fix: make release gates deterministic

Author: CometAPI

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -38,7 +38,7 @@ body:
     attributes:
       label: Versions
       description: Provide Python, cometapi, and openai versions.
-      placeholder: "Python 3.13; cometapi 0.1.0a1; openai 2.45.0"
+      placeholder: "Python 3.13; cometapi <installed version>; openai 2.45.0"
     validations:
       required: true
   - type: input

.github/workflows/ci.yml

@@ -44,6 +44,10 @@ jobs:
         run: uv run pyright
       - name: Run offline unit and contract tests
         run: uv run pytest -m "not live"
+      - name: Select latest OpenAI within the supported major
+        run: uv pip install --python .venv/bin/python --upgrade "openai>=2.45.0,<3.0.0"
+      - name: Run latest-within-major tests without resyncing the lock
+        run: uv run --no-sync pytest -m "not live"
       - name: Check version agreement and durable public content
         run: uv run python scripts/check_version.py --require-changelog --require-public-preview-docs
       - name: Scan for credentials and scope mistakes
@@ -95,27 +99,6 @@ jobs:
       - name: Run offline tests without resyncing the lock
         run: uv run --no-sync pytest -m "not live"
 
-  latest-openai:
-    name: Latest OpenAI within major canary
-    if: github.event_name == 'schedule' || github.actor == 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Check out the candidate
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-      - name: Install the pinned uv frontend
-        run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
-      - name: Create the development environment
-        run: uv sync --locked
-      - name: Select latest OpenAI within the supported major
-        run: uv pip install --python .venv/bin/python --upgrade "openai>=2.45.0,<3.0.0"
-      - name: Run canary tests without resyncing the lock
-        run: uv run --no-sync pytest -m "not live"
-
   package:
     name: Build, inspect, and clean-install exact artifacts
     needs: [quality, locked-runtime, minimum-openai]

.github/workflows/live-smoke.yml

@@ -4,6 +4,16 @@ on:
   schedule:
     - cron: "17 3 * * *"
   workflow_dispatch:
+    inputs:
+      max_output_tokens:
+        description: Maximum output tokens for each bounded live request
+        required: true
+        default: "64"
+        type: choice
+        options:
+          - "64"
+          - "128"
+          - "256"
 
 permissions:
   contents: read
@@ -15,8 +25,8 @@ concurrency:
 env:
   UV_VERSION: 0.11.8
   COMETAPI_LIVE_MAX_REQUESTS: "4"
-  COMETAPI_LIVE_MAX_OUTPUT_TOKENS: "16"
-  COMETAPI_LIVE_MODEL: gpt-5.4
+  COMETAPI_LIVE_MAX_OUTPUT_TOKENS: ${{ inputs.max_output_tokens || '64' }}
+  COMETAPI_LIVE_MODEL: gpt-5.6-sol
   COMETAPI_LIVE_REQUEST_TIMEOUT_SECONDS: "30"
   COMETAPI_LIVE_CONCURRENCY: "1"
   COMETAPI_LIVE_RUN: "1"

.github/workflows/publish.yml

@@ -314,14 +314,14 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
-    # Required repository configuration: protect this environment without required reviewers,
-    # and configure COMETAPI_KEY plus the approved COMETAPI_LIVE_MODEL variable.
+    # Required repository configuration: protect this environment without required reviewers
+    # and configure only the scoped COMETAPI_KEY credential.
     environment: live-smoke
     env:
       COMETAPI_LIVE_CONCURRENCY: "1"
-      COMETAPI_LIVE_MAX_OUTPUT_TOKENS: "16"
+      COMETAPI_LIVE_MAX_OUTPUT_TOKENS: "64"
       COMETAPI_LIVE_MAX_REQUESTS: "4"
-      COMETAPI_LIVE_MODEL: ${{ vars.COMETAPI_LIVE_MODEL || 'gpt-5.4' }}
+      COMETAPI_LIVE_MODEL: gpt-5.6-sol
       COMETAPI_LIVE_REQUEST_TIMEOUT_SECONDS: "30"
       COMETAPI_LIVE_RUN: "1"
       COMETAPI_LIVE_STOP_ON_FAILURE: "1"
@@ -381,7 +381,7 @@ jobs:
         working-directory: release-bundle
         run: sha256sum --check artifact-sha256.txt
       - name: Publish through the configured PyPI Trusted Publisher
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1, node24
         with:
           packages-dir: release-bundle/dist/
           print-hash: true

