simt-dev 0.6.0__tar.gz → 0.6.2__tar.gz

{simt_dev-0.6.0 → simt_dev-0.6.2}/CHANGELOG.md

@@ -6,6 +6,30 @@ All notable changes to this package are recorded here. The format follows
 
 ## [Unreleased]
 
+## [0.6.2] — 2026-10-27
+
+### Fixed
+
+The v0.6.1 tag run failed its own tests step: two decision-corpus lists in
+`test/rules.test.mjs` were not moved with ADR-099 (the partial-supersession
+shapes and the leaking-paths count, both designed to move with the corpus).
+Same product as v0.6.1; this tag exists so the release automation is proven by
+a green run rather than described by a red one.
+
+## [0.6.1] — 2026-10-27
+
+### Fixed
+
+The release automation, which the v0.6.0 tag proved broken in two places. The
+tag workflow compared CI-built binaries against locally-built committed
+checksums, but the build is deterministic per host family, not across them —
+the check could never pass, and darwin binaries cannot be finished on ubuntu
+runners for lack of `codesign` anyway. Each target now builds on its native
+runner, the release verifies the served bytes equal the built bytes, and a
+`sync-formula` job re-renders the committed formula from the served bytes
+(ADR-099). The formula description no longer starts with an article, which is
+what failed the Homebrew channel's `brew style` on v0.6.0. No product change.
+
 ## [0.6.0] — 2026-10-27
 
 ### Added

{simt_dev-0.6.0 → simt_dev-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simt-dev
-Version: 0.6.0
+Version: 0.6.2
 Summary: An intelligence amplifier for AI coding agents: rules and dual gates adopted by one command, plus local retrieval, task briefs, benches and repo memory — deterministic by default, with local-model adapters that propose and never select.
 Project-URL: Homepage, https://github.com/QuazarMedia/simt-dev
 Project-URL: Repository, https://github.com/QuazarMedia/simt-dev

{simt_dev-0.6.0 → simt_dev-0.6.2}/docs/decisions/ADR-098-the-fourth-channel-is-one-file-and-it-needs-no-toolchain.md

@@ -5,7 +5,7 @@ simt-supersedes: [{ adr: "ADR-058", ruling: 5 }, { adr: "ADR-058", ruling: 7, ki
 
 # ADR-098 — The fourth channel is one file, and it needs no toolchain
 
-Status: **accepted** · 2026-10-26 · supersedes ADR-058 ruling 5 · narrows ADR-058 ruling 7 and ADR-097 ruling 3 · supersedes ADR-059 ruling 3
+Status: **accepted** · 2026-10-26 · supersedes ADR-058 ruling 5 · narrows ADR-058 ruling 7 and ADR-097 ruling 3 · supersedes ADR-059 ruling 3 · ruling 3's cross-host byte-identicality narrowed by [ADR-099](ADR-099-the-release-verifies-served-bytes-and-the-formula-mirrors-them.md)
 
 Affects: `scripts/build-sea.mjs`, `src/distribute/release.mjs`, `src/locate.mjs`,
 `src/hooks/shim.mjs`, `src/ci/workflow.mjs`, `.github/workflows/publish.yml`,

simt_dev-0.6.2/docs/decisions/ADR-099-the-release-verifies-served-bytes-and-the-formula-mirrors-them.md

