xoonya 2.9.0 → 2.10.0

package/RELEASE_NOTES.md

@@ -1,81 +1,11 @@
-# xoonya 2.9.0 Release Notes
+# xoonya 2.10.0 Release Notes
 
-`xoonya` 2.9.0 is the public-polish release line for canonical Naxytra product URLs while preserving the XNYA native-standard boundaries from 2.8.0.
+`xoonya` 2.10.0 is the release-hygiene and standard-boundary polish line for current-release-only package notes and stronger release-candidate packaging checks.
 
 Highlights:
 
-- moves the package homepage and funding URL to `https://naxytra.com/xoonya`
-- keeps Xoonya positioned as the proof product path under the single Naxytra public website
-- preserves the XNYA-compatible conformance mark, JavaScript reference implementation, Python candidate scaffold, Rust source-only boundary, and hybrid/PQ design gate
-- keeps external proof import truth boundaries intact for JWT, DID/VC, SD-JWT VC, signed-envelope, detached assertion, and partner proof material
-- prepares the synchronized Naxytra 2.9.0 line for a cleaner public website, npm, and release verification pass
-
-# xoonya 2.8.0 Release Notes
-
-`xoonya` 2.8.0 is the XNYA standard-hardening line for conformance marks, reference implementation promotion discipline, cross-language scaffold evidence, PQ/hybrid design gating, and external proof truth boundaries.
-
-Highlights:
-
-- exposes the XNYA-compatible conformance mark with explicit artifact, vector, error-code, and forbidden-claim boundaries
-- adds the XNYA reference implementation plan and promotion gate so JavaScript remains canonical while Python/Rust require independent vector, crypto, round-trip, conformance, and forbidden-claim evidence before promotion
-- adds Python XNYA atom/payload/frame, proof-bundle, and optional Ed25519 crypto verifier scaffolds without overclaiming full second-reference status
-- packages the Rust XNYA source scaffold while keeping it unpromoted until real Rust toolchain compilation and vector parity exist
-- adds native hybrid/PQ design-gate vectors and deterministic rejection so PQ/hybrid remains visible but not claimable as live verification
-- hardens external proof import truth boundaries for JWT, DID/VC, SD-JWT VC, signed-envelope, detached assertion, and partner proof material
-- keeps the 2.7.0 packaged conformance and clean-consumer release-smoke posture intact while making native-standard claims more defensible
-
-# xoonya 2.7.0 Release Notes
-
-`xoonya` 2.7.0 is the expansion-closeout release line for package-hardening, clean-consumer release smoke testing, and disciplined native-standard claim boundaries.
-
-Highlights:
-
-- ships `scripts/` in the npm artifact so `xoonya conformance` and `xoonya first-run --verify-native` work from a clean npm install
-- adds release-candidate guards that fail if conformance verifier scripts are missing from `npm pack`
-- participates in the Naxytra release-smoke harness that installs packed tarballs into a clean consumer project before synchronized release
-- keeps the 2.6.0 XNYA native, payload, line-rate frame, import-adapter, and standardization capabilities intact while closing the packaging reliability gap
-
-# xoonya 2.6.0 Release Notes
-
-`xoonya` 2.6.0 is the expansion release line for Xoonya Native standard hardening, external proof import, native signed and anchored verification, and strict XNYA payload/frame profile work.
-
-Highlights:
-
-- umbrella CLI entrypoint with `xoonya start-here`, plus `xoonya review` and `xoonya release`
-- `xoonya-native-signed-v1` verification with Ed25519, secp256k1, and P-256 through the explicit signature-suite registry
-- `xoonya-native-anchored-v1` anchor binding for chain, finality, batch, content-hash, and external attestation refs without claiming external provider truth
-- `xoonya-native-payload-profile/v1` with `XNYP` binary payload canonicalization, typed fields, fixed-width integers, canonical ordering, and unknown-field policy checks
-- `xoonya-native-line-rate-frame/v1` as an optional 60/72-byte transport fast-reject wrapper around existing `XNYA` atoms
-- native payload profile vectors and line-rate frame vectors
-- external proof import adapter for JWT, DID/VC, SD-JWT VC, detached assertions, signed envelopes, and partner proof envelopes
-- native hybrid/PQ readiness and standardization packs that keep `xoonya-native-hybrid-v1` design-gated until validators and vectors are real
-- first-class public contract lanes for `OpenAPI`, `AsyncAPI`, and `CloudEvents`
-- first-class provider, framework, and integration-matrix discovery surfaces for the proof side
-- surfaced proof breadth across `proof-bridge`, `external-proof-import`, `result-package-trust`, major rails, treasury, and registry-backed integrations
-- surfaced observability, provenance, artifact-distribution, shared-signals, and feature-control lanes for proof operations and trust
-- explicit proof-role freeze, role-transition, and capability-registry-home posture remain in place
-- canonical event, receipt, and proof-bundle model remain the proof center while external compatibility stays adapter-friendly
-- clearer install-and-use posture for reviewers, operators, outside builders, and proof-carry integrations
-
-Recommended first checks:
-
-1. `npm install xoonya`
-2. `xoonya start-here`
-3. `npm run verify:release-candidate`
-4. `node examples/partner_proof_walkthrough.js`
-5. inspect `/v1/proof-center/native-standard/summary`
-6. inspect `/v1/proof-center/native-payload-profile/summary`
-7. inspect `/v1/proof-center/native-line-rate-frame/summary`
-8. inspect `/v1/proof-center/import-adapter/summary`
-9. inspect `/v1/providers`, `/v1/frameworks`, `/v1/integration-matrix`, and `/v1/proof-bridge`
-10. inspect `/v1/telemetry`, `/v1/provenance`, `/v1/artifact-distribution`, `/v1/shared-signals`, and `/v1/feature-control`
-11. inspect `/v1/role-freeze/package`
-12. inspect `/v1/role-transition` and `/v1/capability-registry-home`
-13. inspect `/v1/proof-center/summary` on the deployed service
-
-Recommended first docs:
-
-- `PROGRAM_COMPLETE_RELEASE.md`
-- `FINAL_CONTRACT.md`
-- `WHY_XYTARA_XOONYA.md`
-- `PARTNER_READY_PATH.md`
+- keeps `RELEASE_NOTES.md` scoped to the current release so npm and GitHub release notes do not read like a rolling changelog
+- adds a release-candidate guard that fails when package release notes contain prior release headings or drift from the package version
+- preserves the XNYA-compatible conformance mark, native reference implementation boundaries, external proof import boundaries, and PQ/hybrid design gate
+- keeps the canonical `https://naxytra.com/xoonya` public product URL and single Naxytra website positioning intact
+- prepares the synchronized Naxytra 2.10.0 line for a cleaner npm, GitHub, website, and post-deploy verification pass

