pi-ptc-subagents 1.5.0 → 1.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +56 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
9
9
|
|
|
10
10
|
(nothing yet)
|
|
11
11
|
|
|
12
|
+
## [1.5.1] - 2026-10-08
|
|
13
|
+
|
|
14
|
+
### Fixed
|
|
15
|
+
|
|
16
|
+
- **Two claims 1.5.0's changelog made about this repository were false, and are now corrected in
|
|
17
|
+
the repository itself.** 1.5.0's tarball still carries the original wording — published tarballs
|
|
18
|
+
are immutable — so the correction lives here, in `main`, and in
|
|
19
|
+
[ADR-0031](./docs/adr/0031-open-source-and-publish-authority.md)'s amendment blocks:
|
|
20
|
+
- _"The repository is public … release authority is enforced by a `refs/tags/v*` ruleset."_ The
|
|
21
|
+
repository was still private at 1.5.0's release, and no ruleset existed. Both were done
|
|
22
|
+
2026-10-08, hours after the gap was measured: the flip, then an active ruleset (id 24698892)
|
|
23
|
+
on `refs/heads/main` — no pushes, no merges, no deletions, no force-pushes except by
|
|
24
|
+
`a1121611810` as sole bypass actor, with one approving review and green `format` / `oxlint` /
|
|
25
|
+
`test` checks required for everyone else.
|
|
26
|
+
- _"The next version published from here carries an npm provenance attestation."_ No published
|
|
27
|
+
version through 1.5.0 has one, because the provenance precondition (a public source
|
|
28
|
+
repository) only became true with the flip above. **1.5.1 is the first version whose
|
|
29
|
+
precondition held** — see `dist.attestations` on the registry.
|
|
30
|
+
|
|
31
|
+
How the false claims shipped: they were written as decisions in an earlier session
|
|
32
|
+
(`c1dda59`), recorded as facts, and every gate in this repository checks the shape of a claim —
|
|
33
|
+
that a `file:line` resolves, that a constant matches a rule — not whether the thing a sentence
|
|
34
|
+
describes exists. Five review rounds and a green release gate passed them. The same class of
|
|
35
|
+
gap is recorded in `docs/testing-constraints.md` §"What the gate does not check".
|
|
36
|
+
|
|
37
|
+
### Added
|
|
38
|
+
|
|
39
|
+
- **`docs/prototypes/` — the bgdispatch design records, recovered from research branches.** The
|
|
40
|
+
ten research branches deleted in the run-up to going public carried twelve verdict /
|
|
41
|
+
measurement / prototype files that had never been merged to `main`: the records of _why_ the
|
|
42
|
+
background-dispatch design is what it is. They were recovered before the branches were deleted;
|
|
43
|
+
`AGENTS.md` treats records as load-bearing.
|
|
44
|
+
- **`.mailmap`**, so the public commit history displays `a1121611810` instead of the 224-character
|
|
45
|
+
padded name that authored 309 commits. No history rewrite.
|
|
46
|
+
|
|
47
|
+
### Changed
|
|
48
|
+
|
|
49
|
+
- **`.gitignore` gains `.zcode/` and `.scratch/`.** `.zcode/` was previously protected only by two
|
|
50
|
+
nested self-ignoring `.gitignore` files that are themselves untracked. `.scratch/` (local ticket
|
|
51
|
+
drafts, content duplicated on GitHub Issues) is removed from tracking.
|
|
52
|
+
- **Twelve research / feature branches and two `backup/undo-*` tags deleted from the remote.**
|
|
53
|
+
They carried the developer's machine-local paths (`/Users/lilianda`) that `main` had already
|
|
54
|
+
scrubbed; GitHub publishes every ref, not just `main`, so a public reader could have clicked
|
|
55
|
+
into them. Content was verified present in `main` (or recovered above) before each deletion.
|
|
56
|
+
Four routine `dependabot/*` bumps remain as open branches for the maintainer to review.
|
|
57
|
+
- **`docs/prototypes/**` excluded from oxlint.** The recovered files are measurement scripts and
|
|
58
|
+
were never part of the linted source; they are records, not production code.
|
|
59
|
+
- **The npm mirror noted during the audit turned out to be local configuration, not the
|
|
60
|
+
lockfile** — `pnpm-lock.yaml` carries no registry URLs at all.
|
|
61
|
+
|
|
12
62
|
## [1.5.0] - 2026-10-08
|
|
13
63
|
|
|
14
64
|
### Added
|
|
@@ -50,10 +100,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
50
100
|
`refs/tags/v*` ruleset plus the npm package's "Require two-factor authentication and disallow
|
|
51
101
|
tokens" setting, so it no longer depends on where a credential file is kept
|
|
52
102
|
([ADR-0031](./docs/adr/0031-open-source-and-publish-authority.md) §A–§B).
|
|
103
|
+
~~**Measured 2026-10-08: this did not happen.** The repository is still private and no ruleset
|
|
104
|
+
exists — see §Unreleased above and ADR-0031's correction block. The npm 2FA setting is unverified
|
|
105
|
+
and is not claimed here.~~
|
|
53
106
|
- **The next version published from here carries an npm provenance attestation.** Under trusted
|
|
54
107
|
publishing npm generates it automatically once the source repository is public, with no workflow
|
|
55
108
|
change — so the `homepage` and `repository` fields that pointed at a private GitHub now resolve,
|
|
56
109
|
and the missing provenance badge that ADR-0018 §7 recorded as expected is no longer expected.
|
|
110
|
+
~~**Measured 2026-10-08: this is false and always was.** `dist.attestations` is empty for every
|
|
111
|
+
published version including 1.5.0; the repository was never public, so the precondition never
|
|
112
|
+
held and ADR-0018 §7 stands unamended.~~
|
|
57
113
|
- **`node scripts/preview-ptc-render.mjs` requires `PI_ROOT`.** It imported pi's theme from a hard-coded
|
|
58
114
|
path on one developer's machine, so following the README from anywhere else failed inside a
|
|
59
115
|
module loader. It now reads the install directory from the environment and, when it is missing or
|