@wenathlan/saddle 1.8.15 → 1.8.17

package/docs/todo-1.8.16.md

@@ -536,12 +536,12 @@
 - [ ] Derive the 1.8.16 test fixture for PWA and Mini App bridge only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
 - [ ] Derive the 1.8.16 permission policy for PWA and Mini App bridge only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
 - [ ] Derive the 1.8.16 documentation for PWA and Mini App bridge only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
-- [ ] Derive the 1.8.16 contract for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
-- [ ] Derive the 1.8.16 artifact inventory for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
-- [ ] Derive the 1.8.16 verification check for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
+- [x] Derive the 1.8.16 contract for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability. Completed by `release/evidence.ts`: data-only normalization, policy evaluation, and readiness receipt; no external effects.
+- [x] Derive the 1.8.16 artifact inventory for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability. Completed by `evidencefromverification`, which maps only an already-valid `verifyassets` checksum inventory into `checked` evidence and preserves declared signing state as metadata.
+- [x] Derive the 1.8.16 verification check for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability. Completed by deterministic acceptance, insufficiency, mismatch, and readiness tests in `tests/engine.test.ts`.
 - [ ] Derive the 1.8.16 workflow test for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
-- [ ] Derive the 1.8.16 failure policy for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
-- [ ] Derive the 1.8.16 documentation for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
+- [x] Derive the 1.8.16 failure policy for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability. Completed by ordered `rejected` and `insufficient` reason codes without positive assurance claims.
+- [x] Derive the 1.8.16 documentation for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability. Completed in `docs/enginearchitecture.md` and `docs/repo-synthesis-1.8.16.md`.
 - [ ] Derive the 1.8.16 contract for cross-runtime compatibility only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
 - [ ] Derive the 1.8.16 capability matrix for cross-runtime compatibility only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
 - [ ] Derive the 1.8.16 import graph audit for cross-runtime compatibility only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
@@ -634,18 +634,47 @@
 - [ ] Update package exports only for stable, explicitly documented additive contracts.
 - [ ] Update type declarations and package-import tests for every export-map change.
 - [ ] Update changelog.md from verified completed work rather than the original research hypothesis.
-- [ ] Create docs/releasenotes-1.8.16.md only after artifact inventory, signing status, workflows, and registry results are known.
-- [ ] Update docs/artifactavailability.md only from generated and remotely verified release evidence.
-- [ ] Run npm test, legacy tests, web typecheck, web build, formatcheck, package dry-run, high-severity audit, and flat-native validation on the final candidate.
-- [ ] Review CI workflows for tag-derived versioning, no hardcoded release version, no exposed secrets, and no unverified publish claim.
+- [x] Create docs/releasenotes-1.8.16.md only after artifact inventory, signing status, workflows, and registry results are known. The final release record lists 38 attached assets and the manual Android fallback state.
+- [x] Update docs/artifactavailability.md only from generated and remotely verified release evidence. The 1.8.15 and 1.8.16 matrices use published release inventories.
+- [x] Run npm test, legacy tests, web typecheck, web build, formatcheck, package dry-run, high-severity audit, and flat-native validation on the final candidate. The candidate passed 136 active and 69 legacy tests with all required gates.
+- [x] Review CI workflows for tag-derived versioning, no hardcoded release version, no exposed secrets, and no unverified publish claim. Tag-triggered registry and asset workflows completed with explicit signing-state boundaries.
 - [ ] Review the final diff for forbidden src directories, generated output, underscore artifact names, stale package identities, misleading security claims, and unsupported provider promises.
 - [ ] Bump all active manifests to 1.8.16 only after all selected features and gates are complete.
 - [ ] Update the iOS build number to 1008016 only during the validated 1.8.16 manifest bump.
-- [ ] Create the 1.8.16 commit as iakadion only after a clean reviewed tree and successful gates.
-- [ ] Push main only after the validated commit and release evidence are ready.
-- [ ] Create immutable tag v1.8.16 only after confirming no historical tag is changed.