package/lib/release_history.js

@@ -10,6 +10,18 @@ function buildReleaseHistory() {
     current_version: packageJson.version,
     release_track: "public_release",
     history: [
+      {
+        version: "2.10.0",
+        channel: "public_release",
+        maturity_posture: "release_hygiene",
+        headline: "release-hygiene line with current-release-only notes and package verifier guards while preserving native-standard claim boundaries",
+        milestone_refs: [
+          "current_release_only_release_notes",
+          "release_notes_packaging_guard",
+          "xnya_claim_boundary_preserved",
+          "synchronized_2_10_release_prep"
+        ]
+      },
       {
         version: "2.9.0",
         channel: "public_release",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xoonya",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "description": "Deterministic proof and review engine for receipts, handoffs, governance, and verification.",
   "main": "index.js",
   "bin": {

package/scripts/verify_release_candidate.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const assert = require("assert");
+const fs = require("fs");
 const path = require("path");
 const { execFileSync, execSync } = require("child_process");
 const packageJson = require("../package.json");
@@ -14,6 +15,29 @@ function parsePackDryRun() {
   return Array.isArray(parsed) ? parsed[0] : parsed;
 }
 
+function verifyReleaseNotes() {
+  const notesPath = path.resolve(__dirname, "..", "RELEASE_NOTES.md");
+  const notes = fs.readFileSync(notesPath, "utf8");
+  const headings = (notes.match(/^#\s+xoonya\s+\d+\.\d+\.\d+\s+Release Notes\s*$/gm) || [])
+    .map((heading) => heading.trim());
+  assert.deepStrictEqual(
+    headings,
+    [`# xoonya ${packageJson.version} Release Notes`],
+    "RELEASE_NOTES.md must contain only the current xoonya release heading"
+  );
+  assert.strictEqual(
+    notes.includes(`xoonya\` ${packageJson.version}`),
+    true,
+    "RELEASE_NOTES.md must mention the current package version"
+  );
+  const mentionedVersions = notes.match(/\b\d+\.\d+\.\d+\b/g) || [];
+  assert.strictEqual(
+    mentionedVersions.every((version) => version === packageJson.version),
+    true,
+    "RELEASE_NOTES.md must not mention prior package versions"
+  );
+}
+
 function main() {
   const releaseOutput = execFileSync(process.execPath, [
     path.resolve(__dirname, "..", "bin", "xoonya-release.js"),
@@ -27,6 +51,7 @@ function main() {
   assert.strictEqual(releaseCandidate.product, "xoonya", "release candidate product mismatch");
   assert.strictEqual(releaseCandidate.publish_access, "public", "release candidate publish access mismatch");
   assert.strictEqual(releaseCandidate.checklist_count >= 5, true, "release candidate checklist count mismatch");
+  verifyReleaseNotes();
 
   const conformanceOutput = execFileSync(process.execPath, [
     path.resolve(__dirname, "..", "bin", "xoonya.js"),