borgmcp 2.15.0 → 2.16.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +35 -11
- package/dist/assimilate-cmd.d.ts +2 -0
- package/dist/assimilate-cmd.d.ts.map +1 -1
- package/dist/assimilate-cmd.js +20 -7
- package/dist/assimilate-cmd.js.map +1 -1
- package/dist/assimilate-deps.d.ts.map +1 -1
- package/dist/assimilate-deps.js +2 -1
- package/dist/assimilate-deps.js.map +1 -1
- package/dist/bare-launch-menu.d.ts +8 -0
- package/dist/bare-launch-menu.d.ts.map +1 -1
- package/dist/bare-launch-menu.js +12 -0
- package/dist/bare-launch-menu.js.map +1 -1
- package/dist/claude.d.ts.map +1 -1
- package/dist/claude.js +26 -39
- package/dist/claude.js.map +1 -1
- package/dist/cubes.d.ts +6 -1
- package/dist/cubes.d.ts.map +1 -1
- package/dist/cubes.js +7 -2
- package/dist/cubes.js.map +1 -1
- package/dist/parse-assimilate-args.d.ts.map +1 -1
- package/dist/parse-assimilate-args.js +6 -1
- package/dist/parse-assimilate-args.js.map +1 -1
- package/dist/regen-format.d.ts.map +1 -1
- package/dist/regen-format.js +7 -1
- package/dist/regen-format.js.map +1 -1
- package/dist/resolved-cli-config.d.ts +16 -0
- package/dist/resolved-cli-config.d.ts.map +1 -0
- package/dist/resolved-cli-config.js +26 -0
- package/dist/resolved-cli-config.js.map +1 -0
- package/dist/setup-selection.d.ts +38 -0
- package/dist/setup-selection.d.ts.map +1 -0
- package/dist/setup-selection.js +51 -0
- package/dist/setup-selection.js.map +1 -0
- package/dist/setup.js +80 -21
- package/dist/setup.js.map +1 -1
- package/docs/EXTRACTION_PROVENANCE.md +23 -10
- package/docs/RELEASING.md +8 -282
- package/package.json +8 -9
- package/src/assimilate-cmd.ts +24 -7
- package/src/assimilate-deps.ts +2 -0
- package/src/bare-launch-menu.ts +17 -0
- package/src/claude.ts +29 -37
- package/src/cubes.ts +7 -2
- package/src/parse-assimilate-args.ts +7 -1
- package/src/regen-format.ts +7 -1
- package/src/resolved-cli-config.ts +40 -0
- package/src/setup-selection.ts +87 -0
- package/src/setup.ts +98 -24
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
const CLI_TITLES = {
|
|
2
|
+
claude: 'Claude Code',
|
|
3
|
+
codex: 'Codex',
|
|
4
|
+
opencode: 'OpenCode',
|
|
5
|
+
};
|
|
6
|
+
/** Build the first-run choices from the CLIs that are actually installed. */
|
|
7
|
+
export function setupAgentChoices(detected, alreadyConfigured = new Set()) {
|
|
8
|
+
return [...new Set(detected)].map((cli) => ({
|
|
9
|
+
title: alreadyConfigured.has(cli)
|
|
10
|
+
? `${CLI_TITLES[cli]} (already configured)`
|
|
11
|
+
: CLI_TITLES[cli],
|
|
12
|
+
value: cli,
|
|
13
|
+
selected: !alreadyConfigured.has(cli),
|
|
14
|
+
...(alreadyConfigured.has(cli) ? { disabled: true } : {}),
|
|
15
|
+
}));
|
|
16
|
+
}
|
|
17
|
+
/** The agent names whose newly selected setup needs a restart notice. */
|
|
18
|
+
export function setupRestartInstruction(selected) {
|
|
19
|
+
const labels = selected.map((cli) => CLI_TITLES[cli]);
|
|
20
|
+
return `🔄 Restart ${labels.join(' / ')} (or open a new session) for the changes to take effect.`;
|
|
21
|
+
}
|
|
22
|
+
/** Describe the accepted zero-selection result and its recovery path. */
|
|
23
|
+
export function emptySetupOutcome() {
|
|
24
|
+
return {
|
|
25
|
+
kind: 'empty',
|
|
26
|
+
agentConfigurationChanged: false,
|
|
27
|
+
localServerInitializationStarted: false,
|
|
28
|
+
recovery: {
|
|
29
|
+
kind: 'rerun-setup',
|
|
30
|
+
command: 'borg setup',
|
|
31
|
+
},
|
|
32
|
+
};
|
|
33
|
+
}
|
|
34
|
+
/**
|
|
35
|
+
* Keep only detected agents and return them in detection order. The selected
|
|
36
|
+
* set is invocation-local; it is deliberately never persisted.
|
|
37
|
+
*/
|
|
38
|
+
export function normalizeSetupAgentSelection(detected, selected) {
|
|
39
|
+
if (!Array.isArray(selected))
|
|
40
|
+
return [];
|
|
41
|
+
const selectedSet = new Set(selected);
|
|
42
|
+
return [...new Set(detected)].filter((cli) => selectedSet.has(cli));
|
|
43
|
+
}
|
|
44
|
+
/** Turn the prompt result into the terminal outcome used by the wizard. */
|
|
45
|
+
export function resolveSetupAgentSelection(detected, selected, cancelled = false) {
|
|
46
|
+
if (cancelled)
|
|
47
|
+
return { kind: 'cancelled' };
|
|
48
|
+
const agents = normalizeSetupAgentSelection(detected, selected);
|
|
49
|
+
return agents.length === 0 ? { kind: 'empty' } : { kind: 'selected', agents };
|
|
50
|
+
}
|
|
51
|
+
//# sourceMappingURL=setup-selection.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"setup-selection.js","sourceRoot":"","sources":["../src/setup-selection.ts"],"names":[],"mappings":"AAwBA,MAAM,UAAU,GAA4B;IAC1C,MAAM,EAAE,aAAa;IACrB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAC/B,QAA4B,EAC5B,oBAA0C,IAAI,GAAG,EAAE;IAEnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;YAC/B,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,uBAAuB;YAC3C,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACnB,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QACrC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,QAA4B;IAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO,cAAc,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,0DAA0D,CAAC;AACpG,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,yBAAyB,EAAE,KAAK;QAChC,gCAAgC,EAAE,KAAK;QACvC,QAAQ,EAAE;YACR,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,YAAY;SACtB;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAA4B,EAC5B,QAAwC;IAExC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACxC,QAA4B,EAC5B,QAAwC,EACxC,SAAS,GAAG,KAAK;IAEjB,IAAI,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,4BAA4B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC"}
|
package/dist/setup.js
CHANGED
|
@@ -20,6 +20,7 @@ import { initDebugFromArgv } from './debug.js';
|
|
|
20
20
|
import { defaultApprovalIo, setupApprovalWarnings } from './cli-tool-approval.js';
|
|
21
21
|
import { offerFirstRunServerInstall } from './first-run-server.js';
|
|
22
22
|
import { setupNextStepsText } from './cli-help.js';
|
|
23
|
+
import { emptySetupOutcome, resolveSetupAgentSelection, setupAgentChoices, setupRestartInstruction, } from './setup-selection.js';
|
|
23
24
|
/**
|
|
24
25
|
* Main setup wizard
|
|
25
26
|
*/
|
|
@@ -58,22 +59,18 @@ async function main() {
|
|
|
58
59
|
console.error(chalk.gray(' OpenCode: https://opencode.ai\n'));
|
|
59
60
|
process.exit(1);
|
|
60
61
|
}
|
|
61
|
-
//
|
|
62
|
-
//
|
|
63
|
-
// partial setup state behind.
