codemble 0.22.0__tar.gz → 0.23.0__tar.gz

{codemble-0.22.0 → codemble-0.23.0}/.github/workflows/ci.yml

@@ -94,11 +94,19 @@ jobs:
       - name: Escape surfaces
         if: ${{ !cancelled() }}
         run: cd web && CODEMBLE_URL=http://127.0.0.1:8899 npm run check:escape
+      - name: Study text containment
+        if: ${{ !cancelled() }}
+        run: cd web && CODEMBLE_URL=http://127.0.0.1:8899 npm run check:text
       # Owns separate project-bound and unbound-picker servers with disposable
       # data roots, then exercises the repaired journeys in both browser engines.
       - name: User-flow repairs
         if: ${{ !cancelled() }}
         run: cd web && npm run check:userflows
+      # Owns a disposable TLS endpoint and proves the capability viewer in both
+      # engines without connecting the local preview to upload or cloud state.
+      - name: Private share delivery
+        if: ${{ !cancelled() }}
+        run: cd web && npm run check:share-delivery
   package-check:
     runs-on: ubuntu-latest
     steps:
@@ -109,4 +117,4 @@ jobs:
       - name: Build wheel and verify packaged SPA
         run: |
           python -m pip wheel . --no-deps --wheel-dir /tmp/codemble-wheel
-          python -c 'import pathlib, zipfile; wheel = next(pathlib.Path("/tmp/codemble-wheel").glob("*.whl")); names = zipfile.ZipFile(wheel).namelist(); assert "codemble/web_dist/index.html" in names; assert any(name.startswith("codemble/web_dist/assets/") for name in names)'
+          python -c 'import pathlib, zipfile; wheel = next(pathlib.Path("/tmp/codemble-wheel").glob("*.whl")); archive = zipfile.ZipFile(wheel); names = archive.namelist(); metadata = archive.read(next(name for name in names if name.endswith(".dist-info/METADATA"))).decode(); assert "codemble/web_dist/index.html" in names; assert "codemble/share/http_delivery.py" in names; assert "codemble/share/persistent_storage.py" in names; assert "Requires-Dist: cryptography<51,>=45" in metadata; assert any(name.startswith("codemble/web_dist/assets/") for name in names)'

{codemble-0.22.0 → codemble-0.23.0}/CHANGELOG.md

@@ -5,6 +5,146 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) · Versioning:
 
 ## [Unreleased]
 
+## [0.23.0] - 2026-09-25
+
+### Documentation
+- Align the README, public site, installation guides, artifact ledger, and
+  release notes with v0.23.0, pin public assets to the exact tag, and refresh
+  Study captures with the selected world visible beside its parser evidence.
+
+### Dependencies
+- Accept cryptography 50, tree-sitter-go 0.25, tree-sitter-rust 0.24, and
+  JetBrains Mono 5.3 after focused compatibility, semantic-oracle, real-corpus,
+  package, and full-suite verification.
+
+### Fixed
+- Product capture now fixes the visible project label to `Codemble`, making the
+  committed screenshots reproducible from arbitrarily named clones and
+  worktrees, and parses a Git-filtered source snapshot so ignored build output
+  cannot alter the public counts.
+- Missing scheduled-maintenance locks now fail startup instead of silently
+  skipping the service, making failures eligible for the existing alert relay.
+  The preflight also rejects paths that do not resolve to regular files.
+
+### Performance
+- Avoid repeated whole-project scans while resolving Python import namespaces and generating check options, preserving parser meaning and pinned check answers.
+
+### Added
+- Seeded ocean, ice, rocky, and banded worlds with cloud cover, relief lighting,
+  thin atmospheres, a granular Sun, and layered nebula scenery. Surface patterns
+  are illustrative; parser-owned positions, roles, routes, and progress retain
+  their existing meanings.
+- Study now frames the selected world beside source evidence, with slimmer
+  close-up routes and live reduced-motion support. System panels leave more
+  space for exploration and orbit explanations no longer overlap world names.
+- A local `ShareArtifact` interface now compiles the render-ready graph into an
+  immutable read-only snapshot with per-artifact keyed IDs, source-ID-independent
+  collision-aware placement, RFC 8785 canonical bytes, an exact payload digest,
+  source-safe provenance, and an absolute expiry capped at 30 days. It adds no
+  upload, provider, account, or cloud request.
+- A local share workbench now makes the privacy boundary visible before delivery:
+  choose a one-, seven-, or thirty-day lifetime, opt into names and learner
+  understanding separately, inspect the exact canonical artifact and its digest,
+  then acknowledge only the fields present. Its same-origin preview and
+  confirmation routes retain one candidate in process memory and expose no upload
+  capability.
+- A provider-neutral capability module now issues independent 256-bit view and
+  deletion capabilities for one immutable artifact, stores only derived lookup,
+  reuse-detection, and capability-keyed authentication values, irreversibly
+  tombstones observed expiry, revalidates the closed schema, relationships,
+  digests, and bound storage identity, and atomically revokes access with
+  retry-safe results even across a server-clock rollback.
+  Its reference adapter is process-local; no provider or cloud storage is
+  enabled.
+- A standalone share-delivery application now serves one immutable capability
+  over HTTPS-only `GET`, accepts confirmed revocation only through a protected
+  deletion-capability header, context-encodes artifact labels into a script-free
+  viewer, and normalizes every bearer-bearing or unknown target before ASGI access
+  logging. It is not connected to the local preview or any upload route.
+- One trusted Share Artifact interpreter now validates canonical bytes and
+  derives the preview and delivery facts consumed by every boundary. The
+  compiler lays out and summarizes the exact deduplicated relationship
+  projection it serializes while separately validating the parser's full graph.
+- The Share Preview Run now owns the complete choose, compile, inspect,
+  acknowledge, confirm, restart, and project-release lifecycle, including stale
+  response refusal and focus handoffs, instead of spreading that state between
+  the session and dialog.
+- A zero-license-cost operations reference uses Caddy, restic, and rest-server
+  with separate append-only writer and local operator roles. It adds hourly
+  sweep/backup and daily full-data-check/prune commands, pinned restic bytes,
+  operator-managed Caddy configuration and a fixed absolute rest-server path,
+  closed configuration templates, a process-serialized create-only Retirement
+  Journal that advances only after two named authenticated repositories return
+  snapshot- and entry-bound receipts, role-local credential-derived deployment
+  attestations, independent journal materialization, application-host-local
+  production restore with writer-journal rehydration, a stable application-host
+  operation lock outside the replaceable store whose root-owned parent is not
+  replaceable by the non-root writer, with trusted-directory and inode checks
+  plus process-level exclusion proof for writer and root-operator transitions.
+  The public writer cycle acquires that lock before opening its store or journal,
+  every writer-owned sibling path is pre-provisioned, and root restores verify a
+  recursive ownership handoff to the configured non-root writer before promotion.
+  Exact snapshot retirement stays behind a durable creation seal, with
+  repository-bound finite whole-key-store retirement authorization.
+  Hardware, storage, DNS, electricity, and network access may still cost money.
+- Scheduled writer, operator, and append-only receiver failures now enter one
+  provider-neutral alert relay. It writes a closed token-free event to a private
+  root-owned spool before invoking a digest-pinned local notifier, retries a
+  failed handoff with the same alert ID, and keeps delivered evidence separate
+  from the next failure. Real channel delivery remains an operational gate.
+
+### Privacy
+- Raw source, snippets, filesystem paths, dedicated filename metadata, file
+  hashes, source positions, external targets, narration/provider data, checks,
+  visits, recents, and logs are excluded. Source-derived labels (which can still
+  reveal file or module names) and learner understanding are separate,
+  false-by-default publisher choices. The compiler closes language/schema/value
+  bounds, rejects contradictory or incomplete certain relationships, recomputes
+  Home/routes/orbits over represented edges, and deduplicates viewer marks.
+- Preview and confirmation responses are `no-store`, accept strict JSON bodies,
+  bind confirmation to the current preview ID and payload digest, and disappear
+  with the active project or process. A confirmed preview creates no link and
+  performs no outbound or cloud request.
+- Invalid, expired, and revoked view capabilities have one indistinguishable
+  result. Deletion requires an explicit confirmation, removes active bytes on
+  the first atomic revocation, and retains only a non-serving tombstone so a
+  lost response can be retried without restoring access. Raw capabilities and
+  artifact bytes are excluded from storage-record representations.
+- Every viewer, revocation, validation-error, and not-found response carries
+  `no-store`, `no-referrer`, a self-contained restrictive CSP, no-index and
+  opener/resource isolation headers. Lifecycle logs accept only an internal share
+  ID, UTC timestamp, closed operation, and closed outcome; raw capabilities,
+  request targets, artifacts, IP addresses, and User-Agent data have no logging
+  interface. A failed telemetry sink is non-authoritative and cannot strand an
+  active share or change view/revocation state. Chromium and WebKit verify no
+  cookie or other browser storage, service worker, or third-party request is created.
+- Backups bind the authenticated database digest and backup-repository identity
+  to the exact Retirement Journal fully anchored high-water and immutable
+  name-to-repository replica inventory, captured before the SQLite snapshot so a
+  concurrent retirement cannot be skipped. Restore requires independently
+  materialized replicas and their repository-bound receipts to agree, replays
+  every later revocation or expiry, rehydrates the writer journal, and fails
+  closed on gaps, forks, stale copies, or missing rollback authority. Only the
+  independently held operator role can check, restore, prune, inventory, or
+  remove snapshots. Explicit removal installs an authenticated durable seal that
+  closes later creates and writer cycles, then deletes only the exact live
+  inventory; final authorization re-queries that repository rather than
+  accepting caller-asserted emptiness. The separately held recovery-key copy
+  must authenticate the same active storage key while role-local attestations
+  prove authority credentials stay different without bringing both secret
+  configurations together.
+  The local compiler and exact disclosure preview ship connected in v0.23.0,
+  while capability persistence, standalone delivery, backup, and operations
+  remain disconnected from public delivery. Public share delivery stays blocked
+  until the intended independent node, timers, alerts, restore drill, deletion
+  deadline, and approved media-erasure procedure are observed in operation.
+
+### Release boundary
+- v0.23.0 publishes the graphics, local learning experience, dependency updates,
+  documentation, local-only share preview, and disconnected delivery foundations.
+  It does not connect an upload or public delivery route and makes no
+  operational-erasure claim.
+
 ## [0.22.0] - 2026-08-25
 
 ### Added