public source through the scoped Trusted Publisher path, post-publish scoped npm registry identity, root-only installed-package JSON CLI ABI proof, and an explicit compatibility or deprecation disposition for the unscoped npm package. |
 | DONE | SECURITY-01 | Provider security settings | Repository is public with collaborator-only PR creation, public issues, squash-only merges, branch protection on `main`, strict required CI, CodeQL, OSV source advisory scanning, Scorecard, Dependabot security updates, secret scanning, and push protection. Non-provider secret patterns and validity checks remain unavailable or disabled under the current provider plan and are not claimed. |
 | DONE | CONSUMER-01 | Public-package consumer proof | A private first consumer repository consumed exact public npm `agentic-proofkit@0.1.134` through its repository-owned external-consumer gate. The proof installed the package into an isolated temporary consumer, matched the admitted tarball integrity and shasum, proved lockfile resolution was not workspace based, ran installed CLI `self-check`, `witness-plan`, and `release-authority`, proved rollback by removing the dependency from the temporary lockfile, and preserved consumer-owned native witness authority. |
 | DONE | CONSUMER-02 | Second-consumer pilot | A private topology-distinct Python/FastAPI consumer module was run through explicit-input warn-mode `gradual-adoption-guidance` and `--agent-envelope` pilot records. Proofkit admitted the caller-owned route, reported one advisory candidate boundary, reported two missing proof-binding rule IDs as warnings, emitted route/bind/modernize/verify/promote agent actions, and kept enforcement blocked until consumer owners admit stable requirements and proof bindings. No generic Proofkit blocker was confirmed. |

package/README.md

@@ -13,10 +13,10 @@ packets without copying verifier logic between projects.
 | Surface | State |
 |---|---|
 | Source visibility | Public |
-| Current layer | Public source with admitted unscoped npm release evidence; scoped npm identity is staged for the next release |
+| Current layer | Public source with admitted unscoped npm release evidence; scoped npm identity has a bootstrap namespace release and is staged for Trusted Publisher release evidence |
 | Runtime implementation | Go CLI with npm and Python wrapper packaging |
-| Package release | `agentic-proofkit@0.1.135` is admitted; `@research-engineering/agentic-proofkit@0.1.136` is pending release evidence |
-| Public-source provenance | Admitted for `v0.1.135`; scoped package provenance is pending a reviewed scoped release |
+| Package release | `agentic-proofkit@0.1.135` is admitted; `@research-engineering/agentic-proofkit@0.1.136` is bootstrap-published; `@research-engineering/agentic-proofkit@0.1.137` is pending release evidence |
+| Public-source provenance | Admitted for `v0.1.135`; scoped package Trusted Publisher provenance is pending a reviewed scoped release |
 | License | MIT |
 
 ## Project Boundary

package/docs/release-process.md

@@ -121,11 +121,12 @@ The `release` workflow must:
 
 1. verify source package identity;
 2. run the package gate;
-3. build publish dry-run evidence;
+3. build publish candidate evidence through either npm publish dry-run or
+   exact existing-byte-match validation for an already published version;
 4. build Python wheel candidates for the same embedded Go CLI;
 5. prove publish readiness before any registry side effect: the tag must equal
    `v<package.json version>`, target a commit reachable from `main`, and have
-   npm dry-run evidence plus PyPI wheel candidates;
+   npm publish candidate evidence plus PyPI wheel candidates;
 6. publish to public npm through the admitted trusted path, or record
    `existing_byte_match` when the same version already exists with exact
    candidate bytes;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.1.136",
+  "version": "0.1.137",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,