|
|
64
|
-
console.log(chalk.blue('◼ Local Server'));
|
|
65
|
-
const serverInstall = await offerFirstRunServerInstall(undefined, undefined, { initializeServer: true });
|
|
66
|
-
if (serverInstall.kind !== 'present' && serverInstall.kind !== 'installed') {
|
|
67
|
-
process.exit(serverInstall.kind === 'declined' ? 0 : 1);
|
|
68
|
-
}
|
|
69
|
-
console.log('');
|
|
70
|
-
console.log('◼ Local server initialized');
|
|
71
|
-
// Step 1: Configure every detected agent CLI
|
|
62
|
+
// Step 1: Choose which detected agent CLIs to configure. The choice is
|
|
63
|
+
// first-run/invocation-local; it is never persisted as an opt-out.
|
|
72
64
|
console.log(chalk.blue('◼ Agent CLI Integration'));
|
|
73
65
|
const yes = parseYesFlag(process.argv);
|
|
74
66
|
const claudeDetected = claudeCliPath !== null;
|
|
75
67
|
const codexDetected = codexCliPath !== null;
|
|
76
68
|
const opencodeDetected = opencodeCliPath !== null;
|
|
69
|
+
const detectedClis = [
|
|
70
|
+
...(claudeDetected ? ['claude'] : []),
|
|
71
|
+
...(codexDetected ? ['codex'] : []),
|
|
72
|
+
...(opencodeDetected ? ['opencode'] : []),
|
|
73
|
+
];
|
|
77
74
|
const claudeMcpConfigured = isMcpServerConfigured();
|
|
78
75
|
const codexMcpConfigured = isCodexMcpServerConfigured();
|
|
79
76
|
const opencodeMcpConfigured = isOpenCodeMcpServerConfigured();
|
|
@@ -81,19 +78,70 @@ async function main() {
|
|
|
81
78
|
const claudeUpsHookPending = claudeDetected && !isUserPromptSubmitHookRegistered();
|
|
82
79
|
const codexSessionHookPending = codexDetected && !isCodexSessionStartHookRegistered();
|
|
83
80
|
const codexUpsHookPending = codexDetected && !isCodexUserPromptSubmitHookRegistered();
|
|
84
|
-
const
|
|
85
|
-
|
|
86
|
-
|
|
81
|
+
const alreadyConfigured = new Set([
|
|
82
|
+
...(claudeDetected && claudeMcpConfigured && !claudeLegacyHookPending && !claudeUpsHookPending
|
|
83
|
+
? ['claude']
|
|
84
|
+
: []),
|
|
85
|
+
...(codexDetected && codexMcpConfigured && !codexSessionHookPending && !codexUpsHookPending
|
|
86
|
+
? ['codex']
|
|
87
|
+
: []),
|
|
88
|
+
...(opencodeDetected && opencodeMcpConfigured ? ['opencode'] : []),
|
|
89
|
+
]);
|
|
90
|
+
const allDetectedMutationPending = setupMutationPending({
|
|
87
91
|
claude: claudeDetected,
|
|
88
92
|
codex: codexDetected,
|
|
89
93
|
opencode: opencodeDetected,
|
|
90
94
|
claudeMcpConfigured,
|
|
91
95
|
codexMcpConfigured,
|
|
92
96
|
opencodeMcpConfigured,
|
|
97
|
+
claudeHookPending: claudeLegacyHookPending || claudeUpsHookPending,
|
|
98
|
+
codexHookPending: codexSessionHookPending || codexUpsHookPending,
|
|
99
|
+
});
|
|
100
|
+
let selectedClis = detectedClis;
|
|
101
|
+
if (allDetectedMutationPending && !yes && process.stdin.isTTY === true) {
|
|
102
|
+
let cancelled = false;
|
|
103
|
+
const answer = await prompts({
|
|
104
|
+
type: 'multiselect',
|
|
105
|
+
name: 'selected',
|
|
106
|
+
message: 'Which detected agent CLIs should Borg configure?',
|
|
107
|
+
hint: 'Space toggles selection; Enter accepts the checked agents',
|
|
108
|
+
choices: setupAgentChoices(detectedClis, alreadyConfigured),
|
|
109
|
+
instructions: false,
|
|
110
|
+
}, {
|
|
111
|
+
onCancel: () => {
|
|
112
|
+
cancelled = true;
|
|
113
|
+
},
|
|
114
|
+
});
|
|
115
|
+
const selection = resolveSetupAgentSelection(detectedClis, answer.selected, cancelled);
|
|
116
|
+
if (selection.kind === 'cancelled') {
|
|
117
|
+
console.log(chalk.yellow('\n◼ Setup cancelled — no changes made.\n'));
|
|
118
|
+
return;
|
|
119
|
+
}
|
|
120
|
+
if (selection.kind === 'empty') {
|
|
121
|
+
const outcome = emptySetupOutcome();
|
|
122
|
+
console.log(chalk.yellow(`\n◼ No agent CLIs selected — agent configuration and local-server initialization were skipped. ` +
|
|
123
|
+
`Run \`${outcome.recovery.command}\` again to choose an agent and continue setup.\n`));
|
|
124
|
+
return;
|
|
125
|
+
}
|
|
126
|
+
selectedClis = selection.agents;
|
|
127
|
+
}
|
|
128
|
+
const selected = new Set(selectedClis);
|
|
129
|
+
const claudeSelected = selected.has('claude');
|
|
130
|
+
const codexSelected = selected.has('codex');
|
|
131
|
+
const opencodeSelected = selected.has('opencode');
|
|
132
|
+
const claudeHookPending = claudeSelected && (claudeLegacyHookPending || claudeUpsHookPending);
|
|
133
|
+
const codexHookPending = codexSelected && (codexSessionHookPending || codexUpsHookPending);
|
|
134
|
+
if (setupMutationPending({
|
|
135
|
+
claude: claudeSelected,
|
|
136
|
+
codex: codexSelected,
|
|
137
|
+
opencode: opencodeSelected,
|
|
138
|
+
claudeMcpConfigured,
|
|
139
|
+
codexMcpConfigured,
|
|
140
|
+
opencodeMcpConfigured,
|
|
93
141
|
claudeHookPending,
|
|
94
142
|
codexHookPending,
|
|
95
143
|
})) {
|
|
96
|
-
console.log(formatConfigMutationDisclosure(configMutationTargets({ claude:
|
|
144
|
+
console.log(formatConfigMutationDisclosure(configMutationTargets({ claude: claudeSelected, codex: codexSelected, opencode: opencodeSelected })));
|
|
97
145
|
const mutationDecision = await confirmConfigMutation({
|
|
98
146
|
isTTY: process.stdin.isTTY === true,
|
|
99
147
|
yes,
|
|
@@ -113,7 +161,18 @@ async function main() {
|
|
|
113
161
|
}
|
|
114
162
|
}
|
|
115
163
|
console.log('');
|
|
116
|
-
|
|
164
|
+
// Resolve the separately published local server only after the complete
|
|
165
|
+
// agent selection and the existing single config-mutation confirmation.
