software-defence-factory 0.15.0 → 0.15.1

package/docs/npm.md

@@ -94,6 +94,18 @@ jobs and history are preserved. Existing processes keep their original code.
 Set `SDF_AUTO_UPDATE=0` to skip automatic network checks for a command.
 Source checkouts remain managed by Git and do not update themselves.
 
+The exact selected release is downloaded with npm's `--prefer-online` metadata
+refresh and `--prefer-offline=false`; this does not change account settings.
+An `ETARGET` visibility failure
+gets at most three attempts, separated by one second, within the same total
+120-second download budget (including waits). Offline, authentication and package
+identity errors are not retried by Factory. A successful download must match the
+requested package name, version and CLI entry before immutable adoption. Exhaustion
+cleans only that download's staging directory and retains the selected runtime,
+configuration and job history. Managed updates release their idle reservations on
+download failure; normal reservation/recovery rules in [services](services.md)
+still apply. The retries add no extra download maintenance budget.
+
 CLI updates do not rebuild or update Docker images automatically. Stop the
 installation and run `install --state PATH` when intentionally adopting a new
 runtime image; repeat the relevant qualification before resuming jobs. Install retains the old and new
@@ -104,8 +116,8 @@ installation or retained attempt needs them.
 
 ## Protected evidence compatibility
 
-Factory 0.15.0 recognizes version-1 execution profiles emitted by native
-**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1, 0.11.2, 0.12.0, 0.13.0, 0.13.1, 0.14.0 and 0.15.0**. This is an exact allowlist in
+Factory 0.15.1 recognizes version-1 execution profiles emitted by native
+**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1, 0.11.2, 0.12.0, 0.13.0, 0.13.1, 0.14.0, 0.15.0 and 0.15.1**. This is an exact allowlist in
 `factory/execution-profile.mjs`, independent of the installed package version;
 it is not a semver range or an automatic promise for later releases. Unknown
 runtime strings, unknown profile formats and incomplete legacy acceptance
@@ -172,7 +184,7 @@ Verify evidence and cannot authorize acceptance or publication.
 
 Version 0.14.0 preserves the v1 writer only for unchanged inherited installations:
 policy bytes, candidate/check/review/acceptance bindings, mounts and credential
-rules stay compatible. Adopted role overrides use **v2 from 0.14.0 and 0.15.0**, recording
+rules stay compatible. Adopted role overrides use **v2 from 0.14.0, 0.15.0 and 0.15.1**, recording
 role/provider/effort and an exact selection digest. The executor verifies the
 frozen common configuration before phase selection; continuation and both delivery
 validation paths require matching protected v2 evidence and private frozen config.
@@ -199,6 +211,15 @@ publishes an increased `package.json` version. Existing versions are skipped;
 registry errors fail the release instead of masquerading as a missing version.
 The workflow can also be started manually from `main`.
 
+An accepted npm publication may still be processing. It is not yet a verified,
+downloadable release: exact-version and `latest` metadata can appear at different
+times, and an npm install can briefly report `ETARGET` even after both appear.
+Verify an exact package download and compare its contents with the reviewed
+artifact before reporting release availability. If the bounded updater reports
+that the release is not yet downloadable, retain the prior runtime and retry the
+update later. This does not establish whether a particular delay came from a
+local cache or registry propagation.
+
 For a release, update both manifests with `npm version patch --no-git-tag-version`,
 review the change, and push through the project's normal review flow. A code
 push without a version bump is tested but does not overwrite a published package.
@@ -233,7 +254,7 @@ The 0.15.0 compatibility audit preserves unchanged v1/v2 policy construction,
 protected checks, candidate reconstruction, read-only review and acceptance guards.
 Historical 0.14.0 v2 validation compares its actual writer version rather than
 relabeling it as the installed version. Local registry selection is a new execution
-contract: every phase of a local/hybrid attempt requires **v3 from 0.15.0** and its
+contract: every phase of a local/hybrid attempt requires **v3 from 0.15.0 or 0.15.1** and its
 exact protected frozen configuration. v1/v2 cannot attest local binding fields,
 providers or a common policy containing a selected local role. A selected endpoint,
 model, limit or compatibility change invalidates the current policy; explicit
@@ -241,3 +262,9 @@ rollback can restore it without editing historical evidence. Controlled regressi
 exercise legacy v2 readback and local v3 rejection/tamper cases. Installed-package
 Docker and independent Review remain delivery qualification, not inferred from this
 compatibility audit.
+
+The 0.15.1 patch changes release downloads and preserves the 0.15.0 v1/v2/v3
+writers, frozen configuration and policy bytes. The explicit allowlists include
+both patch versions; supported v3 readback retains the original writer version
+while still comparing every execution selection, phase and policy field. It does
+not rewrite historical evidence or allow v1/v2 to attest local bindings.

