docs: record alpha.3 registry release

README.md

@@ -5,8 +5,8 @@ the official OpenAI JavaScript request, response, stream, and error types while
 defaulting the client to CometAPI.
 
 > **Registry Alpha pre-release:** the SDK is under active 0.1 development.
-> `0.1.0-alpha.3` is approved for npm publication under the `next` dist-tag,
-> and its API may change before `0.1.0`.
+> `0.1.0-alpha.3` is available from npm under the `next` dist-tag, and its API
+> may change before `0.1.0`.
 
 ## Supported 0.1 surface
 
@@ -210,10 +210,12 @@ parent.
 
 The repository has completed Public Preview. Blocking CI, protected repository
 rules, security reporting, protected environments, and the authorized live
-smoke have passed. Registry Alpha `0.1.0-alpha.1` is available from npm. The
-immutable `0.1.0-alpha.2` GitHub release failed before invoking npm, and
-`0.1.0-alpha.3` is approved for OIDC publication. Mocked responses, packed
-artifacts, GitHub Actions, trusted live tests, and npm publication remain
+smoke have passed. Registry Alpha `0.1.0-alpha.3` was published from the
+immutable release artifact through GitHub Actions OIDC with provenance, and
+independent public-registry ESM, CommonJS, and compatible-OpenAI host installs
+passed. The immutable `0.1.0-alpha.2` GitHub release remains as an unpublished
+failure record because its guard stopped before invoking npm. Mocked responses,
+packed artifacts, GitHub Actions, trusted live tests, and npm publication remain
 separate evidence layers and must not be represented as another.
 
 See:

RELEASING.md

@@ -351,6 +351,44 @@ one-time exception:
 
 This exception must never become a reusable source-controlled publishing path.
 