|
|
166
|
+
// Esc/zero-selection/decline therefore leave both agent and server setup
|
|
167
|
+
// untouched.
|
|
168
|
+
console.log(chalk.blue('◼ Local Server'));
|
|
169
|
+
const serverInstall = await offerFirstRunServerInstall(undefined, undefined, { initializeServer: true });
|
|
170
|
+
if (serverInstall.kind !== 'present' && serverInstall.kind !== 'installed') {
|
|
171
|
+
process.exit(serverInstall.kind === 'declined' ? 0 : 1);
|
|
172
|
+
}
|
|
173
|
+
console.log('');
|
|
174
|
+
console.log('◼ Local server initialized');
|
|
175
|
+
if (claudeSelected) {
|
|
117
176
|
try {
|
|
118
177
|
ensureCliMcpConfigured('claude');
|
|
119
178
|
if (claudeLegacyHookPending)
|
|
@@ -127,7 +186,7 @@ async function main() {
|
|
|
127
186
|
process.exit(1);
|
|
128
187
|
}
|
|
129
188
|
}
|
|
130
|
-
if (
|
|
189
|
+
if (codexSelected) {
|
|
131
190
|
try {
|
|
132
191
|
ensureCliMcpConfigured('codex');
|
|
133
192
|
if (codexSessionHookPending)
|
|
@@ -141,7 +200,7 @@ async function main() {
|
|
|
141
200
|
process.exit(1);
|
|
142
201
|
}
|
|
143
202
|
}
|
|
144
|
-
if (
|
|
203
|
+
if (opencodeSelected) {
|
|
145
204
|
try {
|
|
146
205
|
ensureCliMcpConfigured('opencode');
|
|
147
206
|
console.log(chalk.green('◼ borg configured for OpenCode'));
|
|
@@ -157,8 +216,8 @@ async function main() {
|
|
|
157
216
|
codexArgs: [],
|
|
158
217
|
});
|
|
159
218
|
for (const warning of await setupApprovalWarnings(approvalIo, {
|
|
160
|
-
codex:
|
|
161
|
-
opencode:
|
|
219
|
+
codex: codexSelected,
|
|
220
|
+
opencode: opencodeSelected,
|
|
162
221
|
})) {
|
|
163
222
|
console.log(chalk.yellow(`warning: ${warning}`));
|
|
164
223
|
}
|
|
@@ -168,7 +227,7 @@ async function main() {
|
|
|
168
227
|
console.log(chalk.gray('Local self-hosted server mode — no account or subscription needed.'));
|
|
169
228
|
// Success message
|
|
170
229
|
console.log(chalk.green.bold('\nSetup complete!\n'));
|
|
171
|
-
console.log(chalk.yellow(
|
|
230
|
+
console.log(chalk.yellow(`${setupRestartInstruction(selectedClis)}\n`));
|
|
172
231
|
if (!serverInstall.suppressClientNextSteps) {
|
|
173
232
|
console.log(chalk.gray(setupNextStepsText()));
|
|
174
233
|
}
|
package/dist/setup.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,EAC9B,YAAY,EACZ,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAC5B,gCAAgC,EAChC,iCAAiC,EACjC,qCAAqC,EACrC,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,EAC9B,YAAY,EACZ,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAC5B,gCAAgC,EAChC,iCAAiC,EACjC,qCAAqC,EACrC,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B;;GAEG;AACH,KAAK,UAAU,IAAI;IACjB,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,iBAAiB,EAAE,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAE5D,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QAAC,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IACtE,IAAI,CAAC;QAAC,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IACpE,IAAI,CAAC;QAAC,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAE1E,IAAI,aAAa;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,EAAE,CAAC,CAAC,CAAC;IACjF,IAAI,YAAY;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,eAAe;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,eAAe,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,aAAa,IAAI,YAAY,IAAI,eAAe;QAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEtE,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvC,MAAM,cAAc,GAAG,aAAa,KAAK,IAAI,CAAC;IAC9C,MAAM,aAAa,GAAG,YAAY,KAAK,IAAI,CAAC;IAC5C,MAAM,gBAAgB,GAAG,eAAe,KAAK,IAAI,CAAC;IAClD,MAAM,YAAY,GAAc;QAC9B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,UAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;IAEF,MAAM,mBAAmB,GAAG,qBAAqB,EAAE,CAAC;IACpD,MAAM,kBAAkB,GAAG,0BAA0B,EAAE,CAAC;IACxD,MAAM,qBAAqB,GAAG,6BAA6B,EAAE,CAAC;IAC9D,MAAM,uBAAuB,GAAG,cAAc,IAAI,4BAA4B,EAAE,CAAC;IACjF,MAAM,oBAAoB,GAAG,cAAc,IAAI,CAAC,gCAAgC,EAAE,CAAC;IACnF,MAAM,uBAAuB,GAAG,aAAa,IAAI,CAAC,iCAAiC,EAAE,CAAC;IACtF,MAAM,mBAAmB,GAAG,aAAa,IAAI,CAAC,qCAAqC,EAAE,CAAC;IACtF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAU;QACzC,GAAG,CAAC,cAAc,IAAI,mBAAmB,IAAI,CAAC,uBAAuB,IAAI,CAAC,oBAAoB;YAC5F,CAAC,CAAC,CAAC,QAAiB,CAAC;YACrB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,aAAa,IAAI,kBAAkB,IAAI,CAAC,uBAAuB,IAAI,CAAC,mBAAmB;YACzF,CAAC,CAAC,CAAC,OAAgB,CAAC;YACpB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,gBAAgB,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAC,UAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;QACtD,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,gBAAgB;QAC1B,mBAAmB;QACnB,kBAAkB;QAClB,qBAAqB;QACrB,iBAAiB,EAAE,uBAAuB,IAAI,oBAAoB;QAClE,gBAAgB,EAAE,uBAAuB,IAAI,mBAAmB;KACjE,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,YAAY,CAAC;IAChC,IAAI,0BAA0B,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACvE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B;YACE,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,kDAAkD;YAC3D,IAAI,EAAE,2DAA2D;YACjE,OAAO,EAAE,iBAAiB,CAAC,YAAY,EAAE,iBAAiB,CAAC;YAC3D,YAAY,EAAE,KAAK;SACpB,EACD;YACE,QAAQ,EAAE,GAAG,EAAE;gBACb,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;SACF,CACF,CAAC;QACF,MAAM,SAAS,GAAG,0BAA0B,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvF,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CACtB,iGAAiG;gBACjG,SAAS,OAAO,CAAC,QAAQ,CAAC,OAAO,mDAAmD,CACrF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC;IAClC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,cAAc,IAAI,CAAC,uBAAuB,IAAI,oBAAoB,CAAC,CAAC;IAC9F,MAAM,gBAAgB,GAAG,aAAa,IAAI,CAAC,uBAAuB,IAAI,mBAAmB,CAAC,CAAC;IAE3F,IACE,oBAAoB,CAAC;QACnB,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,gBAAgB;QAC1B,mBAAmB;QACnB,kBAAkB;QAClB,qBAAqB;QACrB,iBAAiB;QACjB,gBAAgB;KACjB,CAAC,EACF,CAAC;QACD,OAAO,CAAC,GAAG,CACT,8BAA8B,CAC5B,qBAAqB,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CACpG,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC;YACnD,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;YACnC,GAAG;YACH,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;oBAChC,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,8BAA8B;oBACvC,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;gBACH,OAAO,OAAO,KAAK,IAAI,CAAC;YAC1B,CAAC;SACF,CAAC,CAAC;QACH,IAAI,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,aAAa;IACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IACzG,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAE1C,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,uBAAuB;gBAAE,sBAAsB,EAAE,CAAC;YACtD,IAAI,oBAAoB;gBAAE,uBAAuB,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wCAAwC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,uBAAuB;gBAAE,wBAAwB,EAAE,CAAC;YACxD,IAAI,mBAAmB;gBAAE,4BAA4B,EAAE,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,sBAAsB,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;QAChE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,EAAE;KACd,CAAC,CAAC;IACH,KAAK,MAAM,OAAO,IAAI,MAAM,qBAAqB,CAAC,UAAU,EAAE;QAC5D,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,gBAAgB;KAC3B,CAAC,EAAE,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,sDAAsD;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC,CAAC;IAE9F,kBAAkB;IAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,uBAAuB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,uBAAuB,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,aAAa;AACb,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
|
@@ -17,13 +17,25 @@ The extraction copied the monorepo's `client/src/` production boundary and top-l
|
|
|
17
17
|
- Kept self-hosted `--host --enroll` preview-only while implementing the
|
|
18
18
|
client-generated PENDING credential/retry tuple and capability-gated,
|
|
19
19
|
repository-idempotent cube creation required for local dogfood.
|
|
20
|
-
- Initially set the standalone package identity to `2.0.0`.
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
20
|
+
- Initially set the standalone package identity to `2.0.0`. **The current
|
|
21
|
+
release identity is `2.16.1`.** Extraction and versioning do not authorize
|
|
22
|
+
publication.
|
|
23
|
+
|
|
24
|
+
Spent versions — each burned an immutable tag and published nothing:
|
|
25
|
+
|
|
26
|
+
| Version | Failed at | Recovered by |
|
|
27
|
+
| --- | --- | --- |
|
|
28
|
+
| `2.0.0` | lightweight release tag, before packaging | `2.0.1` |
|
|
29
|
+
| `2.0.7` | before package creation or npm publication | — |
|
|
30
|
+
| `2.10.1` | before artifact creation or publication | — |
|
|
31
|
+
| `2.12.0` | before artifact creation or publication | `2.12.1` |
|
|
32
|
+
|
|
33
|
+
Every other version in the `2.x` line published and was registry-verified.
|
|
34
|
+
Record spent versions here when they occur; do not append a clause to this
|
|
35
|
+
entry. To confirm the table is still complete, list the repository's version
|
|
36
|
+
tags and `npm view borgmcp versions` — a spent version is a tag whose version
|
|
37
|
+
never reached the registry, and the two sets should differ by exactly these
|
|
38
|
+
rows.
|
|
27
39
|
|
|
28
40
|
## Review Holds
|
|
29
41
|
|
|
@@ -47,6 +59,7 @@ client `borgmcp@2.10.0` line. Its annotated tag object
|
|
|
47
59
|
`sha512-lOxIPg3WcjSBte46iTM7SAFVN6Y0b2oizOKAJ9Q1EijBdOlmsh/cQlpUIaa8F2UJPaTDFsXy3M64gpGs6XgKzA==`
|
|
48
60
|
in the `borgmcp-server-0.9.0-release` registry decision. That server and its
|
|
49
61
|
client line pin historical `borgmcp-shared` version `0.8.1` and remain
|
|
50
|
-
immutable.
|
|
51
|
-
|
|
52
|
-
the exact-artifact and
|
|
62
|
+
immutable. The immutable `v2.0.7` attempt failed before publication and remains
|
|
63
|
+
preserved. The current release identity and publication gate remain governed by
|
|
64
|
+
the reviewed `v2.16.1` source, a fresh annotated tag, and the exact-artifact and
|
|
65
|
+
protected-publication gates.
|
package/docs/RELEASING.md
CHANGED
|
@@ -4,220 +4,11 @@ The GitHub Actions workflow publishes one immutable, reviewed `borgmcp` version
|
|
|
4
4
|
from a protected annotated tag. The protected publish job uses npm Trusted
|
|
5
5
|
Publishing; no long-lived npm token is stored or exposed.
|
|
6
6
|
|
|
7
|
-
##
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
creation or npm publication; the publish job was skipped and
|
|
13
|
-
`borgmcp@2.0.0` remains absent from npm. Never delete, move, replace, reuse, or
|
|
14
|
-
rerun that tag or run.
|
|
15
|
-
|
|
16
|
-
The annotated `v2.0.1` tag object
|
|
17
|
-
`def12ee40af665fc6c3af4873a7d566b3f844fc1` peels to protected-main commit
|
|
18
|
-
`b30fc54a4d73bda98db4630864cca796c8923dd9`. Workflow run `29748931957`
|
|
19
|
-
successfully published that exact source as `borgmcp@2.0.1`; the registry records
|
|
20
|
-
integrity
|
|
21
|
-
`sha512-Ah8IY2izZ774gYLKthRL9lfrV+JBk2o9HSlrWUplyZgoGqwVjVboHNon0hWWF5i/fObiCGikFOMY6qZ+vaeyCw==`.
|
|
22
|
-
Never move, replace, reuse, or rerun that tag or workflow. The next candidate
|
|
23
|
-
must use a fresh unused identity and requires the complete release gate again.
|
|
24
|
-
|
|
25
|
-
The annotated `v2.0.2` tag object
|
|
26
|
-
`a1fc1f8f05c3f1b4d7ccbef86e244955642165b5` peels to protected-main commit
|
|
27
|
-
`aced84956fdf41315904c8901e50a345f628152c`. Workflow run `29840120451`
|
|
28
|
-
successfully published that exact source as `borgmcp@2.0.2`; the registry records
|
|
29
|
-
integrity
|
|
30
|
-
`sha512-w0O0t/2wzeJpXEqb4jQGuqZeavEkfFKdz6poRT8q1TxDKHTlOlwo3auctE+X1kWU2s5JkSDcUiUdQdyLwu84IA==`.