package/factory/execution-profile.mjs

@@ -21,16 +21,17 @@ import { expectedWebStories, webPolicyHash } from './web-verification.mjs';
 // selection digest. V1 can never attest an adopted role override.
 // 0.15.0 keeps unchanged v1/v2 policies and writers; local selections require
 // v3 for every phase. Legacy evidence cannot attest the new registry/launcher.
+// 0.15.1 changes release downloads only; v1/v2/v3 writers and policy are unchanged.
 // Older writers still require exact patch/tree reconstruction before publication.
 // Deliberately independent of VERSION: a release bump is not
 // evidence compatibility. Re-audit this list for every trust-relevant writer,
 // isolation or validation change; remove versions whose guarantees no longer
 // satisfy current policy. See docs/npm.md. This predicate alone grants no trust.
-const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2', '0.12.0', '0.13.0', '0.13.1', '0.14.0', '0.15.0']);
+const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2', '0.12.0', '0.13.0', '0.13.1', '0.14.0', '0.15.0', '0.15.1']);
 
 export function isSupportedExecutionProfile(profile) {
-  if ([2, 3].includes(profile?.version)) return (profile.version === 3 ? profile.runtimeVersion === '0.15.0' && Object.hasOwn(profile, 'localBinding')
-    : ['0.14.0', '0.15.0'].includes(profile.runtimeVersion) && !Object.hasOwn(profile, 'localBinding') && profile.inferenceProvider !== 'factory-local')
+  if ([2, 3].includes(profile?.version)) return (profile.version === 3 ? ['0.15.0', '0.15.1'].includes(profile.runtimeVersion) && Object.hasOwn(profile, 'localBinding')
+    : ['0.14.0', '0.15.0', '0.15.1'].includes(profile.runtimeVersion) && !Object.hasOwn(profile, 'localBinding') && profile.inferenceProvider !== 'factory-local')
     && profile.role === (Object.keys(ROLE_PHASES).find(role => ROLE_PHASES[role] === profile.phase) || null)
     && (profile.reasoningEffort === null || ['low', 'medium', 'high'].includes(profile.reasoningEffort))
     && /^[a-f0-9]{64}$/.test(profile.selectionHash || '');
@@ -132,7 +133,7 @@ export function assertFrozenExecution(config, execution, phase) {
   delete expected.hostName;
   // Audited legacy writers retain their real version. Never let v1/v2 attest
   // a local binding, including a deterministic phase of a hybrid attempt.
-  if (expected.version < 3 && isSupportedExecutionProfile(execution) && execution.version === expected.version)
+  if (isSupportedExecutionProfile(execution) && execution.version === expected.version)
     expected.runtimeVersion = execution.runtimeVersion;
   const actual = { ...execution }; delete actual.hostName; delete actual.workerName;
   if (!isDeepStrictEqual(expected, actual)) throw new Error('Admitted execution profile does not match this attempt');

package/factory/updates.mjs

@@ -65,17 +65,33 @@ function installedEntry(dataHome, version) {
     return pkg.name === PACKAGE && pkg.version === version && existsSync(entry) ? entry : null;
   } catch { return null; }
 }
-export function installRelease(version, dataHome = DATA_HOME, runner = spawnSync) {
+export function installRelease(version, dataHome = DATA_HOME, runner = spawnSync, {
+  now = () => performance.now(),
+  sleep = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms),
+} = {}) {
   if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error('Invalid release version');
   const existing = installedEntry(dataHome, version);
   if (existing) return existing;
   const releases = join(dataHome, 'releases'); privateDir(releases);
   const staging = mkdtempSync(join(releases, '.download-'));
   try {
-    const result = runner('npm', ['install', '--prefix', staging, '--no-save', '--package-lock=false',
-      '--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund', '--registry', REGISTRY, `${PACKAGE}@${version}`],
-      { encoding: 'utf8', timeout: 120000, maxBuffer: 1024 * 1024 });
-    if (result.error || result.status !== 0) throw new Error(`npm update download failed: ${result.error?.message || result.stderr || result.status}`);
+    // Metadata refresh and visibility retries share the original download budget.
+    // Only ETARGET is retried; offline/auth/identity failures keep their own errors.
+    const deadline = now() + 120000;
+    for (let attempt = 1; attempt <= 3; attempt++) {
+      const remaining = Math.floor(deadline - now());
+      if (remaining <= 0) throw new Error(`npm update download failed for ${PACKAGE}@${version}: 120-second download budget exhausted`);
+      const result = runner('npm', ['install', '--prefix', staging, '--no-save', '--package-lock=false',
+        '--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund', '--prefer-online', '--prefer-offline=false', '--registry', REGISTRY, `${PACKAGE}@${version}`],
+        { encoding: 'utf8', timeout: remaining, killSignal: 'SIGKILL', maxBuffer: 1024 * 1024 });
+      if (!result.error && result.status === 0) break;
+      const detail = result.error?.message || result.stderr || result.status;
+      const visibilityDelay = !result.error && /^npm (?:ERR!|error) code ETARGET\s*$/m.test(result.stderr || '');
+      if (!visibilityDelay) throw new Error(`npm update download failed for ${PACKAGE}@${version}: ${detail}`);
+      if (attempt === 3 || deadline - now() <= 1000)
+        throw new Error(`npm release ${PACKAGE}@${version} is not yet downloadable; publication may still be processing. Retry the update later. ${detail}`);
+      sleep(1000);
+    }
     const pkg = read(join(staging, 'node_modules', PACKAGE, 'package.json'));
     if (pkg.name !== PACKAGE || pkg.version !== version || !existsSync(join(staging, 'node_modules', PACKAGE, 'bin/software-defence-factory.mjs')))
       throw new Error('Downloaded package identity does not match the requested release');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "software-defence-factory",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Factory: scoped software delivery and defence investigations with isolated jobs, evidence and review",
   "type": "module",
   "license": "MIT",