diff --git a/README.md b/README.md index 3840cfd..cdd4153 100644 --- a/README.md +++ b/README.md @@ -5,8 +5,8 @@ the official OpenAI JavaScript request, response, stream, and error types while defaulting the client to CometAPI. > **Registry Alpha pre-release:** the SDK is under active 0.1 development. -> `0.1.0-alpha.3` is approved for npm publication under the `next` dist-tag, -> and its API may change before `0.1.0`. +> `0.1.0-alpha.3` is available from npm under the `next` dist-tag, and its API +> may change before `0.1.0`. ## Supported 0.1 surface @@ -210,10 +210,12 @@ parent. The repository has completed Public Preview. Blocking CI, protected repository rules, security reporting, protected environments, and the authorized live -smoke have passed. Registry Alpha `0.1.0-alpha.1` is available from npm. The -immutable `0.1.0-alpha.2` GitHub release failed before invoking npm, and -`0.1.0-alpha.3` is approved for OIDC publication. Mocked responses, packed -artifacts, GitHub Actions, trusted live tests, and npm publication remain +smoke have passed. Registry Alpha `0.1.0-alpha.3` was published from the +immutable release artifact through GitHub Actions OIDC with provenance, and +independent public-registry ESM, CommonJS, and compatible-OpenAI host installs +passed. The immutable `0.1.0-alpha.2` GitHub release remains as an unpublished +failure record because its guard stopped before invoking npm. Mocked responses, +packed artifacts, GitHub Actions, trusted live tests, and npm publication remain separate evidence layers and must not be represented as another. See: diff --git a/RELEASING.md b/RELEASING.md index c4adea8..8dea0d6 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -351,6 +351,44 @@ one-time exception: This exception must never become a reusable source-controlled publishing path. +## Registry Alpha release evidence + +Registry Alpha completed on 2026-07-27 with these independently auditable +layers: + +- The one-time `0.1.0-alpha.1` bootstrap recovery published the exact artifact + with provenance in [GitHub Actions run 30251436832](https://github.com/cometapi-dev/cometapi-node/actions/runs/30251436832). +- npm ownership lists both `tensornull ` and the + company-controlled `cometapi_dev ` account. The bootstrap + token was revoked, local npm authentication was removed, the protected `npm` + environment has no secrets or variables, and npm disallows token publishing. +- The immutable `0.1.0-alpha.2` release passed exact-artifact verification and + protected live smoke in [run 30270656080](https://github.com/cometapi-dev/cometapi-node/actions/runs/30270656080), + then failed before invoking npm because the local publication guard rejected + the fixed `actions/setup-node` authentication placeholder. No alpha.2 + registry artifact exists. +- Pull request [#23](https://github.com/cometapi-dev/cometapi-node/pull/23) + added regression coverage for that placeholder while preserving rejection of + real registry credentials. Default-branch [CI run 30272606126](https://github.com/cometapi-dev/cometapi-node/actions/runs/30272606126) + passed before tagging. +- The immutable [`v0.1.0-alpha.3` release](https://github.com/cometapi-dev/cometapi-node/releases/tag/v0.1.0-alpha.3) + completed exact-artifact verification, the bounded three-request live smoke, + OIDC publication, registry convergence, signature verification, dependency + deduplication, and public installation in [run 30272764488](https://github.com/cometapi-dev/cometapi-node/actions/runs/30272764488). +- npm identifies the publisher as GitHub Actions using + `npm-oidc-no-reply@github.com`. The registry reports SLSA provenance v1 and + integrity + `sha512-dtzQOz0dxif74jJpu2fhfUVjiq6TLm3YkPydtsryHGxuU6usaLWTpcblky854T42TG+SbTApCgOoNJDMkEYIOg==`, + and Sigstore transparency-log index + [`2257566579`](https://search.sigstore.dev/?logIndex=2257566579). +- Independent installs from the public registry passed for ESM, CommonJS, and a + host already declaring `openai@6.47.0`. The host resolved one effective + OpenAI installation and preserved `APIError instanceof` identity. Registry + signatures and attestations were verified with `npm audit signatures`. +- The `next` dist-tag resolves to `0.1.0-alpha.3`. The registry-created `latest` + tag remains on `0.1.0-alpha.1`; it is outside the prerelease installation path + and remains