|
|
31
|
-
Never move, replace, reuse, or rerun that tag or workflow. The next candidate
|
|
32
|
-
must use a fresh unused identity and requires the complete release gate again.
|
|
33
|
-
|
|
34
|
-
The annotated `v2.0.3` tag object
|
|
35
|
-
`47701127cbdba6499595ef0529de264b00a61840` peels to protected-main commit
|
|
36
|
-
`3e44e9c439c036850c6a9226d02876f4883501d9`. Workflow run `29851751102`
|
|
37
|
-
successfully published that exact source as `borgmcp@2.0.3`; the registry records
|
|
38
|
-
integrity
|
|
39
|
-
`sha512-3Iy4BSB+yq8F75w/gWiEU7D+mKCYYa5mIsn/iC/byy5CK/QsAWg10KgsBI3GlDBZul1CD3Qq+zpmVeK2qpIE1A==`.
|
|
40
|
-
Never move, replace, reuse, or rerun that tag or workflow. The next candidate
|
|
41
|
-
must use a fresh unused identity and requires the complete release gate again.
|
|
42
|
-
|
|
43
|
-
The annotated `v2.0.4` tag object
|
|
44
|
-
`f86c5b81b77afa7ebd080b508831f1dc39c403e2` peels to protected-main commit
|
|
45
|
-
`57a26139a11b47bc5f1d7234bc69e2a2a75954b3`. Workflow run `29925624599`, attempt 1,
|
|
46
|
-
successfully published that exact source as `borgmcp@2.0.4`; the registry records integrity
|
|
47
|
-
`sha512-xuGxMQ9FZTQN4KP/wGlJqI4LgxP2aKpeykbakjfXHPeUzmNHvkN0YtcenzlSvHsObnpQgMfsy7TNy+YrPkk65g==`.
|
|
48
|
-
Never move, replace, reuse, or rerun that tag or workflow. The next candidate
|
|
49
|
-
uses the unused `v2.0.5` identity from a fresh reviewed protected-main commit
|
|
50
|
-
and requires the complete release gate again.
|
|
51
|
-
|
|
52
|
-
The annotated `v2.0.5` tag object
|
|
53
|
-
`242ed67fec00701f4eb332302e60dff84c0368f7` peels to protected-main commit
|
|
54
|
-
`a18a169ec96c5e3194b3bd3edc9e84002c4bc7a3`. Workflow run `29955861508`, attempt 1,
|
|
55
|
-
successfully published that exact source as `borgmcp@2.0.5`; the registry records integrity
|
|
56
|
-
`sha512-pMqovKzUu0Mdru2YJULj3XkHSeiT/PuCAjwCQ2Sg/mmF299tZE80qvca6GCNCLjhYEWWIuXmssuxK7wePKqxdw==`.
|
|
57
|
-
Never move, replace, reuse, or rerun that tag or workflow. The next candidate
|
|
58
|
-
uses the unused `v2.0.6` identity from a fresh reviewed protected-main commit
|
|
59
|
-
and requires the complete release gate again.
|
|
60
|
-
|
|
61
|
-
The annotated `v2.0.6` tag object
|
|
62
|
-
`b41d312efc9f8d1ed63021812d8165b00011e8d8` peels to protected-main commit
|
|
63
|
-
`5fd9048e4c22e4478160e3a25654837b5a33d8bb`. Workflow run `29982288768`, attempt 1,
|
|
64
|
-
successfully published that exact source as `borgmcp@2.0.6`; the registry records integrity
|
|
65
|
-
`sha512-WDX4tmk46I6Tvb/Gz1XlD/9PbIgOe72rRDCjV+/lw6KnAxWW0S25LT1DgifotI9LQv7LLAok8WkjucDDTTQ+pw==`.
|
|
66
|
-
Never move, replace, reuse, or rerun that tag or workflow.
|
|
67
|
-
|
|
68
|
-
The annotated `v2.0.7` tag object
|
|
69
|
-
`bf41d5a70d7df11930a3124feda72835ae903522` peels to protected-main commit
|
|
70
|
-
`85f7c45cffdd449a6de4a52608453b6680492221`. Workflow run `30009042758`,
|
|
71
|
-
attempt 1, received registry metadata HTTP 504 for
|
|
72
|
-
`@esbuild/openbsd-arm64@0.28.1` and failed before package creation or npm
|
|
73
|
-
publication. The publish and registry-verification jobs were skipped, and
|
|
74
|
-
`borgmcp@2.0.7` remains absent from npm. Never delete, move, replace, reuse, or
|
|
75
|
-
rerun that tag, version, or workflow. The next candidate uses the unused
|
|
76
|
-
`v2.0.8` identity from a fresh reviewed protected-main commit and requires the
|
|
77
|
-
complete release gate again.
|
|
78
|
-
|
|
79
|
-
The annotated `v2.0.8` tag object
|
|
80
|
-
`7b5a4929534abfa97a65e278df230adfdb842d8f` peels to protected-main commit
|
|
81
|
-
`8bc796d8fc4e307dca593138fb080984662c7d62`. Workflow run `30012098601`, attempt 1,
|
|
82
|
-
successfully published that exact source as `borgmcp@2.0.8`; the registry records integrity
|
|
83
|
-
`sha512-az1IKG4VNwAF/8PKEVK88gdRoFFBqgtl6ObXX+CcJadavNqkwJ9UFeP8LOJ2js911mIiXEm8c4xDf6MnO0GOng==`.
|
|
84
|
-
Never move, replace, reuse, or rerun that tag or workflow. Its successor used
|
|
85
|
-
the fresh `v2.0.9` identity from a reviewed protected-main commit and passed the
|
|
86
|
-
complete release gate.
|
|
87
|
-
|
|
88
|
-
The annotated `v2.0.9` tag object
|
|
89
|
-
`3a88bb4f46143789803a4e57f52b94d762f1ca9b` peels to protected-main commit
|
|
90
|
-
`18084fc486a041f3438f584a97d218c01a5e0399`. Workflow run `30047299013`, attempt 1,
|
|
91
|
-
successfully published that exact source as `borgmcp@2.0.9`; the registry records integrity
|
|
92
|
-
`sha512-lf0TZ8ZcpHv/Nt3LkY/IGxkUFkg3weavF+rLv6xLImDDhLIaZly1y8jUdo3UuheQVhrLnLcxoz37Myr4mPx9lg==`.
|
|
93
|
-
Never move, replace, reuse, or rerun that tag or workflow.
|
|
94
|
-
|
|
95
|
-
The annotated `v2.0.10` tag object
|
|
96
|
-
`31ae3c19ac4e04fac33269459a460d5316cce730` peels to protected-main commit
|
|
97
|
-
`3f7003b65eadc74cd949857e831e1181a1aad2ff`. Workflow run `30063538271`, attempt 1,
|
|
98
|
-
successfully published that exact source as `borgmcp@2.0.10`; the registry records integrity
|
|
99
|
-
`sha512-BkFrq75mF7ih0/7Z7RsXsJYo43qNs4ng7tSnvcFCl3k6r+ex1FvTkah0+KQNinDSrv6a+HLWahUe8875so8zew==`.
