@research-engineering/agentic-proofkit 0.1.144 → 0.1.145
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/BACKLOG.md +1 -0
- package/package.json +1 -1
package/BACKLOG.md
CHANGED
|
@@ -67,6 +67,7 @@ only when these criteria are satisfied or explicitly retired by owner decision:
|
|
|
67
67
|
| DONE | IMPORT-06 | Remaining source-local code delta audit | Non-document source comparison found no old source file missing from the public source tree. Old source bytes remain candidate evidence only and are not imported over current hardening. |
|
|
68
68
|
| DONE | RELEASE-01 | Public source release | A public-source npm release path was admitted through Trusted Publisher, post-publish registry identity capture, root-only installed-package proof, and GitHub Release assets. PyPI publication and GitHub artifact attestations were skipped by explicit optional-channel policy and are not claimed. |
|
|
69
69
|
| DONE | RELEASE-02 | Scoped npm package identity | The organization-scoped npm package identity is the preferred release channel and is admitted through the scoped npm Trusted Publisher path, post-publish registry capture, root-only installed-package JSON CLI ABI proof, and GitHub Release assets. The `agentic-proofkit` CLI binary and Python package identities remain unchanged. The previous unscoped npm package remains a compatibility artifact, not the preferred dependency identity. |
|
|
70
|
+
| BLOCKED | RELEASE-03 | PyPI registry publication | The release workflow has a dedicated PyPI Trusted Publisher job and the GitHub repository has the `pypi` environment required by that workflow identity, but PyPI registry publication is blocked until the PyPI account has a normal or pending Trusted Publisher for project `agentic-proofkit`, repository `research-engineering/agentic-proofkit`, workflow `release.yml`, and environment `pypi`. `PROOFKIT_ENABLE_PYPI_PUBLISH` must stay disabled until that PyPI-side publisher exists. Completion requires enabling the variable, publishing a new version or recording exact existing-byte match, capturing PyPI registry identity, and proving the package through the release workflow. Workflow-published or mixed publication modes must bind the PyPI Trusted Publisher tuple in the release manifest; existing-byte-match mode must retain exact-byte registry proof without inventing publisher provenance. Wheel files in GitHub Release assets remain candidate artifacts, not PyPI dependency authority. |
|
|
70
71
|
| DONE | SECURITY-01 | Provider security settings | Repository is public with collaborator-only PR creation, public issues, squash-only merges, branch protection on `main`, strict required CI, CodeQL, OSV source advisory scanning, Scorecard, Dependabot security updates, secret scanning, and push protection. Non-provider secret patterns and validity checks remain unavailable or disabled under the current provider plan and are not claimed. |
|
|
71
72
|
| DONE | CONSUMER-01 | Public-package consumer proof | A private first consumer repository consumed the public npm package through its repository-owned external-consumer gate. The proof installed the package into an isolated temporary consumer, matched the admitted package identity, proved lockfile resolution was not workspace based, ran installed CLI `self-check`, `witness-plan`, and `release-authority`, proved rollback by removing the dependency from the temporary lockfile, and preserved consumer-owned native witness authority. |
|
|
72
73
|
| DONE | CONSUMER-02 | Second-consumer pilot | A private topology-distinct Python/FastAPI consumer module was run through explicit-input warn-mode `gradual-adoption-guidance` and `--agent-envelope` pilot records. Proofkit admitted the caller-owned route, reported one advisory candidate boundary, reported two missing proof-binding rule IDs as warnings, emitted route/bind/modernize/verify/promote agent actions, and kept enforcement blocked until consumer owners admit stable requirements and proof bindings. No generic Proofkit blocker was confirmed. |
|
package/package.json
CHANGED