AGENTS.md

@@ -64,44 +64,8 @@ Registry Alpha, and the first stable release are completed historical steps and
 must not be repeated. The canonical repository is public with protected branch
 and version-tag rules, Private Vulnerability Reporting, immutable releases,
 protected environments, public default-branch CI, and protected release and
-registry evidence.
-
-The accepted `0.1.1` maintenance release evidence is:
-
-| Field | Value |
-| --- | --- |
-| Release commit and tag target | `576e7503a0a8c1103faca5143e4b8d576f8e8b44` |
-| Release tag | `v0.1.1` |
-| GitHub release | `https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.1` |
-| Release workflow | `https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821548` |
-| PyPI release | `https://pypi.org/project/cometapi/0.1.1/` |
-| Wheel SHA256 | `27e7904542f82fbbcd60e0de23a4a62c042420b6d004d00286d1f37d2ec4c5e5` |
-| Source SHA256 | `64c7cb87745032703b3374cc562ea00b979416c54908862dbcebd116b2dc44c8` |
-
-The accepted `0.1.0` stable release evidence is:
-
-| Field | Value |
-| --- | --- |
-| Release commit and tag target | `6f42981edcc6c252f8db997606671c3da84d1dd8` |
-| Release tag | `v0.1.0` |
-| GitHub release | `https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.0` |
-| Release workflow | `https://github.com/cometapi-dev/cometapi-python/actions/runs/30359383715` |
-| PyPI release | `https://pypi.org/project/cometapi/0.1.0/` |
-| Wheel SHA256 | `8eae758688bb6c98274e48d8d81f882eeae760f69cfd2f5e125004881d60e90f` |
-| Source SHA256 | `e9308b44f6091200b5121e24d1a0e1b9ea3e6bcccc109d6de87554b1ab2a8bca` |
-
-The accepted Registry Alpha evidence is:
-
-| Field | Value |
-| --- | --- |
-| Release commit | `31b68904141489ca04932edbf305ccf88af09372` |
-| Recovery tag | `v0.1.0-alpha.1+recovery.1` |
-| Tag object | `fdc4a6cce31f4534f83903f3f95e7757a4d4049f` |
-| GitHub release | `https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.0-alpha.1%2Brecovery.1` |
-| Release workflow | `https://github.com/cometapi-dev/cometapi-python/actions/runs/30261746138` |
-| PyPI release | `https://pypi.org/project/cometapi/0.1.0a1/` |
-| Wheel SHA256 | `a6820347317943ca22f7632acbe354dd992f31a122a6172dfe45b57960e3a093` |
-| Source SHA256 | `98d86829ef14771e8b7ec180d452c6638289f49c14a39b7207be5c47cb64cde7` |
+registry evidence. Exact historical identities and digests belong only in the
+validated evidence blocks in `ROADMAP.md` and `RELEASING.md`.
 