|
|
100
|
-
Never move, replace, reuse, or rerun that tag or workflow.
|
|
101
|
-
|
|
102
|
-
The annotated `v2.0.11` tag object
|
|
103
|
-
`fb95f4278137d1d7871d945c467eb33984abe1c4` peels to protected-main commit
|
|
104
|
-
`0676d93d3e8a64ba583e95f164d122b39687b53a`. Workflow run `30073844074`, attempt 1,
|
|
105
|
-
successfully published that exact source as `borgmcp@2.0.11`; the registry records integrity
|
|
106
|
-
`sha512-429njJ7HVmWhpm8E71RoLzG57Qehy3RSxEzs6fQofVoOIiZXnK4QQDwbQe9MPfhKifbvVN5lGcDKtKAjuC76ww==`.
|
|
107
|
-
Never move, replace, reuse, or rerun that tag or workflow.
|
|
108
|
-
|
|
109
|
-
The annotated `v2.1.0` tag object
|
|
110
|
-
`e0b189bb0dd1f1b12369ab81870113925e1afc41` peels to protected-main commit
|
|
111
|
-
`10f18e4010c9c518c0ea2184d42ed5388642a53f`. Workflow run `30166498938`, attempt 1,
|
|
112
|
-
successfully published that exact source as `borgmcp@2.1.0`; the same-run artifact report records integrity
|
|
113
|
-
`sha512-Gm9n69y3C0feNDYRPEOnShLCscQJ/BoylcRMH+sDDQJmdcbjY8+U6dDTcFv3w+uH5P/IVwJydB8TGRHPXL0FQA==`.
|
|
114
|
-
Never move, replace, reuse, or rerun that tag or workflow.
|
|
115
|
-
|
|
116
|
-
The annotated `v2.1.1` tag object
|
|
117
|
-
`aa8d772c4791b2da16d702d5d78e5b3c365796c4` peels to protected-main commit
|
|
118
|
-
`db0a6a76744928e0067eb03b8a236076c56ae758`. Workflow run `30174878044`, attempt 1,
|
|
119
|
-
successfully published that exact source as `borgmcp@2.1.1`; the same-run artifact report records integrity
|
|
120
|
-
`sha512-nZJ3i6LBIj/4743mqVRJTUH3YGmC8HfC/NuQb7eOv+/K/dyBogDnwZ3opiZiZSe4LE5CXuG72Sip7cPRoCoZrA==`.
|
|
121
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.2.0` tag object
|
|
122
|
-
`edf12fcd4c56eb0ad59917269aaeee223b36bd53` peels to protected-main commit
|
|
123
|
-
`db4f374e88c24dadee47d5400537890cad1e5f40`. Workflow run `30195666955`, attempt 1,
|
|
124
|
-
successfully published that exact source as `borgmcp@2.2.0`; the same-run artifact report records integrity
|
|
125
|
-
`sha512-Pi3rpQH6f+V67OPoRIwyKjOFrCJ5y/39knCayExBmnMC5Urb8m+m9UQVNV7cWMuhd3S3WMM6JOkgcIYOVhWnxg==`.
|
|
126
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.3.0` tag object
|
|
127
|
-
`24b1f8622a0a0b542dbac26c70662f5b499d3426` peels to protected-main commit
|
|
128
|
-
`9e708b7233486abdcd7fbc893a2d5bc818241d87`. Workflow run `30218208664`, attempt 1,
|
|
129
|
-
successfully published that exact source as `borgmcp@2.3.0`; the same-run artifact report records integrity
|
|
130
|
-
`sha512-xyiyC/HXvWnSiii621WdA4qBKehmBzZSaLGN6PZvf82FQUqVONrRyhl1SmOLzPlPXX9boNKSA1EuaVJrtUv6zA==`.
|
|
131
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.4.0` tag object
|
|
132
|
-
`55458a1c38a670d3e15f8b19909afea195a146ce` peels to protected-main commit
|
|
133
|
-
`3882c22d7e8eca34a2213a4e2e4b1bf10dce8fe3`. Workflow run `30246632666`, attempt 1,
|
|
134
|
-
successfully published that exact source as `borgmcp@2.4.0`; the same-run artifact report records integrity
|
|
135
|
-
`sha512-dQ4jXxmubhtXhIxObTegYYMrgPVk2mZXNHFfV4MRwRWKr1TpQ4xXdmp3Qb89vOOOORvZlux6GNNS5kjy3wDvZw==`.
|
|
136
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.4.1` tag object
|
|
137
|
-
`1e42aac25fc5368f16334a1eb48ffd0524a3fe7f` peels to protected-main commit
|
|
138
|
-
`6b3b5d3c2c008888e55dd88485dafcb623ef9e17`. Workflow run `30282532108`, attempt 1,
|
|
139
|
-
successfully published that exact source as `borgmcp@2.4.1`; the same-run artifact report records integrity
|
|
140
|
-
`sha512-/tMVjZYqXQrZNPoZHjhpaS02e4Qju752sV+BLf9ML7yFmIf6DhzfItj9hDj/3+ORm6GK3aS4Fz4JmiWDxworZg==`.
|
|
141
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.5.0` tag object
|
|
142
|
-
`23132a4d71d42f59fd08bab66f0fe3da0114a15a` peels to protected-main commit
|
|
143
|
-
`771dd6e78e26744180b2470374790d0e91aad7d7`. Workflow run `30349154152`, attempt 1,
|
|
144
|
-
successfully published that exact source as `borgmcp@2.5.0`; the same-run artifact report records integrity
|
|
145
|
-
`sha512-BQ5vxtmxqD9V+dmPuGQaog8Ip+K+hbnCxmjZt0zX2v354x7gUZtIt5zmP3HTNe4A5rmO9sp4qvv7XA4gcAGNrg==`.
|
|
146
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.6.0` tag object
|
|
147
|
-
`c8598e1a1852a3690f53f7089a8342b53e2191da` peels to protected-main commit
|
|
148
|
-
`ef90006de0005e2fe2b35d36907a4656352e4abf`. Workflow run `30421261350`, attempt 1,
|
|
149
|
-
successfully published that exact source as `borgmcp@2.6.0`; the same-run artifact report records integrity
|
|
150
|
-
`sha512-KvJ5kuyMXH6Vd9tImV0zvXWhSj2Y68r09mAO3TqhsGAQM2XERcBPeEmrdp6VI1Z3KYMPjdg0bRvRW7CGonFl9w==`.
|
|
151
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.6.1` tag object
|
|
152
|
-
`e65b9d43c4a5a7c12a4fafc6e3f1024f6d99c023` peels to protected-main commit
|
|
153
|
-
`902847186f5c4fc00f3610ee027e8f929b977670`. Workflow run `30427148267`, attempt 1,
|
|
154
|
-
successfully published that exact source as `borgmcp@2.6.1`; the same-run artifact report records integrity
|
|
155
|
-
`sha512-N0NIsD2D39d98vvjMkcFwMSn/UXHuHMdMTcuk3awfo6t5FHyd7BYhBsQXhpDuvdJK/02S8g0OdvfHUb827siYQ==`.
