From 9658e37e2369a4cd07515a88db2654b5ca46162a Mon Sep 17 00:00:00 2001 From: TensorNull Date: Mon, 27 Jul 2026 15:36:53 +0800 Subject: [PATCH] docs: mark public preview complete --- CHANGELOG.md | 3 ++- README.md | 14 ++++++++------ ROADMAP.md | 45 +++++++++++++++++++++++++-------------------- SECURITY.md | 6 ++---- 4 files changed, 37 insertions(+), 31 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 82f7983..7e86f6b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,8 @@ follows Keep a Changelog, and versions follow Semantic Versioning. ## [Unreleased] -No user-visible changes are currently recorded beyond the initial alpha scope. +- Completed the Public Preview repository transition, protected configuration, + and authorized live-smoke verification. Registry Alpha remains unpublished. ## [0.1.0-alpha.1] - Unreleased diff --git a/README.md b/README.md index c6e13bb..5da2384 100644 --- a/README.md +++ b/README.md @@ -4,8 +4,8 @@ The official CometAPI entry point for the OpenAI-compatible API. The SDK keeps the official OpenAI JavaScript request, response, stream, and error types while defaulting the client to CometAPI. -> **Pre-release:** the SDK is under active 0.1 development. The package is not -> yet available from npm, and its API may change before `0.1.0`. +> **Public Preview pre-release:** the SDK is under active 0.1 development. The +> package is not yet available from npm, and its API may change before `0.1.0`. ## Supported 0.1 surface @@ -207,16 +207,18 @@ parent. ## Project status -The repository is preparing for Public Preview and the first Registry Alpha. -Mocked responses, packed artifacts, GitHub Actions, trusted live tests, and npm -publication are separate evidence layers; one must not be represented as +The repository is in Public Preview. Blocking CI, protected repository rules, +security reporting, protected environments, and the authorized live smoke have +passed. The first Registry Alpha remains a separate release gate; mocked +responses, packed artifacts, GitHub Actions, trusted live tests, and npm +publication are separate evidence layers and must not be represented as another. See: - [Canonical repository](https://github.com/cometapi-dev/cometapi-node) - Support and conduct: `support@cometapi.com` -- [Private vulnerability reporting](https://github.com/cometapi-dev/cometapi-node/security/advisories/new), activated during Public Preview +- [Private vulnerability reporting](https://github.com/cometapi-dev/cometapi-node/security/advisories/new), enabled for Public Preview - [COMPATIBILITY.md](./COMPATIBILITY.md) for the supported protocol matrix - [ARCHITECTURE.md](./ARCHITECTURE.md) for design constraints - [CONTRIBUTING.md](./CONTRIBUTING.md) for contributor checks diff --git a/ROADMAP.md b/ROADMAP.md index 6cb7288..97d67f4 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -1,7 +1,7 @@ # CometAPI TypeScript and Node.js SDK Roadmap -Status: Public Preview pre-visibility complete; visibility change awaiting explicit authorization -Last updated: 2026-07-23 +Status: Public Preview complete; Registry Alpha awaits separate authorization +Last updated: 2026-07-27 Repository contract: This roadmap is self-contained and is the public source of truth for this repository's release sequence. @@ -11,27 +11,26 @@ The TypeScript and Node.js SDK will provide a typed CometAPI entry point that preserves the official OpenAI JavaScript client experience while shipping a small, auditable package for supported Node.js LTS runtimes. -Private Remote Validation and Public Preview pre-visibility preparation are -complete for the sanitized private repository. The repository remains private -at the visibility authorization gate. Public Preview is not ready until the -visibility transition and all public-only controls and live evidence pass under -separate explicit authorization. The functional `0.1.0-alpha.1` prerelease +Private Remote Validation and Public Preview are complete for the sanitized +repository. The repository is public with blocking CI, protected repository and +tag rules, Private Vulnerability Reporting, protected environments, and +authorized live-smoke evidence. The functional `0.1.0-alpha.1` prerelease remains a separate evidence gate after Public Preview. Registry publication proceeds only through Private Remote Validation, Public Preview, Registry Alpha, and stable 0.1.0 stages. ## Milestones -| Milestone | Status | User outcome | -| ---------------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | -| Repository foundation | In progress | The repository has reproducible development, contribution, security, and release processes. | -| Private Remote Validation | Complete | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled. | -| Public Preview | Awaiting authorization | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence. | -| 0.1.0-alpha.1 Registry Alpha | Planned | Early adopters can install a functional prerelease from npm's `next` channel and call the three required OpenAI-compatible resources. | -| 0.1.0 Stable | Planned | Users can install a fully verified package from npm's default channel. | -| 0.2.0 provider-native text | Planned | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports. | -| 0.3.0 CometAPI resources | Planned | Users receive typed access to the first stable CometAPI-specific account or platform resources. | -| Media and task APIs | Later | Users receive typed image, video, audio, upload, polling, and task lifecycle helpers after their contracts are stable. | +| Milestone | Status | User outcome | +| ---------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- | +| Repository foundation | In progress | The repository has reproducible development, contribution, security, and release processes. | +| Private Remote Validation | Complete | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled. | +| Public Preview | Complete | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence. | +| 0.1.0-alpha.1 Registry Alpha | Planned | Early adopters can install a functional prerelease from npm's `next` channel and call the three required OpenAI-compatible resources. | +| 0.1.0 Stable | Planned | Users can install a fully verified package from npm's default channel. | +| 0.2.0 provider-native text | Planned | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports. | +| 0.3.0 CometAPI resources | Planned | Users receive typed access to the first stable CometAPI-specific account or platform resources. | +| Media and task APIs | Later | Users receive typed image, video, audio, upload, polling, and task lifecycle helpers after their contracts are stable. | ## Repository Foundation @@ -115,9 +114,15 @@ visibility or publish to a private or public registry. ## Public Preview -Changing the repository to public begins a short configuration interval; it -does not establish Public Preview readiness by itself. The preview is ready -only when: +Public Preview is complete. The repository visibility transition and public-only +configuration were followed by successful default-branch verification and an +authorized protected live smoke. Evidence for the final pre-documentation +commit is recorded in the corresponding GitHub Actions runs: + +- [Main CI run 30246345118](https://github.com/cometapi-dev/cometapi-node/actions/runs/30246345118) +- [Live smoke run 30246431866](https://github.com/cometapi-dev/cometapi-node/actions/runs/30246431866) + +The readiness criteria remain: - The README describes real 0.1 scope and clearly labels the repository as a pre-release project. diff --git a/SECURITY.md b/SECURITY.md index f21d374..3fbf11d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -17,10 +17,8 @@ issue. The canonical confidential reporting URL is . -Private Vulnerability Reporting is activated during Public Preview, after -Private Remote Validation. Until it is active, contact `support@cometapi.com` -to arrange confidential reporting. Do not make the repository public without a -working confidential reporting path. +Private Vulnerability Reporting is enabled for Public Preview. Contact +`support@cometapi.com` if the reporting URL is unavailable. Include: