chore(release): freecut-editor-surface 0.3.2 - #14
Conversation
Version bump so the 0.3.2 npmjs publish is reproducible from a real repo commit (provenance gate). Content delta vs 0.3.1 is PR #13: host bridge round-trip stability, host-mode timeline shortcuts, and the host-mode cross-origin audio fix.
|
@codepress /judge-verification can you judge this verification? Local VerificationPR Head SHA: Scope: version bump Diff Trigger Inventory
Convention check: PR #12's 0.3.1 bump (a188efa) touched only this same line; Verification Contract ResultsMinimal gate set for a version-only change, all executed at the bound head in worktree
Head/tree binding captured after all gates: Disclosed caveats
Overall: PASS |
|
👋 Hey @lightninglu10! Spawning a verification judge session to help with your request. View session |
|
Dispatched by judge-verification. This judgment is READY TO MERGE at the current head. If the PR is still a draft, transition it to ready for review now with the guarded readiness transaction: Verification Judgment — PR #14 (local)Verdict: ✅ READY TO MERGE PR Head SHA: Summary: The report is bound to the live PR head, and the audited delta is only the editor-surface package version line. The versioned package pack, provenance check, reproducible artifact, and static checks cover the only behavior introduced: publishing the editor surface as version 0.3.2 from this commit. The disclosed non-rerun runtime and fallow gates do not cover changed code, dependencies, or configuration, so they do not affect this manifest-only judgment. Revision binding
Diff trigger inventory
Per-item
Overall status check
What stood up
|
|
Starting initial review of |
![codepress-reviewer-dev[bot]](https://avatars.githubusercontent.com/in/3963614?s=60&v=4){kind=small}
There was a problem hiding this comment.
Request changes: this release commit does not match its stated npmjs publication target.
packages/freecut-editor/package.json still configures the editor surface for https://npm.pkg.github.com. The package script enforces that registry, and the tag-based publish workflow publishes to it as well. Consequently, a normal release of version 0.3.2 from this commit would go to GitHub Packages, not npmjs.
Please bring the public-npm release configuration into this branch, or update the intended release target and provenance claim so they accurately describe the artifact this version will produce.
Reviewed `c3615a37`...`bdaaa613`. Diff collection and GitHub posting were handled by the automation.
|
Review head |
The package manifest keeps publishConfig pointed at GitHub Packages (the CI tag/dispatch target, enforced by package-editor-surface.mjs), but CodePress consumes @quantfive/freecut-editor-surface from npmjs and the repo has no NPM_TOKEN secret, so npmjs releases are a manual maintainer step. Add scripts/publish-editor-surface-npmjs.mjs (root script publish:editor-surface:npmjs) that runs the provenance + deterministic pack + fresh-consumer smoke preflight and then publishes the exact tarball to https://registry.npmjs.org with --access=public; --dry-run validates without publishing. Document both release targets in the package README and refresh the provenance package.json checksums.
|
Starting new changes review of |
|
Thanks — the finding was correct: the manifest's
Validated at this head: |
|
@codepress /judge-verification can you judge this verification? Local VerificationPR Head SHA: Scope: version bump Diff Trigger Inventory
No runtime code changed. The GitHub Packages registry assertion in Verification Contract ResultsGates executed at the bound head in worktree
Red/green evidence for the release-path fix: before refreshing the provenance checksums, Head/tree binding captured after all gates: Disclosed caveats
Overall: PASS |
|
👋 Hey @lightninglu10! Spawning a verification judge session to help with your request. View session |
There was a problem hiding this comment.
The separate manual npmjs publisher resolves the earlier registry-target concern: the manifest and CI workflow can remain on GitHub Packages, while the public release explicitly overrides only the publish command.
One blocking provenance issue remains.