 The accepted identity is:
 
@@ -155,7 +119,7 @@ Post-stable invariants:
    direct dependency's `result` to equal `success`. A skipped, cancelled,
    failed, or missing dependency must never make build, live smoke,
    publication, or registry verification eligible.
-9. Keep Release Please pinned to the reviewed `v5.0.0` commit
+9. Keep Release Please v5.0.0 pinned to the reviewed commit
    `45996ed1f6d02564a971a2fa1b5860e934307cf7`, whose immutable action metadata
    uses `node24`. The workflow semantic checker must reject any different pin.
    Invoke that action release-only first with `skip-github-pull-request: true`;
@@ -170,6 +134,10 @@ Post-stable invariants:
    state read-only, and stop. Do not use another main push or recovery path
    until the exact external state is known and recovery is separately
    authorized.
+   Keep the PyPI publisher v1.14.1 pinned to the reviewed commit whose
+   composite action uses the Node 24 `setup-python` fallback. The workflow
+   checker must reject any other publisher SHA without changing the top-level
+   workflow, job, environment, or Trusted Publisher identity.
 10. `README.md` is the distribution long description and must remain accurate
     before and after publication. Use `python -m pip install cometapi`,
     unversioned project links, and publication-neutral maintenance language.
@@ -181,8 +149,11 @@ Post-stable invariants:
     persistent guidance or current-state documentation. Query public PyPI when
     current registry state is required. Keep candidate version truth in
     `pyproject.toml` and `.release-please-manifest.json`, and keep exact released
-    versions only in immutable historical evidence. The document/version
-    checker must fail before merge or release when this boundary is violated.
+    versions only in `CHANGELOG.md` or validated immutable evidence blocks in
+    `ROADMAP.md` and `RELEASING.md`. All other persistent/current-state public
+    documents must contain no exact CometAPI patch or recovery identity. The
+    document/version checker must fail before merge or release when this
+    boundary is violated.
 
 ## Repository independence
 
@@ -265,9 +236,9 @@ that exact version. Runtime dependencies belong in the manifest only when
 CometAPI source directly imports and owns their use.
 
 Compatibility checks cover the minimum supported OpenAI version, the locked
-development version, and a scheduled or dependency-PR latest-within-major
-canary. Python 3.10 through 3.14 is the initial blocking runtime range while
-Python 3.10 remains upstream-supported.
+development version, and a blocking latest-within-major lane on every pull
+request and default-branch push. Python 3.10 through 3.14 is the initial
+blocking runtime range while Python 3.10 remains upstream-supported.
 
 ## Development and verification
 
@@ -312,7 +283,7 @@ committed.
 
 ## Release and documentation rules
 
-- The first public artifact must be functional `0.1.0a1`, never a placeholder.
+- The first public artifact was functional Registry Alpha, never a placeholder.
 - Publication uses a reviewed immutable tag, a protected `pypi` environment,
   and PyPI OIDC Trusted Publishing.
 - The release commit must equal the tag target and belong to the protected
@@ -339,11 +310,10 @@ committed.
 - Every distribution `Project-URL` must use HTTPS. The canonical Support URL
   is `https://github.com/cometapi-dev/cometapi-python/blob/main/SUPPORT.md`;
   `support@cometapi.com` remains the support and conduct contact.
-- GitHub permanently reserved `v0.1.0-alpha.1` after its immutable release
-  reached OIDC publication but failed before any PyPI distribution was
-  accepted. The sole approved recovery tag is
-  `v0.1.0-alpha.1+recovery.1`, which maps to package version `0.1.0a1`.
-  Later releases must use their ordinary canonical tag spelling.
+- The initial Registry Alpha recovery exception is immutable historical
+  evidence recorded in `ROADMAP.md` and `RELEASING.md`. Later releases must use
+  their ordinary canonical tag spelling; do not reuse or increment that
+  exception.
 - Keep Release Please disabled outside an explicitly authorized release
   sequence. The stable-readiness configuration used a reviewed and tested
   `last-release-sha` bridge because the recovery tag's build metadata could not
@@ -362,7 +332,9 @@ committed.
 - Keep README, roadmap, compatibility matrix, examples, and changelog aligned
   with shipped behavior. README installation and availability guidance must be
   publication-neutral because it is embedded in immutable distribution
-  metadata. Use currently supported model IDs.
+  metadata. Keep the active example/live model in the checker's canonical
+  model constant; executable README examples and both live workflows must fail
+  validation when they drift from it.
 - All repository documentation is written in English.
 
 The Public Preview readiness record requires

ARCHITECTURE.md

@@ -101,7 +101,7 @@ Compatibility evidence has three lanes:
 
 - minimum OpenAI on the oldest supported Python runtime;
 - locked OpenAI across the blocking Python runtime matrix; and
-- latest OpenAI below 3.0 as a scheduled and dependency-update canary.
+- latest OpenAI below 3.0 as a blocking pull-request and default-branch lane.
 
 ## Verification boundaries
 
@@ -135,11 +135,19 @@ and after a release. Source-document and artifact checks reject approval,
 unpublished, exact-version installation, and versioned release-link text; each
 artifact long description must also exactly match the source README.
 
-Release Please is pinned to the immutable `v5.0.0` commit whose action metadata
+Release Please v5.0.0 is pinned to the immutable commit whose action metadata
 uses `node24`. The workflow semantic contract fixes that SHA and runtime
 disposition so GitHub does not need to force a deprecated Node 20 action onto a
 newer runtime.
 
+The version gate accepts Release Please's native linked, dated changelog heading
+as well as the existing legacy dated form. It validates repository, previous
+tag, candidate tag, and calendar date rather than rewriting generated history.
+
+The PyPI publisher remains directly in `publish.yml` and is pinned to its
+reviewed Node 24 maintenance release. Pinning its exact SHA prevents a syntactic
+full-SHA substitution from silently changing the OIDC publication supply chain.
+
 Release Please execution is split at the mutability boundary. The first pinned
 action invocation is release-only (`skip-github-pull-request: true`) and is
 neither continued on error nor retried. Only when that invocation succeeds
@@ -150,39 +158,10 @@ failure ends the job. Updating a branch or pull request is mutable and
 idempotent, while retrying immutable tag or GitHub Release creation could leave
 ambiguous external state and is forbidden.
 
-[Release Please run 30509764960](https://github.com/cometapi-dev/cometapi-python/actions/runs/30509764960)
-isolated the motivating failure to the action's Undici/global `fetch`: the PR
-workflow reached its write boundary and then failed with `other side closed`
-before any branch, pull-request, tag, GitHub Release, live, or registry write.
-The existing release branch and repository pull-request permission were not the
-cause. This is negative transport evidence, not evidence of a stale branch or
-authorization drift.
-
-This complete trust chain executed successfully in
-[release workflow run 30261746138](https://github.com/cometapi-dev/cometapi-python/actions/runs/30261746138)
-for release commit `31b68904141489ca04932edbf305ccf88af09372`, recovery tag
-`v0.1.0-alpha.1+recovery.1`, and PyPI version `0.1.0a1`. The public wheel and
-source distribution matched the retained pre-publication digests, Trusted
-Publisher provenance was verified, and the clean registry install/import/mocked
-smoke passed.
-
-The same trust chain executed successfully for stable `0.1.0` in
-[release workflow run 30359383715](https://github.com/cometapi-dev/cometapi-python/actions/runs/30359383715).
-The immutable `v0.1.0` tag resolves to release commit
-`6f42981edcc6c252f8db997606671c3da84d1dd8`; the protected live suite, direct
-top-level OIDC publication, public digest and provenance comparison, and clean
-registry install all passed. The selector-descendant conditions were therefore
-verified in GitHub's hosted scheduler, not only by local static checks.
-
-The same trust chain completed for maintenance release `0.1.1` in
-[release workflow run 30429821548](https://github.com/cometapi-dev/cometapi-python/actions/runs/30429821548).
-The immutable `v0.1.1` tag resolves to release commit
-`576e7503a0a8c1103faca5143e4b8d576f8e8b44`; exact-release live smoke, direct
-top-level OIDC publication, public digest and provenance comparison, and clean
-registry installation all passed. The public wheel SHA256 is
-`27e7904542f82fbbcd60e0de23a4a62c042420b6d004d00286d1f37d2ec4c5e5`, and the
-source-distribution SHA256 is
-`64c7cb87745032703b3374cc562ea00b979416c54908862dbcebd116b2dc44c8`.
+Immutable run, tag, commit, registry, and digest records live only in the
+validated release-evidence blocks in `ROADMAP.md` and `RELEASING.md`.
+Architecture documents mechanisms and boundaries, not a second historical
+ledger.
 
 The scheduled/manual default-branch smoke is an operational canary only; it
 does not prove the release commit. `COMETAPI_KEY` is exposed only to the
@@ -218,11 +197,9 @@ reject every rerun, and require every direct dependency's result to equal
 `success`. This crosses only the unused branch's skipped ancestry; cancellation,
 failure, a skipped direct dependency, or a missing result remains fail-closed.
 
-The initial alpha has one release-identity exception. GitHub's immutable
-release tombstone permanently reserves `v0.1.0-alpha.1`, so the reviewed
-recovery release uses SemVer build metadata in
-`v0.1.0-alpha.1+recovery.1`. The build suffix does not change the package
-artifact identity: the PyPI version remains `0.1.0a1`.
+The initial Registry Alpha has one immutable release-identity exception. Its
+exact recovery tag and package mapping are historical evidence in
+`RELEASING.md`; later releases use the ordinary canonical tag spelling.
 
 Release Please remains disabled outside an explicitly authorized release
 sequence. The stable-readiness configuration used a tested `last-release-sha`

COMPATIBILITY.md

@@ -48,7 +48,7 @@ openai>=2.45.0,<3.0.0
 | --- | --- | --- |
 | Minimum `2.45.0` | Prove the declared lower bound | Oldest supported Python runtime |
 | Locked development version | Reproducible contributor and blocking CI environment | Every blocking Python runtime |
-| Latest available below `3.0.0` | Detect upstream drift | Scheduled and dependency-update canary |
+| Latest available below `3.0.0` | Detect upstream drift | Every pull request and default-branch push |
 
 The lock file is development evidence only. It does not narrow the dependency
 range installed for library users.

CONTRIBUTING.md

@@ -38,8 +38,8 @@ uv run python scripts/check_repository_independence.py
 uv run python scripts/run_actionlint.py
 ```
 
-`scripts/run_actionlint.py` downloads and checksum-verifies `actionlint`
-1.7.12 when it is not cached. A passing static workflow check does not mean the
+`scripts/run_actionlint.py` downloads and checksum-verifies actionlint 1.7.12
+when it is not cached. A passing static workflow check does not mean the
 workflow has run successfully on GitHub.
 
 If a check is unavailable, say so in the pull request rather than describing

README.md

@@ -74,7 +74,7 @@ from cometapi import CometAPI
 
 with CometAPI() as client:
     response = client.chat.completions.create(
-        model="gpt-5.4",
+        model="gpt-5.6-sol",
         messages=[{"role": "user", "content": "Hello!"}],
     )
     print(response.choices[0].message.content)
@@ -88,7 +88,7 @@ from cometapi import CometAPI
 
 with CometAPI() as client:
     stream = client.chat.completions.create(
-        model="gpt-5.4",
+        model="gpt-5.6-sol",
         messages=[{"role": "user", "content": "Write one sentence."}],
         stream=True,
     )
@@ -104,7 +104,7 @@ from cometapi import CometAPI
 
 with CometAPI() as client:
     response = client.responses.create(
-        model="gpt-5.4",
+        model="gpt-5.6-sol",
         input="Explain API compatibility in one sentence.",
     )
     models = client.models.list()
@@ -125,7 +125,7 @@ from cometapi import AsyncCometAPI
 async def main() -> None:
     async with AsyncCometAPI() as client:
         response = await client.responses.create(
-            model="gpt-5.4",
+            model="gpt-5.6-sol",
             input="Say hello.",
         )
         print(response.output_text)