xytara 2.9.0 → 2.10.0

package/RELEASE_NOTES.md

@@ -1,75 +1,11 @@
-# xytara 2.9.0 Release Notes
+# xytara 2.10.0 Release Notes
 
-`xytara` 2.9.0 is the public-polish release line for canonical Naxytra product URLs and safer first-contact runtime guidance.
+`xytara` 2.10.0 is the release-hygiene and launch-polish line for current-release-only package notes, safer first-contact docs, and stronger release-candidate packaging checks.
 
 Highlights:
 
-- moves the package homepage and funding URL to `https://naxytra.com/xytara`
-- removes standalone product-domain assumptions from current launch guidance
-- replaces older wallet-secret and txid-led first-contact examples with the quote-first `xytara first-run --run-quote` path
-- keeps the 2.8.0 release-boundary hardening around provider promotion, treasury claims, pricing guardrails, and read-only operator observability intact
-- prepares the synchronized Naxytra 2.9.0 line for a cleaner public website, npm, and release verification pass
-
-# xytara 2.8.0 Release Notes
-
-`xytara` 2.8.0 is the release-boundary hardening line for live-provider promotion discipline, treasury/operator public-claim safety, and pricing experiment guardrails.
-
-Highlights:
-
-- adds framework-provider promotion evidence gates so LangGraph/LangChain style claims stay reference-contract until endpoint, auth, health, latency, failure, and proof-fact evidence exists
-- hardens pricing experiment planning and launch gates so optimization remains sample-maturity and operator-review gated
-- hardens treasury public claim boundaries so public surfaces do not leak landing/custody/provider refs or promote readiness-only/internal rails as live
-- hardens operator observability boundaries so read-only views cannot drift into mutation, settlement submission, fund movement, unsafe attention actions, or secret-bearing control behavior
-- keeps the 2.7.0 clean-consumer packaging and release-smoke posture intact while making expansion claims more defensible
-
-# xytara 2.7.0 Release Notes
-
-`xytara` 2.7.0 is the expansion-closeout release line for package-hardening, clean-consumer release smoke testing, and disciplined adapter/product claim boundaries.
-
-Highlights:
-
-- ships `scripts/` in the npm artifact so packaged verification commands are available to consumers
-- adds release-candidate guards that fail if required verifier scripts are missing from `npm pack`
-- participates in the Naxytra release-smoke harness that installs packed tarballs into a clean consumer project before synchronized release
-- keeps the 2.6.0 expansion capabilities and adapter surfaces intact while closing the packaging reliability gap
-
-# xytara 2.6.0 Release Notes
-
-`xytara` 2.6.0 is the expansion release line for first-run execution polish, provider-backed adapter depth, and framework reference adapters while preserving the existing machine-commerce, settlement, observability, and release surfaces.
-
-Highlights:
-
-- umbrella CLI entrypoint with `xytara start-here`, plus `xytara run` and `xytara release`
-- public first-run quote and credits-first execution posture for outside builders
-- provider-backed `adapter.mcp.invoke` depth with concrete MCP tool binding
-- executable LangGraph and LangChain reference framework adapters with manifests and proof-compatible execution facts
-- adapter verifier coverage for provider and framework execution posture
-- read-only operator observability across activity, payment, delivery, settlement, external credit grants, adapter failures, and pricing telemetry
-- first-class public contract lanes for `OpenAPI`, `AsyncAPI`, and `CloudEvents`
-- first-class provider, framework, protocol, and integration-matrix discovery surfaces
-- surfaced runtime breadth across `MCP`, `A2A`, `A2C`, `x402`, `Stripe MPP`, stablecoins, major rails, treasury, and registry-backed integrations
-- surfaced framework and ecosystem breadth including `LangGraph`, `LangChain`, `AutoGen`, `Semantic Kernel`, `CrewAI`, and `LlamaIndex`
-- surfaced protocol and transport breadth including `ACP`, `gRPC`, `Kafka`, `NATS`, `MQTT`, `ROS2`, and webhook event bus posture
-- first-class observability, provenance, artifact-distribution, shared-signals, and feature-control lanes
-- clearer install-and-use posture for humans, developers, and agents without widening the native runtime core
-- existing wallet / authority / identity / trust / capability / pricing / participation foundations remain in place
-
-Recommended first checks:
-
-1. `npm install xytara`
-2. `xytara start-here`
-3. `npm run verify:release-candidate`
-4. `node examples/partner_launch_walkthrough.js`
-5. inspect `/v1/providers`, `/v1/frameworks`, `/v1/protocols`, and `/v1/integration-matrix`
-6. inspect `/v1/adapter-depth/summary` and `/v1/operator-observability/summary`
-7. inspect `/v1/mcp`, `/v1/a2a`, `/v1/a2c`, `/v1/x402`, and `/v1/settlement`
-8. inspect `/v1/telemetry`, `/v1/provenance`, `/v1/artifact-distribution`, `/v1/shared-signals`, and `/v1/feature-control`
-9. inspect `/v1/economics/accounts/:account_id/wallet-ledger-bundle`
-10. inspect `/v1/economics/accounts/:account_id/network-participation-package`
-
-Recommended first docs:
-
-- `PROGRAM_COMPLETE_RELEASE.md`
-- `FINAL_CONTRACT.md`
-- `WHY_XYTARA_XOONYA.md`
-- `PARTNER_READY_PATH.md`
+- keeps `RELEASE_NOTES.md` scoped to the current release so npm and GitHub release notes do not read like a rolling changelog
+- adds a release-candidate guard that fails when package release notes contain prior release headings or drift from the package version
+- replaces the remaining soft-launch wallet-secret and txid example with the quote-first public first-run path
+- keeps the canonical `https://naxytra.com/xytara` public product URL and website polish intact
+- prepares the synchronized Naxytra 2.10.0 line for a cleaner npm, GitHub, website, and post-deploy verification pass