- Critical — bind the public artifact to a clean, merged checkout (
scripts/publish-editor-surface-npmjs.mjs:36): The new script does not check the worktree or release ref before it rebuilds and publishes. Its provenance check does not hash the editor-surface source tree, so uncommitted source changes can be packaged by the consumer-smoke step and published as the official npmjs version. Add a clean-worktree check and confirm the checked-out commit is on the intended staging release ref before packaging (or build from a verified detached commit). This makes the documented “reproducible from a real repo commit” claim true for the artifact that reaches npmjs.
|
Dispatched by judge-verification. This judgment is READY TO MERGE at the current head. If the PR is still a draft, transition it to ready for review now with the guarded readiness transaction: Verification Judgment — PR #14 (local)Verdict: ✅ READY TO MERGE PR Head SHA: Summary: The report is bound to the live PR head and its clean-tree capture is explicit. The six-file diff adds a focused manual npmjs release path while preserving the GitHub Packages CI target; the reported provenance, packaging, fresh-consumer smoke, lint, type, format, and changed-health evidence covers the material behavior. The real npmjs publication is intentionally deferred to the maintainer after merge and is not required to establish that this release path is safe to merge. Revision binding
Diff trigger inventory
Per-item
Overall status check
What stood up
|
Per maintainer direction the editor surface is a public package now. publishConfig targets https://registry.npmjs.org with public access and package-editor-surface.mjs enforces exactly that; the tag/dispatch workflow publishes to npmjs with NODE_AUTH_TOKEN from the NPM_TOKEN repo secret (a repo admin must add it before tag publishes work). The manual maintainer path (publish:editor-surface:npmjs) stays as the fallback and drops its registry/access overrides now that the manifest is canonical. README release docs updated; GitHub Packages is no longer a target.
|
Follow-up on the release-target finding: per maintainer direction the package is public now, so
Dry-run at this head: |
|
@codepress /judge-verification can you judge this verification? Local VerificationPR Head SHA: Scope: version bump Diff Trigger Inventory
No runtime code changed. Verification Contract ResultsGates executed at the bound head in worktree
Head/tree binding captured after all gates: Disclosed caveats
Overall: PASS |
|
Starting new changes review of |
|
👋 Hey @lightninglu10! Spawning a verification judge session to help with your request. View session |
There was a problem hiding this comment.
Architecture checkpoint
The release-target architecture is now coherent: the package manifest is the canonical public npmjs source of truth, the pack gate enforces it, and both CI and the manual publisher consume that same target. That resolves the earlier GitHub Packages/nmpjs mismatch without retaining a competing release path.
One critical provenance boundary remains in the manual publisher.
- Critical — bind the manual artifact to a clean merged checkout (
scripts/publish-editor-surface-npmjs.mjs:51): The script begins its preflight and rebuilds the tarball without checking either the worktree or the release ref. The provenance verifier does not hash the editor-surface source tree, while the consumer smoke invokes the pack command against the live checkout. A maintainer can therefore publish uncommitted source as the official public version even though the preflight passes, contradicting the claim that the release is reproducible from the merged staging commit. Before packaging, reject a non-emptygit status --porcelainand verify that HEAD is the intended merged staging release revision (or package from a verified detached commit).
Once that guard binds the manual release artifact to its committed source, the aligned npmjs configuration and existing pack/smoke checks are sufficient for this release path.
Reviewed `e445b29f`...`c821b57d`. Diff collection and GitHub posting were handled by the automation.
|
Dispatched by judge-verification. This judgment is READY TO MERGE at the current head. If the PR is still a draft, transition it to ready for review now with the guarded readiness transaction: Verification Judgment — PR #14 (local)Verdict: ✅ READY TO MERGE PR Head SHA: Summary: The report is bound to the live PR head and includes explicit post-gate head and clean-tree capture. A separate clean detached checkout confirms the reported eight-file, 128-insertion/38-deletion diff, with no runtime source, dependency, lockfile, schema, or generated-artifact change. The public npmjs manifest target, fail-closed pack gate, deterministic packaging, exact-tarball consumer smoke, manual npmjs dry-run, and CI publish wiring cover the material release behavior. The deferred mutating publish and required Revision binding
Diff trigger inventory
Per-item
Overall status check
What stood up
|
Reviewer finding: the manual publish script rebuilt and preflighted without checking the worktree or release ref, so uncommitted source could ship as the official public version. The script now requires an explicit --ref <sha> (or --ref HEAD) and refuses before any build step — in dry-run mode too — unless the tree is clean, HEAD equals --ref, and --ref is an ancestor of origin/staging. Guard behavior is covered by scripts/publish-editor-surface-npmjs.test.mjs (node --test, 7 cases: clean/match/ancestor acceptance, dirty tree, HEAD mismatch, non-staging ref, missing ref, unresolvable ref) wired as test:publish-editor-surface-guards. README documents the --ref flow; provenance checksums refreshed for the root manifest change.