|
|
156
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.0` tag object
|
|
157
|
-
`a9a7f75114548b6c383168164f0f59bb05c02b85` peels to protected-main commit
|
|
158
|
-
`a8d3c572dee3b90cf2a898768c45a1f46270fe11`. Workflow run `30440435955`, attempt 1,
|
|
159
|
-
successfully published that exact source as `borgmcp@2.7.0`; the same-run artifact report records integrity
|
|
160
|
-
`sha512-qn7ljuq/UwYzQJ5pWliLqD7Q5mlwk287ObOXbSV5FOcs+JdoXjFlb9NVC6bFoQzjHaWixCX600EAEtRZ0UeNPw==`.
|
|
161
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.1` tag object
|
|
162
|
-
`fc308b52393edf0ed8299490980207840a69c157` peels to protected-main commit
|
|
163
|
-
`41091978bfe02831863de26e75fdf3bb48d4b038`. Workflow run `30463299198`, attempt 1,
|
|
164
|
-
successfully published that exact source as `borgmcp@2.7.1`; the same-run artifact report records integrity
|
|
165
|
-
`sha512-hgxKTCAocbTsBV/YHIegn/jlG9a9YwdbOHD3s5mL+CsN61/5m180rvGJ8+RlNRd5Sdk408phc+QW2Li46tmTMg==`.
|
|
166
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.2` tag object
|
|
167
|
-
`0b16c38da15090a49b285e687fae45381f0f6812` peels to protected-main commit
|
|
168
|
-
`52b8a54565f548560dd674d689e0b841e2d8590d`. Workflow run `30491774435`, attempt 1,
|
|
169
|
-
successfully published that exact source as `borgmcp@2.7.2`; the same-run artifact report records integrity
|
|
170
|
-
`sha512-j/OKr5FzhnDbnLn4pNadbi6XQwR6hcmlfSQHuDsy696KYroL1UagIzelpLJXR+uR/T6FKbD2Zdphr/s81l1Rfw==`.
|
|
171
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.3` tag object
|
|
172
|
-
`b084eb3d2177fc93aa87ca58efde402542b90b8f` peels to protected-main commit
|
|
173
|
-
`83fadd1b308f2b770ce0d8da6a3b61183ec94f8d`. Workflow run `30618377765`, attempt 1,
|
|
174
|
-
successfully published that exact source as `borgmcp@2.7.3`; the same-run artifact report records integrity
|
|
175
|
-
`sha512-Jb+Kg/+H3cPU34JX7eFV3gEO/PzdfJEruNU1mJwYlQZKG7TMfrLJzwghDzxmlMupHJHL3rzAVZ224wioM/pclg==`.
|
|
176
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.8.0` tag object
|
|
177
|
-
`576e2401a83537662ef0d5f7b0d03d6101b15c54` peels to protected-main commit
|
|
178
|
-
`ad40e93ee9b1ff2801119c1c763ad526974ae2a6`. Workflow run `30639790368`, attempt 1,
|
|
179
|
-
successfully published that exact source as `borgmcp@2.8.0`; the same-run artifact report records integrity
|
|
180
|
-
`sha512-hKNyWwVg/8WJ/qcqaNjZVylMw2UzgFEhE7sAJmWy/BjNU4lEa6ox8N7SdbEt8hhKsySMxt+YTFbNFitRtf9u3g==`.
|
|
181
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.9.0` tag object
|
|
182
|
-
`26df119da33e914f857f820e68df6e887afed949` peels to protected-main commit
|
|
183
|
-
`895f12065c09ec5c0a35f770f26ec89f36f2feaa`. Workflow run `30695501563`, attempt 1,
|
|
184
|
-
successfully published that exact source as `borgmcp@2.9.0`; the same-run artifact report records integrity
|
|
185
|
-
`sha512-e10KK//zAP6xRDtUjCrLqzVyeX5zd/39JD4LksBhNVL0ZIGthu5ZLahPMrcCjGl6lZQHNTCo8Tez5c1jmThgGQ==`.
|
|
186
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.10.0` tag object
|
|
187
|
-
`83bd13fe9943c980760db6ecdbcef0d8c413cee0` peels to protected-main commit
|
|
188
|
-
`c5d3d2cbe85644d402dfd82ce108dceca3a913a1`. Workflow run `30764262636`, attempt 1,
|
|
189
|
-
successfully published that exact source as `borgmcp@2.10.0`; the same-run artifact report records integrity
|
|
190
|
-
`sha512-YUVxWevAToQYwu/MDV2r9TrKnaZxpYiEitmLtr7OekfyE0+XZnkyHmL1gSk04JAiYquzv6ZyTRDYMnjQzS5GxA==`.
|
|
191
|
-
Never move, replace, reuse, or rerun that tag or workflow. FAILED-SUPERSEDED release record: The annotated `v2.10.1` tag object
|
|
192
|
-
`afee30802629d0f838b2446efd2241ff01964af2` peels to protected-main commit
|
|
193
|
-
`fcecd75211107994ccd0df0bf4093240f83de9b2`. Workflow run `30766475027`, attempt 1, concluded `failure`
|
|
194
|
-
during verification before artifact creation or publication. Verify job `91545993819` records the release
|
|
195
|
-
artifact build, verification, exercise, and upload steps as skipped; publish job `91546125556` was skipped.
|
|
196
|
-
Registry verification found no published `borgmcp@2.10.1` package, so no published npm artifact or SRI
|
|
197
|
-
exists for that version as of this check.
|
|
198
|
-
Never delete, move, replace, reuse, or rerun that tag, version, or workflow. The annotated `v2.10.2` tag object
|
|
199
|
-
`3655b212c12617aa08cf76747a3b65a73b78e5cc` peels to protected-main commit
|
|
200
|
-
`bb8ff57162efdc777bb92f5e1f9d31aaf293d3c6`. Workflow run `30768860612`, attempt 1,
|
|
201
|
-
successfully published that exact source as `borgmcp@2.10.2`; the same-run artifact report records integrity
|
|
202
|
-
`sha512-uNeDidPLxZDe0E/RnQ35zaAMZwHcBbdpHrk+McQuV4lyBxoMSdf+MlBDHv7usijCtOBAUf+exlR/l4F9wVtvZg==`.
|
|
203
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.13.0` tag object
|
|
204
|
-
`67a2fd7bf76299dccc94a3260ddfd4b688eacaa1` peels to protected-main commit
|
|
205
|
-
`fc5e4d9299210b70f979c7d39130a9c12ea265ea`. Workflow run `30894287863`, attempt 1,
|
|
206
|
-
successfully published that exact source as `borgmcp@2.13.0`; the same-run artifact report records integrity
|
|
207
|
-
`sha512-YuF3NwY5iBRVKhgdRiK+3GX+6O8O7S/V9g+XYN/1A0so9RLIYoQWpS91qJewqGQ59nyIARjRmk2wKhK8ODxU0Q==`.