package/lib/release_history.js

@@ -10,6 +10,18 @@ function buildReleaseHistory() {
     current_version: packageJson.version,
     release_track: "public_release",
     history: [
+      {
+        version: "2.10.0",
+        channel: "public_release",
+        maturity_posture: "release_hygiene",
+        headline: "release-hygiene line with current-release-only notes, package verifier guards, and safer first-contact soft-launch guidance",
+        milestone_refs: [
+          "current_release_only_release_notes",
+          "release_notes_packaging_guard",
+          "soft_launch_quote_first_guidance",
+          "synchronized_2_10_release_prep"
+        ]
+      },
       {
         version: "2.9.0",
         channel: "public_release",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xytara",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "description": "Agent-commerce runtime for quote, pay, execute, deliver, meter, and integrate.",
   "main": "index.js",
   "bin": {

package/scripts/verify_release_candidate.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const assert = require("assert");
+const fs = require("fs");
 const path = require("path");
 const { execFileSync, execSync } = require("child_process");
 const packageJson = require("../package.json");
@@ -14,6 +15,29 @@ function parsePackDryRun() {
   return Array.isArray(parsed) ? parsed[0] : parsed;
 }
 
+function verifyReleaseNotes() {
+  const notesPath = path.resolve(__dirname, "..", "RELEASE_NOTES.md");
+  const notes = fs.readFileSync(notesPath, "utf8");
+  const headings = (notes.match(/^#\s+xytara\s+\d+\.\d+\.\d+\s+Release Notes\s*$/gm) || [])
+    .map((heading) => heading.trim());
+  assert.deepStrictEqual(
+    headings,
+    [`# xytara ${packageJson.version} Release Notes`],
+    "RELEASE_NOTES.md must contain only the current xytara release heading"
+  );
+  assert.strictEqual(
+    notes.includes(`xytara\` ${packageJson.version}`),
+    true,
+    "RELEASE_NOTES.md must mention the current package version"
+  );
+  const mentionedVersions = notes.match(/\b\d+\.\d+\.\d+\b/g) || [];
+  assert.strictEqual(
+    mentionedVersions.every((version) => version === packageJson.version),
+    true,
+    "RELEASE_NOTES.md must not mention prior package versions"
+  );
+}
+
 function main() {
   const releaseOutput = execFileSync(process.execPath, [
     path.resolve(__dirname, "..", "bin", "xytara-release.js"),
@@ -27,6 +51,7 @@ function main() {
   assert.strictEqual(releaseCandidate.product, "xytara", "release candidate product mismatch");
   assert.strictEqual(releaseCandidate.publish_access, "public", "release candidate publish access mismatch");
   assert.strictEqual(releaseCandidate.checklist_count >= 5, true, "release candidate checklist count mismatch");
+  verifyReleaseNotes();
 
   const dryRun = parsePackDryRun();
   assert.strictEqual(dryRun.name, packageJson.name, "npm pack dry-run name mismatch");