explicit residual cleanup before stable publication. + ## Stable 0.1.0 sequence ```text diff --git a/ROADMAP.md b/ROADMAP.md index 97f1f8a..9c0b990 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -1,6 +1,6 @@ # CometAPI TypeScript and Node.js SDK Roadmap -Status: Public Preview complete; Registry Alpha OIDC closeout in progress +Status: Public Preview and Registry Alpha complete; 0.1.0 stable planned Last updated: 2026-07-27 Repository contract: This roadmap is self-contained and is the public source of truth for this repository's release sequence. @@ -17,22 +17,22 @@ tag rules, Private Vulnerability Reporting, protected environments, and authorized live-smoke evidence. The functional `0.1.0-alpha.1` prerelease is available from npm. The immutable `0.1.0-alpha.2` GitHub release failed locally before invoking npm because its publication guard rejected the fixed -`actions/setup-node` authentication placeholder. Registry Alpha remains open -until `0.1.0-alpha.3` completes the OIDC, provenance, ownership, and -public-install verification sequence. +`actions/setup-node` authentication placeholder. `0.1.0-alpha.3` completed the +OIDC, provenance, ownership, and public-install verification sequence and is +available from npm's `next` channel. ## Milestones -| Milestone | Status | User outcome | -| -------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- | -| Repository foundation | In progress | The repository has reproducible development, contribution, security, and release processes. | -| Private Remote Validation | Complete | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled. | -| Public Preview | Complete | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence. | -| 0.1.x Registry Alpha | In progress | Early adopters can install a functional prerelease from npm's `next` channel; alpha.3 must prove the OIDC-only publication path. | -| 0.1.0 Stable | Planned | Users can install a fully verified package from npm's default channel. | -| 0.2.0 provider-native text | Planned | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports. | -| 0.3.0 CometAPI resources | Planned | Users receive typed access to the first stable CometAPI-specific account or platform resources. | -| Media and task APIs | Later | Users receive typed image, video, audio, upload, polling, and task lifecycle helpers after their contracts are stable. | +| Milestone | Status | User outcome | +| -------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------- | +| Repository foundation | In progress | The repository has reproducible development, contribution, security, and release processes. | +| Private Remote Validation | Complete | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled. | +| Public Preview | Complete | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence. | +| 0.1.x Registry Alpha | Complete | Early adopters can install a functional, provenance-verified prerelease from npm's `next` channel through the OIDC-only publication path. | +| 0.1.0 Stable | Planned | Users can install a fully verified package from npm's default channel. | +| 0.2.0 provider-native text | Planned | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports. | +| 0.3.0 CometAPI resources | Planned | Users receive typed access to the first stable CometAPI-specific account or platform resources. | +| Media and task APIs | Later | Users receive typed image, video, audio, upload, polling, and task lifecycle helpers after their contracts are stable. | ## Repository Foundation @@ -347,10 +347,10 @@ npm does not allow configuration before the first package publication, only local publication guard rejected the fixed `actions/setup-node` authentication placeholder before npm was invoked; no alpha.2 registry artifact exists. -6. The project preserves that immutable failure record, publishes - `0.1.0-alpha.3` through OIDC with regression coverage for the placeholder, - verifies provenance and installation, and confirms that `next` resolves to - `0.1.0-alpha.3`. +6. The project preserved that immutable failure record and published + `0.1.0-alpha.3` through OIDC with regression coverage for the placeholder. + Provenance, registry signatures, independent installation, ownership, and + the `next` dist-tag were verified. This exception must be recorded in the release evidence and must never become a reusable publication path.