diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..9db6f1d --- /dev/null +++ b/.gitattributes @@ -0,0 +1 @@ +packages/npm/ethos-pdf/vendor/ethos-* binary diff --git a/.github/scripts/test_execution_status.py b/.github/scripts/test_execution_status.py index d5fb316..8302455 100644 --- a/.github/scripts/test_execution_status.py +++ b/.github/scripts/test_execution_status.py @@ -34,10 +34,14 @@ def test_status_is_scoped_to_internal_continuation(self) -> None: text = status_text() self.assertIn( - "Status: Public beta evaluation is approved for the GitHub source repository; the three bounded " - "Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.1.2`; " - "the Python `ethos-pdf` wheel at `0.1.2`; the npm `@docushell/ethos-pdf` CLI package " - "at `0.1.2`; and the GitHub Release `v0.1.2` macOS arm64 and Linux x64 CLI artifacts.", + "Status: v0.2.0 public beta/evaluation surfaces are live for the GitHub source repository; " + "Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.2.0`; " + "the Python `ethos-pdf` wheel at `0.2.0`; npm `@docushell/ethos-pdf@0.2.1`; " + "and GitHub Release `v0.2.0` macOS arm64/Linux x64 CLI artifacts.", + text, + ) + self.assertIn( + "npm `@docushell/ethos-pdf@0.2.0` is deprecated because it shipped stale CLI binaries", text, ) self.assertIn("Internal Milestone D source-only closeout remains complete", text) @@ -97,6 +101,12 @@ def test_public_posture_boundary_remains_explicit(self) -> None: "`ETHOS_PDFIUM_LIBRARY_PATH`.", text, ) + self.assertIn( + "v0.2.0 public beta/evaluation surfaces are live for the GitHub source repository", + text, + ) + self.assertIn("npm `@docushell/ethos-pdf@0.2.1`", text) + self.assertIn("GitHub Release `v0.2.0` macOS arm64/Linux x64 CLI artifacts", text) self.assertIn("ethos-doc-core", text) self.assertIn("ethos-verify", text) self.assertIn("ethos-pdf", text) diff --git a/.github/scripts/test_milestone_e_package_publication_metadata_readiness.py b/.github/scripts/test_milestone_e_package_publication_metadata_readiness.py index 7fe5b5f..7d28352 100644 --- a/.github/scripts/test_milestone_e_package_publication_metadata_readiness.py +++ b/.github/scripts/test_milestone_e_package_publication_metadata_readiness.py @@ -111,13 +111,11 @@ def test_in_tree_candidate_metadata_files_are_present_and_activated(self) -> Non crate, ) self.assertIn("reserved_crates_io_version = \"0.0.0-reserved.0\"", manifest, crate) - self.assertIn("Publication metadata is activated", readme, crate) - self.assertIn("Public installation from crates.io remains blocked", readme, crate) - self.assertIn("0.0.0-reserved.0", readme, crate) - self.assertIn("registry action", readme, crate) - self.assertIn("package-publication activation review only", readme, crate) + self.assertIn("Public installation from crates.io is available at `0.2.0`", readme, crate) + self.assertIn("The reserved crates.io placeholder remains historical", readme, crate) + self.assertIn("`0.2.0` is the current public package", readme, crate) self.assertIn("Publication metadata is activated", notice, crate) - self.assertIn("public installation and registry action remain blocked", notice, crate) + self.assertIn("public installation is available from crates.io at `0.2.0`", notice, crate) def test_reserved_placeholder_crates_without_manifests_stay_blocked(self) -> None: prep = load_json(PREP) diff --git a/.github/scripts/test_milestone_e_package_publication_public_installation_availability.py b/.github/scripts/test_milestone_e_package_publication_public_installation_availability.py index 3122e7d..bb7549a 100644 --- a/.github/scripts/test_milestone_e_package_publication_public_installation_availability.py +++ b/.github/scripts/test_milestone_e_package_publication_public_installation_availability.py @@ -58,9 +58,10 @@ "Ethos is a deterministic document evidence layer for source-grounded verification and " "citation checking across native Ethos JSON and supported foreign parser outputs. The current " "beta includes the GitHub