|
|
208
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.14.0` tag object
|
|
209
|
-
`eb9d5cb14b08b1a2eb6d48b2492acbc6cecb7bef` peels to protected-main commit
|
|
210
|
-
`4dd92bcbac26f460a4f137f766992e8f93843576`. Workflow run `30929322201`, attempt 1,
|
|
211
|
-
successfully published that exact source as `borgmcp@2.14.0`; the same-run artifact report records integrity
|
|
212
|
-
`sha512-haKgpQbcbaRya1XqYQaOy7yZiHMxeP8QO3fr7ahHaYDNYrDvlGmXNlW9VMtqnRJ9mtVDC5UTkeuQmCRJMzF/Tg==`.
|
|
213
|
-
Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.14.1` tag object
|
|
214
|
-
`c1c8b526dcc31259f6b821f0a6fdd0017a42435c` peels to protected-main commit
|
|
215
|
-
`3de4cbf2e5adf6883334fe4e9b7aa1f43868daae`. Workflow run `30943397747`, attempt 1,
|
|
216
|
-
successfully published that exact source as `borgmcp@2.14.1`; the same-run artifact report records integrity
|
|
217
|
-
`sha512-VqkOp3jo/KnzgusCk98TFj/U8U7Q/gt8agvIbjiSWrV0lIHnsD+A+7w3C+GMQeyA08KXxRuZDF3No9sDomqMTQ==`.
|
|
218
|
-
Never move, replace, reuse, or rerun that tag or workflow. The next candidate
|
|
219
|
-
uses the unused `v2.15.0` identity from a fresh reviewed protected-main commit
|
|
220
|
-
and requires the complete release gate again.
|
|
7
|
+
## Release Integrity
|
|
8
|
+
|
|
9
|
+
Release provenance is established by protected annotated tags, GitHub build
|
|
10
|
+
provenance, and npm Trusted Publishing. Tags and publication workflows are
|
|
11
|
+
immutable: never move, replace, reuse, or rerun them.
|
|
221
12
|
|
|
222
13
|
## Release Prerequisites
|
|
223
14
|
|
|
@@ -246,76 +37,11 @@ Before creating the release tag, independently verify all of these conditions:
|
|
|
246
37
|
machine-checkable. A release tag created before they are resolved fails before
|
|
247
38
|
dependency installation or publication.
|
|
248
39
|
|
|
249
|
-
### Release
|
|
250
|
-
|
|
251
|
-
Prepare the next stable identity only from a clean protected-main checkout. The
|
|
252
|
-
command requires evidence for the version being superseded because a workflow
|
|
253
|
-
run and artifact integrity cannot be derived from the repository tree:
|
|
254
|
-
|
|
255
|
-
```sh
|
|
256
|
-
npm run release:prepare -- 2.3.0 \
|
|
257
|
-
--workflow-run-id 30195666955 \
|
|
258
|
-
--workflow-run-attempt 1 \
|
|
259
|
-
--artifact-integrity 'sha512-...'
|
|
260
|
-
```
|
|
261
|
-
|
|
262
|
-
The command independently verifies the annotated tag, its peeled commit, the
|
|
263
|
-
exact successful tag-workflow attempt, and npm artifact integrity before writing
|
|
264
|
-
anything. It then deterministically updates only the manifest version, the two
|
|
265
|
-
root lockfile version fields, the extraction ledger, this document's immutable
|
|
266
|
-
release record, and the release-lane current-version/evidence assertions.
|
|
267
|
-
|
|
268
|
-
When the superseded tag's attempt failed before artifact creation or publication,
|
|
269
|
-
prepare the fresh recovery identity with `--workflow-conclusion failure` and omit
|
|
270
|
-
`--artifact-integrity` entirely. The preparer verifies the annotated tag and exact
|
|
271
|
-
failed workflow attempt, writes a canonical failed-superseded record stating that
|
|
272
|
-
the artifact build, verification, exercise, upload, and publish phases were all
|
|
273
|
-
skipped, and separately re-verifies the last published release as the artifact
|
|
274
|
-
provenance anchor. It also reads the authoritative registry version list before
|
|
275
|
-
writing the time-bounded fact that no published npm artifact or SRI exists for
|
|
276
|
-
the failed version. This recovery-time absence check is required before preparing
|
|
277
|
-
the replacement identity; it is not the prohibited post-publication readback of
|
|
278
|
-
the newly published release. A failed record carrying an SRI, a failed run whose
|
|
279
|
-
artifact or publish phase ran, a failed version present in the registry, or a
|
|
280
|
-
successful record without an SRI is invalid. Failed tags and workflow attempts
|
|
281
|
-
stay immutable and must never be moved, reused, or rerun.
|
|
282
|
-
|
|
283
|
-
```sh
|
|
284
|
-
npm run release:prepare -- 2.10.2 \
|
|
285
|
-
--workflow-run-id 30766475027 \
|
|
286
|
-
--workflow-run-attempt 1 \
|
|
287
|
-
--workflow-conclusion failure
|
|
288
|
-
```
|
|
40
|
+
### Release branches
|
|
289
41
|
|
|
290
42
|
Release branches use the `release/` prefix and enter protected `main` through a
|
|
291
|
-
pull request.
|
|
292
|
-
|
|
293
|
-
authority, or release authority.
|
|
294
|
-
|
|
295
|
-
For a pull request from a same-repository `release/` branch, the dedicated
|
|
296
|
-
release-identity workflow is loaded from the exact protected base commit. It
|
|
297
|
-
checks out that base, fetches the exact candidate commit into the Git object
|
|
298
|
-
database without checking it out, and invokes the base commit's verifier with
|
|
299
|
-
explicit base and candidate SHAs. It does not install or execute candidate
|
|
300
|
-
dependencies, package scripts, workflow code, actions, or verifier code. The
|
|
301
|
-
candidate is treated only as Git tree and blob data.
|
|
302
|
-
|
|
303
|
-
To reproduce the classification locally, resolve and pass exact commit SHAs:
|
|
304
|
-
|
|
305
|
-
```sh
|
|
306
|
-
base_sha=$(git rev-parse origin/main)
|
|
307
|
-
candidate_sha=$(git rev-parse HEAD)
|
|
308
|
-
npm run verify:release-identity -- --base "$base_sha" --candidate "$candidate_sha"
|
|
309
|
-
```
|
|
310
|
-
|
|
311
|
-
The verifier rechecks the recorded provenance against GitHub, npm, and Git. It
|
|
312
|
-
reconstructs the expected tree in a temporary Git index and requires exact tree
|
|
313
|
-
equality, exact changed paths, and exact per-file shapes. The release-identity
|
|
314
|
-
allowlist must remain byte-identical. The generated no-cloud occurrence allowlist
|
|
315
|
-
must also remain byte-identical; any source-line renumbering makes the commit a
|
|
316
|
-
code change rather than a release-identity change. A commit the classifier
|
|
317
|
-
rejects follows the full code review chain and must never be manually declared
|
|
318
|
-
identity-only.
|
|
43
|
+
pull request. Direct pushes only update staging branches; publication still
|
|
44
|
+
requires the complete protected release gate.
|
|
319
45
|
|
|
320
46
|
## Repository Controls
|
|
321
47
|
|