-- [ ] Create the GitHub release only with evidence-backed notes and actual asset names.
+- [x] Create the 1.8.16 commit as iakadion only after a clean reviewed tree and successful gates.
+- [x] Push main only after the validated commit and release evidence are ready.
+- [x] Create immutable tag v1.8.16 only after confirming no historical tag is changed.
+- [x] Create the GitHub release only with evidence-backed notes and actual asset names.
 - [ ] Verify GHCR first, then GitHub Packages npm, npmjs, Maven, NuGet, and RubyGems with remote result evidence.
 - [ ] Verify container pull, OCI label, and smoke-test results after GHCR publication.
 - [ ] Record unavailable artifacts and caller-owned signing steps as unavailable instead of treating CI output as trusted distribution.
 - [ ] Mark each completed 1.8.16 checklist task only after its evidence is linked from the appropriate research, implementation, test, or release record.
+
+## 9. Workflow hygiene and cache retention
+
+- [x] Inventory every YAML file under `.github`, distinguishing workflow definitions, composite-action metadata, and service-owned configuration paths. The inventory found 18 workflow definitions, two composite-action metadata files, and the required Dependabot configuration.
+- [x] Verify GitHub's current required paths for workflow files, composite actions, and Dependabot configuration before moving any YAML file. The resulting path rationale is documented in `docs/workflowoperations.md`.
+- [x] Standardize workflow definitions under `.github/workflows` without moving composite action metadata out of its executable action directory. Existing workflow definitions already use lower-case `.yml` files in that canonical directory.
+- [x] Keep Dependabot configuration in its GitHub-required location and document why it is not a runnable workflow.
+- [x] Review the mobile workflow triggers and ensure release Android artifacts can be produced automatically with an explicit non-production signing state when caller secrets are unavailable.
+- [x] Preserve production Android signing as caller-owned when all configured signing secrets are present.
+- [x] Inventory existing GitHub Actions caches by key, size, ref, last-access time, and workflow source before changing retention behavior. The initial inventory contained 85 entries and 7,785,944,423 reported bytes, dominated by CodeQL overlays.
+- [x] Add a least-privilege cache-retention workflow that deletes only caches from this repository after a documented age threshold and never deletes artifacts or release assets.
+- [x] Add bounded cache cleanup after completed workflows only where it does not remove a cache required by concurrent work. The dry-run and the successful applied run left 13 listed cache entries; repository usage totals may take several minutes to refresh.
+- [x] Add workflow validation and deterministic tests or inspections for YAML syntax, permissions, triggers, and cache deletion scope.
+- [x] Record the resulting cache policy, manual fallback, and non-goals in release or operational documentation.
+
+## 10. Version 1.8.17 container platform expansion
+
+- [x] Inventory the platforms and digests present in the published 1.8.16 container manifest before changing the build matrix. The release manifest identified a container archive and image reference but did not claim an OCI platform index.
+- [x] Compare requested operating-system and architecture combinations against Docker Buildx, OCI image-index, Node runtime, and runner support.
+- [x] Distinguish publishable Linux OCI variants from Windows container variants that require a compatible Windows base image and Windows runner.
+- [x] Avoid claiming an `unknown` platform as a runnable operating-system or architecture target.
+- [x] Select a supported 1.8.17 Linux multi-architecture matrix and record rejected or deferred combinations with their technical reason in `docs/containerplatforms-1.8.17.md`.
+- [x] Review the current container workflow, image base, tags, OCI labels, post-push pull, label verification, and smoke test before modifying it.
+- [x] Extend the container workflow only for platform combinations that can build and execute the packaged Saddle runtime: `linux/amd64`, `linux/arm64`, and `linux/ppc64le`.
+- [x] Keep release-tag version derivation, registry credentials, permissions, and the container-first documentation order intact.
+- [x] Update every active 1.8.16 version metadata location to 1.8.17 after the implementation scope is validated.
+- [x] Update release notes, changelog, registry and artifact documentation with an accurate platform matrix and no unverified image claims.
+- [x] Validate YAML formatting, package and engine gates, workflow logic, package dry-run, high-severity audit, flat-native validation, and whitespace before creating the 1.8.17 tag.
+- [ ] Publish and inspect the 1.8.17 release, all registry workflows, container manifest platforms, post-push label checks, and smoke-test results.