@@ -0,0 +1,79 @@
+---
+simt-affects: [".github/workflows/publish.yml", "scripts/build-sea.mjs", "scripts/verify-release-asset.mjs", "Formula/simt-dev.rb"]
+simt-supersedes: [{ adr: "ADR-098", ruling: 3, kind: "narrowed" }]
+---
+
+# ADR-099 — the release verifies served bytes, and the formula mirrors them
+
+Status: **accepted** · 2026-10-27 · narrows ADR-098 ruling 3
+
+Affects: `.github/workflows/publish.yml`, `scripts/build-sea.mjs`,
+`scripts/verify-release-asset.mjs`, `Formula/simt-dev.rb`
+
+## Context
+
+ADR-098 ruling 3 made determinism the release contract in its strongest form: the
+same tree builds byte-identical assets on any host, so the tag workflow rebuilds
+each asset and fails when its checksum is not the one `Formula/simt-dev.rb` in the
+tagged tree promises. The v0.6.0 tag proved the strong form false. The CI-built
+`linux-x64` asset hashed to `809dcda7…` while the same tree built on a darwin host
+hashed to `b55bffc2…` — and the local rebuild is reproducible, so the difference is
+the host, not the tree. The SEA blob is generated by a node running on the build
+host, and a darwin-generated blob and a linux-generated blob of the same tree
+differ. A check comparing CI bytes against locally-built committed checksums can
+therefore never pass, and keeping it means every release fails at tag time for a
+reason no tree change can fix.
+
+The same run surfaced the second defect in the arrangement: all three targets built
+on `ubuntu-latest`, but darwin binaries are finished with `codesign`, which exists
+only on macOS. The darwin jobs never ran anywhere before v0.6.0 — v0.5.0 predates
+the binary channel — so the runner assignment was never exercised either.
+
+## Ruling
+
+1. **Each target builds on its native runner.** `darwin-arm64` and `darwin-x64` on
+   `macos-14`, `linux-x64` on `ubuntu-latest`, with `fail-fast: false` so one
+   target's failure no longer cancels the others. Determinism is per host family —
+   the same tree rebuilt on the same OS family hashes identically — and the matrix
+   is what makes that claim checkable instead of aspirational.
+
+2. **The release checks upload integrity, not cross-host equality.** After uploading
+   each asset, the workflow downloads what GitHub serves for it
+   (`scripts/verify-release-asset.mjs`) and fails when the served sha256 is not the
+   one the build just wrote. A torn or clobbered upload graduates into a release
+   nobody can detect any other way; the tap installing bytes whose checksum refuses
+   them is exactly that failure arriving on somebody else's machine.
+
+3. **The committed formula is a mirror, refreshed after the release moves it — never
+   a prediction.** A `sync-formula` job renders `Formula/simt-dev.rb` from the
+   served bytes with `scripts/release-formula.mjs` and commits it to `main` when it
+   changed. A re-run that finds the mirror current exits quietly, and a formula
+   that already names a newer version is left alone, so an older tag can never
+   rewrite a newer mirror. The tap push (`publish-channels.yml`) already renders
+   from served bytes, so it was correct by construction throughout; this closes the
+   loop for the in-repo copy.
+
+## Consequences
+
+- **The v0.6.0 equality check is gone, and its premise with it.** Nothing in the
+  release compares bytes built on different hosts. The `build-sea.mjs` header no
+  longer claims cross-host byte-identicality.
+- **The formula in a tagged tree is the previous release's mirror, and that is
+  stated rather than hidden.** Between the tag and `sync-formula`'s commit it names
+  the served bytes of the last release, which is what makes it a mirror and not a
+  promise.
+- **`verify-release-asset.mjs` is runnable by hand.** It takes `--version` and
+  `--target` and answers whether the release serves what a build of this tree
+  wrote — the same question the workflow asks, askable from any checkout.
+
+## Rejected
+
+- **Generating one blob on one host and sharing it across targets.** It would make
+  the three assets share a blob while their node bases still differ per target, so
+  cross-host equality would still fail at the base — the part this repository does
+  not build. Sharing would add artifact plumbing to preserve a comparison the
+  release no longer makes.
+- **Committing the formula from the tag before the assets exist.** That restores the
+  prediction in a new place: the committed checksums would again be bytes no
+  download has served, and the first thing that reads them (the tap) would read a
+  promise instead of a record.

{simt_dev-0.6.0 → simt_dev-0.6.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "simt-dev",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "An intelligence amplifier for AI coding agents: rules and dual gates adopted by one command, plus local retrieval, task briefs, benches and repo memory — deterministic by default, with local-model adapters that propose and never select.",
   "license": "Apache-2.0",
   "author": "Said Elimam",

{simt_dev-0.6.0 → simt_dev-0.6.2}/src/ci/workflow.mjs

@@ -128,13 +128,15 @@ function header(own) {
  * is the release a reader recognises, and Dependabot's `github-actions` ecosystem
  * rewrites the pair together - which is why the pin needs no maintenance here.
  *
- * The major version is deliberately the one the templates already used rather than the
- * newest available. `checkout` v7 and `setup-node` v7 both carry breaking changes, and
- * a gate whose behaviour changes because somebody re-ran an updater is precisely what
- * pinning exists to prevent. Moving a major is one reviewed line in this table.
+ * The major version moves by review, not by updater. `checkout` stayed on v4 while v7
+ * carried breaking changes a gate should not absorb by re-running Dependabot; it moved
+ * to v7.0.1 when the v7 line had run green in this repository's own workflows (the
+ * checkout steps of the v7 Dependabot run all succeeded — only the template-drift
+ * tests failed, which is the pin doing its job). `setup-node` stays on v4: no run has
+ * yet proven a newer major here, and moving it is the same one reviewed line.
  */
 export const ACTIONS = {
-  checkout: { repo: 'actions/checkout', commit: '11d5960a326750d5838078e36cf38b85af677262', release: 'v4.4.0' },
+  checkout: { repo: 'actions/checkout', commit: '3d3c42e5aac5ba805825da76410c181273ba90b1', release: 'v7.0.1' },
   setupNode: { repo: 'actions/setup-node', commit: '49933ea5288caeca8642d1e84afbd3f7d6820020', release: 'v4.4.0' },
 };