+## Registry Alpha release evidence
+
+Registry Alpha completed on 2026-07-27 with these independently auditable
+layers:
+
+- The one-time `0.1.0-alpha.1` bootstrap recovery published the exact artifact
+  with provenance in [GitHub Actions run 30251436832](https://github.com/cometapi-dev/cometapi-node/actions/runs/30251436832).
+- npm ownership lists both `tensornull <tensor.null@gmail.com>` and the
+  company-controlled `cometapi_dev <dev@cometapi.com>` account. The bootstrap
+  token was revoked, local npm authentication was removed, the protected `npm`
+  environment has no secrets or variables, and npm disallows token publishing.
+- The immutable `0.1.0-alpha.2` release passed exact-artifact verification and
+  protected live smoke in [run 30270656080](https://github.com/cometapi-dev/cometapi-node/actions/runs/30270656080),
+  then failed before invoking npm because the local publication guard rejected
+  the fixed `actions/setup-node` authentication placeholder. No alpha.2
+  registry artifact exists.
+- Pull request [#23](https://github.com/cometapi-dev/cometapi-node/pull/23)
+  added regression coverage for that placeholder while preserving rejection of
+  real registry credentials. Default-branch [CI run 30272606126](https://github.com/cometapi-dev/cometapi-node/actions/runs/30272606126)
+  passed before tagging.
+- The immutable [`v0.1.0-alpha.3` release](https://github.com/cometapi-dev/cometapi-node/releases/tag/v0.1.0-alpha.3)
+  completed exact-artifact verification, the bounded three-request live smoke,
+  OIDC publication, registry convergence, signature verification, dependency
+  deduplication, and public installation in [run 30272764488](https://github.com/cometapi-dev/cometapi-node/actions/runs/30272764488).
+- npm identifies the publisher as GitHub Actions using
+  `npm-oidc-no-reply@github.com`. The registry reports SLSA provenance v1 and
+  integrity
+  `sha512-dtzQOz0dxif74jJpu2fhfUVjiq6TLm3YkPydtsryHGxuU6usaLWTpcblky854T42TG+SbTApCgOoNJDMkEYIOg==`,
+  and Sigstore transparency-log index
+  [`2257566579`](https://search.sigstore.dev/?logIndex=2257566579).
+- Independent installs from the public registry passed for ESM, CommonJS, and a
+  host already declaring `openai@6.47.0`. The host resolved one effective
+  OpenAI installation and preserved `APIError instanceof` identity. Registry
+  signatures and attestations were verified with `npm audit signatures`.
+- The `next` dist-tag resolves to `0.1.0-alpha.3`. The registry-created `latest`
+  tag remains on `0.1.0-alpha.1`; it is outside the prerelease installation path
+  and remains explicit residual cleanup before stable publication.
+
 ## Stable 0.1.0 sequence
 
 ```text

ROADMAP.md

@@ -1,6 +1,6 @@
 # CometAPI TypeScript and Node.js SDK Roadmap
 
-Status: Public Preview complete; Registry Alpha OIDC closeout in progress
+Status: Public Preview and Registry Alpha complete; 0.1.0 stable planned
 Last updated: 2026-07-27
 Repository contract: This roadmap is self-contained and is the public source
 of truth for this repository's release sequence.
@@ -17,22 +17,22 @@ tag rules, Private Vulnerability Reporting, protected environments, and
 authorized live-smoke evidence. The functional `0.1.0-alpha.1` prerelease is
 available from npm. The immutable `0.1.0-alpha.2` GitHub release failed locally
 before invoking npm because its publication guard rejected the fixed
-`actions/setup-node` authentication placeholder. Registry Alpha remains open
-until `0.1.0-alpha.3` completes the OIDC, provenance, ownership, and
-public-install verification sequence.
+`actions/setup-node` authentication placeholder. `0.1.0-alpha.3` completed the
+OIDC, provenance, ownership, and public-install verification sequence and is
+available from npm's `next` channel.
 
 ## Milestones
 
-| Milestone                  | Status      | User outcome                                                                                                                             |
-| -------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| Repository foundation      | In progress | The repository has reproducible development, contribution, security, and release processes.                                              |
-| Private Remote Validation  | Complete    | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled.     |
-| Public Preview             | Complete    | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence. |
-| 0.1.x Registry Alpha       | In progress | Early adopters can install a functional prerelease from npm's `next` channel; alpha.3 must prove the OIDC-only publication path.         |
-| 0.1.0 Stable               | Planned     | Users can install a fully verified package from npm's default channel.                                                                   |
-| 0.2.0 provider-native text | Planned     | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports.                                         |
-| 0.3.0 CometAPI resources   | Planned     | Users receive typed access to the first stable CometAPI-specific account or platform resources.                                          |
-| Media and task APIs        | Later       | Users receive typed image, video, audio, upload, polling, and task lifecycle helpers after their contracts are stable.                   |
+| Milestone                  | Status      | User outcome                                                                                                                              |
+| -------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| Repository foundation      | In progress | The repository has reproducible development, contribution, security, and release processes.                                               |
+| Private Remote Validation  | Complete    | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled.      |
+| Public Preview             | Complete    | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence.  |
+| 0.1.x Registry Alpha       | Complete    | Early adopters can install a functional, provenance-verified prerelease from npm's `next` channel through the OIDC-only publication path. |
+| 0.1.0 Stable               | Planned     | Users can install a fully verified package from npm's default channel.                                                                    |
+| 0.2.0 provider-native text | Planned     | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports.                                          |
+| 0.3.0 CometAPI resources   | Planned     | Users receive typed access to the first stable CometAPI-specific account or platform resources.                                           |
+| Media and task APIs        | Later       | Users receive typed image, video, audio, upload, polling, and task lifecycle helpers after their contracts are stable.                    |
 
 ## Repository Foundation
 
@@ -347,10 +347,10 @@ npm does not allow configuration before the first package publication, only
    local publication guard rejected the fixed `actions/setup-node`
    authentication placeholder before npm was invoked; no alpha.2 registry
    artifact exists.
-6. The project preserves that immutable failure record, publishes
-   `0.1.0-alpha.3` through OIDC with regression coverage for the placeholder,
-   verifies provenance and installation, and confirms that `next` resolves to
-   `0.1.0-alpha.3`.
+6. The project preserved that immutable failure record and published
+   `0.1.0-alpha.3` through OIDC with regression coverage for the placeholder.
+   Provenance, registry signatures, independent installation, ownership, and
+   the `next` dist-tag were verified.
 
 This exception must be recorded in the release evidence and must never become
 a reusable publication path.