agent-merge-broker 0.12.1 → 0.14.2

package/CHANGELOG.md

@@ -1,5 +1,93 @@
 # Changelog
 
+## 0.14.2 — 2026-09-06
+
+### Fixed
+
+- Accepted both npm 10's root-level publish dry-run JSON fields and npm 11/12's package-name wrapper
+  when checking the tested tarball. Versions `0.14.0` and `0.14.1` have immutable GitHub tags but were
+  not published to npm; `0.14.2` is the corrected release target pending registry confirmation.
+
+## 0.14.1 — 2026-09-06
+
+This GitHub release was not published to npm; its dry-run JSON compatibility correction is in `0.14.2`.
+
+### Fixed
+
+- Prefixed the tested release tarball path with `./` so npm treats it as a local package rather than
+  GitHub shorthand. Added a publish dry-run to the packaged smoke test to verify that path before
+  granting publication authority.
+- Updated release references to `0.14.1`. The immutable `v0.14.0` GitHub tag remains available, but
+  its npm publication failed before uploading a package. Version `0.14.1` is the first npm release
+  target for the features below; confirm completed publication in npm's version history.
+
+## 0.14.0 — 2026-09-06
+
+This GitHub release was not published to npm; its publishing-path correction is in `0.14.1`.
+
+### Added
+
+- Added Gate readiness checks through `doctor --gate`, captured validator output through
+  `candidate show --logs`, archived-submission inspection with `candidate list --all`, and
+  submission counts in metrics.
+- Added deliberate `candidate abandon --reason` and preview-first `candidate archive` operations.
+  Abandonment preserves the original evidence and retries cleanup without rerunning validators.
+  Archival retires terminal records from active state while preserving their audit history; refs
+  remain retained unless `--release-artifacts` explicitly releases the exact broker-owned ref.
+- Added detached Ed25519 DSSE attestations containing an in-toto Gate validation statement, plus
+  offline verification against an independently trusted public key and expected artifact, base,
+  policy, and authority. Signed validation evidence does not authorize publication or merging.
+- Added fingerprint-addressed, packaged schema snapshots and an identity manifest while preserving
+  legacy schema aliases. Added a runnable local Gate example with accepted and rejected candidates.
+- Added runtime validation of saved state with field-specific corruption diagnostics, portable
+  GitHub CLI test fixtures, and real subprocess termination/restart recovery tests.
+
+### Changed
+
+- Raised the minimum Node.js version to 22, from 20.12 in `0.13.0`. The reusable release matrix
+  tests Node.js 22, 24, and 26 on Linux, macOS, and Windows.
+- Publication now waits for all platform checks against one immutable commit, installs and exercises
+  the actual npm tarball, and publishes those tested bytes with npm trusted publishing/provenance.
+- Extracted pure candidate lifecycle and Git locator logic and Gate retention into focused internal
+  modules while preserving the public Coordinate API.
+- Shortened the README into Coordinate and Gate entry routes and aligned operations, security,
+  compatibility, release, and roadmap documentation with the implemented capability boundaries.
+
+## 0.13.0 — 2026-09-04
+
+### Added
+
+- Added validation-only Gate intake for trusted Git refs already present in the broker repository.
+  `candidate authority setup` first records a versioned protected-target trust root at a fixed path
+  in Git's common directory; `candidate adopt --ref` then pins the exact commit, derives its
+  base-relative history and paths, loads committed policy from the registered base, and records a
+  standalone, schema-backed submission without manufacturing tasks, leases, receipts, or batches.
+- Added `candidate list` and `candidate show`, plus recovery of interrupted `received` and
+  `validating` submissions.
+
+### Changed
+
+- Validator environments now expose `MERGE_BROKER_SUBMISSION_ID` during trusted local-ref intake.
+- Validators now receive an owner-readable UTF-8 JSON path list through
+  `MERGE_BROKER_FILES_FILE`, `MERGE_BROKER_FILES_FILE_FORMAT=json`, and shell-safe `{filesFile}`.
+  Inline input remains the compatibility default but fails closed when either legacy representation
+  exceeds 4 KiB; `filesInput: "json"` explicitly selects file-only transport for large path sets.
+- Gate requires Git 2.46 or newer, binds protected-base refresh to the canonical fetch URL (separate
+  from any publication `pushurl`), rejects and scrubs Git repository/index/object/history and
+  configuration-injection or transport-command overrides, refuses configured URL/transport
+  rewrites, proxy/TLS/routing overrides, and exact-locator remote shorthand collisions, physically
+  binds local transport paths, rejects URL forms whose Git and web interpretations differ,
+  recursively inspects the owned object store, recomputes commit/tree/blob identities,
+  applies documented aggregate diff/tree/path ceilings, materializes raw filter-free blob bytes,
+  binds state/worktree/cache/hook directories to physical filesystem identities, journals retained-ref
+  establishment and later loss, bounds untracked-path diagnostics, and serializes authority
+  replacement against adoption and recovery.
+
+### Fixed
+
+- Kept exact-target checks compatible with Git for Windows' standard unscoped Schannel TLS backend,
+  and made lock release retry transient Windows sharing violations without weakening nonce fencing.
+
 ## 0.12.1 — 2026-09-04
 
 ### Added

package/CONTRIBUTING.md

@@ -14,19 +14,33 @@ npm install
 npm run verify
 node dist/cli.js --help
 npm run example
+npm run example:gate
+npm run test:package
 ```
 
-Tests use temporary real Git repositories rather than mocks for transaction behavior. Add a regression fixture for changes to leases, receipts, cherry-picking, validation, batching, or lifecycle transitions.
+The source checkout requires Node.js 22+ and Git 2.46+ for the Gate example. Tests use temporary real
+Git repositories for transaction behavior, portable GitHub CLI fixtures, and subprocess
+termination/restart checks for recovery. Add a regression fixture for changes to leases, receipts,
+cherry-picking, validation, batching, or lifecycle transitions.
 
 ## Pull requests
 
 - Keep changes focused and explain any state or protocol compatibility impact.
 - Update JSON schemas and documentation with persisted-format changes.
 - Avoid agent-specific behavior in the core; expose it through an adapter boundary.
-- Preserve the invariant that no branch is retained after failed validation.
+- Preserve the invariant that failed Coordinate validation cannot retain a publication branch.
+  Gate deliberately retains rejected artifacts for evidence and operator-controlled retirement.
 - Include tests for both the successful transaction and its recovery path.
 
-Run `npm run verify` before submitting. CI also runs `npm pack --dry-run` to verify the distributable package.
+Run `npm run verify` before submitting. CI repeats verification and both examples on Linux, macOS,
+and Windows with Node.js 22, 24, and 26, then installs and exercises the actual npm tarball. Releases
+publish the tested tarball only after the complete matrix succeeds.
+
+For schema changes, run `npm run build` and
+`node scripts/update-schema-snapshots.mjs --write`. The generator adds new fingerprint snapshots and
+updates the alias manifest; it refuses to overwrite changed immutable content. Commit new snapshots
+alongside the root alias change, and retain existing snapshots for consumers. `--check` is read-only
+and runs in CI. See [Protocol](docs/PROTOCOL.md) for identity and compatibility semantics.
 
 See [SUPPORT.md](SUPPORT.md) for usage questions and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for the
 project's participation expectations.