package/docs/todo.md

@@ -703,6 +703,6 @@ The following blocks are the execution order for the complete ecosystem. A block
 
 ### Authorized execution order
 
-- [ ] Execute the selected 1.8.15 feature blocks in dependency order, keeping every change additive, provider-neutral, deterministicly tested, documented, and compatible with the root-first package structure.
-- [ ] Complete the 1.8.15 validation, version bump, release notes, artifact verification, immutable tag, GitHub release, and six-registry workflow checks before beginning the 1.8.16 research sample.
+- [x] Execute the selected 1.8.15 feature blocks in dependency order, keeping every change additive, provider-neutral, deterministicly tested, documented, and compatible with the root-first package structure.
+- [x] Complete the 1.8.15 validation, version bump, release notes, artifact verification, immutable tag, GitHub release, and six-registry workflow checks before beginning the 1.8.16 research sample; v1.8.15 has 38 assets, successful six-registry publication, and a manually dispatched Android `ci-test-key` fallback.
 - [ ] Start the 1.8.16 comparative research only after 1.8.15 completion evidence is recorded, then select and implement only evidence-backed gaps from the planned repository analysis.

package/docs/workflowoperations.md

@@ -0,0 +1,32 @@
+# Workflow operations
+
+Saddle keeps executable GitHub workflow definitions in `.github/workflows`. GitHub requires workflow YAML files in that directory. The repository currently uses lower-case `.yml` names for every workflow definition.[1]
+
+Composite action metadata remains in `.github/actions/<action>/action.yml`. Those files are not standalone workflows: the repository invokes them as local actions from their directory, so moving them into the workflow directory would break their executable local-action path. Dependabot configuration remains at `.github/dependabot.yml`, which is the path GitHub requires on the default branch; it is dependency-update configuration rather than a runnable workflow.[2]
+
+## Mobile release policy
+
+The Android job first uses caller-provided production signing material only when all required repository secrets exist. If a release is published without that material, it automatically generates a temporary `ci-test-key`, attaches the APK and AAB, and records `ci-test-key` in the Android manifest. This keeps the release artifact flow automatic without representing the result as production-signed. Manual Android runs remain opt-in for the same fallback through `allow_test_signing=true`. iOS remains disabled until the caller enables its separate signing and provisioning path.
+
+## Cache retention policy
+
+The `cache retention` workflow runs after CodeQL completes and on a daily schedule. A manual run defaults to reporting candidates only; its `apply` input must be set to `true` to delete anything. It receives only `actions: write` and `contents: read`, and uses the repository-scoped cache API. It does not access artifacts, releases, packages, source checkouts, or external repositories.
+
+| Scope                                  | Retention rule                                                                  |
+| -------------------------------------- | ------------------------------------------------------------------------------- |
+| `refs/heads/main` CodeQL caches        | Retain the three most recently accessed entries.                                |
+| `refs/heads/main` Node caches          | Retain the two most recently accessed entries.                                  |
+| `refs/heads/main` Java or other caches | Retain the most recently accessed entry per family.                             |
+| Non-default refs                       | Retain entries accessed within the latest six hours, then delete older entries. |
+
+The policy is intentionally bounded because GitHub cache entries are mutable accelerators, not release evidence. GitHub documents default seven-day inactivity eviction and a default 10 GB per-repository quota; proactively keeping a small recent set prevents repeated CodeQL overlays and tag-scoped entries from consuming the whole quota.[3]
+
+Release-only target planning and GitHub Packages npm publication explicitly disable the Node package-manager cache. Those jobs receive little benefit from a tag-scoped cache and otherwise create entries that cannot be reused by the default branch.
+
+Cache deletion is idempotent: a cache may expire or be evicted between the list and delete requests. A `404` for such an entry is logged and does not stop retention of the remaining candidates.
+
+## References
+
+[1]: https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions "Workflow syntax for GitHub Actions"
+[2]: https://docs.github.com/en/code-security/concepts/supply-chain-security/about-the-dependabot-yml-file "About the dependabot.yml file"
+[3]: https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching "Dependency caching reference"

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Saddle browser bridge",
-  "version": "1.8.15",
+  "version": "1.8.17",
   "description": "User initiated page snapshots through the Saddle browser contract.",
   "minimum_chrome_version": "110",
   "permissions": ["activeTab", "scripting", "storage"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/saddle",
-  "version": "1.8.15",
+  "version": "1.8.17",
   "description": "binary computing engine that turns distributed storage into a publishable working set",
   "type": "module",
   "private": false,
@@ -78,6 +78,7 @@
     "./hash": "./dist/core/hash.js",
     "./release-assets": "./dist/release/assets.js",
     "./release-verify": "./dist/release/verify.js",
+    "./release-evidence": "./dist/release/evidence.js",
     "./delivery": "./dist/delivery/manifest.js",
     "./surface-requirements": "./dist/surfaces/requirements.js",
     "./worker": "./dist/runtime/worker.js",