|
Good catch — fixed in Guards (run first, in Tests: the repo's scripts test convention is Live red/green at this head:
README's manual path now documents the |
|
Starting new changes review of |
|
@codepress /judge-verification can you judge this verification? Local VerificationPR Head SHA: Scope: version bump Diff Trigger Inventory
No runtime code changed. Verification Contract ResultsGates executed at the bound head in worktree
Head/tree binding captured after all gates: Disclosed caveats
Overall: PASS |
|
👋 Hey @lightninglu10! Spawning a verification judge session to help with your request. View session |
There was a problem hiding this comment.
Architecture checkpoint
The release path is now coherent and appropriately bounded. The manifest remains the single canonical npmjs/public target; the manual publisher adds a narrow provenance gate around the external publish operation rather than creating another release configuration.
Before it can build anything, the publisher now requires a clean worktree, an explicit --ref that resolves to the checked-out HEAD, and ancestry from origin/staging. Those checks run in dry-run mode as well, and the new focused tests exercise the accepted staging checkout plus dirty, mismatched, unrelated, missing, and unresolvable-ref failures. This closes the prior path where a maintainer could smoke-test and publish uncommitted editor-surface source.
No actionable findings. Approving the current head.
Reviewed `c821b57d`...`27133c50`. Diff collection and GitHub posting were handled by the automation.
|
Dispatched by judge-verification. This judgment is READY TO MERGE at the current head. If the PR is still a draft, transition it to ready for review now with the guarded readiness transaction: Verification Judgment — PR #14 (local)Verdict: ✅ READY TO MERGE PR Head SHA: Summary: The current PR head is safe to merge. The report is bound to the live head with a captured clean verifier tree, and an independent clean detached checkout confirms the same revision. The diff's material release behavior is covered: the package is explicitly public on npmjs, the pack gate rejects the old registry/private configuration, the manual publisher rejects dirty, mismatched, or unmerged revisions before preflight, and the exact artifact passes consumer smoke. Actual publication is intentionally deferred; the missing CI Revision binding
Diff trigger inventory
No Per-item
Overall status check
Becomes What stood up
|
1 participant
Version bump
@quantfive/freecut-editor-surface0.3.1 → 0.3.2 so the release is reproducible from a real repo commit (provenance requirement).Content delta vs 0.3.1 is exactly PR #13 (squash c3615a3): host bridge round-trip stability, host-mode timeline shortcuts, and the host-mode cross-origin audio fix.
Release target: public npmjs (canonical). The package is public now, so
publishConfiginpackages/freecut-editor/package.jsontargetshttps://registry.npmjs.orgwith"access": "public"andscripts/package-editor-surface.mjsenforces exactly that (fail-closed: verified it rejects the old GitHub Packages registry). GitHub Packages is no longer a target.Two release paths, both to npmjs:
NODE_AUTH_TOKENfrom theNPM_TOKENrepo secret. Action needed: a repo admin must addNPM_TOKEN(npm automation token with publish rights on@quantfive) before tag publishes work — no secret is configured today.npm run publish:editor-surface:npmjs -- --ref <merged-staging-sha>from a clean checkout of the merged staging commit. The script refuses anything else: clean tree, HEAD ==--ref, and--refan ancestor oforigin/stagingare all required before the preflight (provenance + deterministic pack + fresh-consumer smoke) and publish — guards run in--dry-runtoo and are unit-tested (test:publish-editor-surface-guards, 7/7).Validated pre-merge: dirty-tree and unmerged-head dry-runs correctly refuse; post-merge-equivalent dry-run (temp clone, staging advanced to this head) is green end-to-end: "Publishing to https://registry.npmjs.org with tag latest and public access (dry-run)". Publish intentionally not done here.