source repository, Rust library crates `ethos-doc-core`, " - "`ethos-verify`, and `ethos-pdf` at `0.1.2`, the Python `ethos-pdf` wheel at `0.1.2`, the " - "npm `@docushell/ethos-pdf@0.1.2` package, and GitHub Release `v0.1.2` macOS arm64/Linux x64 " - "CLI artifacts. PDFium-backed commands use caller-provided PDFium through " + "`ethos-verify`, and `ethos-pdf` at `0.2.0`, the Python `ethos-pdf` wheel at `0.2.0`, the " + "npm `@docushell/ethos-pdf@0.2.1` package, and GitHub Release `v0.2.0` macOS arm64/Linux x64 " + "CLI artifacts. npm `@docushell/ethos-pdf@0.2.0` is deprecated because it shipped stale CLI " + "binaries; use `0.2.1`. PDFium-backed commands use caller-provided PDFium through " "`ETHOS_PDFIUM_LIBRARY_PATH`." ) BOUNDED_INSTALLATION_WORDING = ( @@ -88,9 +89,9 @@ "cargo add ethos-pdf@0.1.0", ) CURRENT_INSTALL_COMMANDS = ( - "cargo add ethos-doc-core@0.1.2", - "cargo add ethos-verify@0.1.2", - "cargo add ethos-pdf@0.1.2", + "cargo add ethos-doc-core@0.2.0", + "cargo add ethos-verify@0.2.0", + "cargo add ethos-pdf@0.2.0", ) FORBIDDEN_SCOPE_EXPANSION = [ "public reports are approved", @@ -172,7 +173,9 @@ def test_readme_matches_bounded_public_wording(self) -> None: self.assertIn(CURRENT_README_WORDING, readme) for command in CURRENT_INSTALL_COMMANDS: self.assertIn(command, readme) - self.assertIn("npm install -g @docushell/ethos-pdf@0.1.2", readme) + self.assertIn("npm install -g @docushell/ethos-pdf@0.2.1", readme) + self.assertIn("python3 -m pip install ethos-pdf==0.2.0", readme) + self.assertIn("GitHub Release `v0.2.0`", readme) self.assertIn("macOS arm64/Linux x64 CLI artifacts", readme) self.assertIn("Windows packaged artifacts", readme) self.assertIn("bundled project-maintained PDFium builds", readme) diff --git a/.github/scripts/test_milestone_e_public_beta_source_only_approval.py b/.github/scripts/test_milestone_e_public_beta_source_only_approval.py index 4ed186e..167bec4 100644 --- a/.github/scripts/test_milestone_e_public_beta_source_only_approval.py +++ b/.github/scripts/test_milestone_e_public_beta_source_only_approval.py @@ -46,9 +46,10 @@ "Ethos is a deterministic document evidence layer for source-grounded verification and " "citation checking across native Ethos JSON and supported foreign parser outputs. The current " "beta includes the GitHub source repository, Rust library crates `ethos-doc-core`, " - "`ethos-verify`, and `ethos-pdf` at `0.1.2`, the Python `ethos-pdf` wheel at `0.1.2`, the " - "npm `@docushell/ethos-pdf@0.1.2` package, and GitHub Release `v0.1.2` macOS arm64/Linux x64 " - "CLI artifacts. PDFium-backed commands use caller-provided PDFium through " + "`ethos-verify`, and `ethos-pdf` at `0.2.0`, the Python `ethos-pdf` wheel at `0.2.0`, the " + "npm `@docushell/ethos-pdf@0.2.1` package, and GitHub Release `v0.2.0` macOS arm64/Linux x64 " + "CLI artifacts. npm `@docushell/ethos-pdf@0.2.0` is deprecated because it shipped stale CLI " + "binaries; use `0.2.1`. PDFium-backed commands use caller-provided PDFium through " "`ETHOS_PDFIUM_LIBRARY_PATH`." ) EXPECTED_SOURCE = { @@ -185,7 +186,8 @@ def test_public_surfaces_use_exact_approved_wording_and_exclusions(self) -> None self.assertIn("cargo build --locked -p ethos-cli", readme) self.assertIn("make verify-alpha", readme) self.assertIn("ETHOS_PDFIUM_LIBRARY_PATH", readme) - self.assertIn("npm `@docushell/ethos-pdf@0.1.2` package", normalized_readme) + self.assertIn("npm `@docushell/ethos-pdf@0.2.1` package", normalized_readme) + self.assertIn("npm `@docushell/ethos-pdf@0.2.0` is deprecated", normalized_readme) self.assertIn("Windows packaged artifacts", normalized_readme) self.assertIn("bundled project-maintained PDFium builds", normalized_readme) self.assertIn("public benchmark reports", normalized_readme) diff --git a/.github/scripts/test_milestone_e_public_evaluation_current_state_closeout.py b/.github/scripts/test_milestone_e_public_evaluation_current_state_closeout.py index 26f826e..2117b9a 100644 --- a/.github/scripts/test_milestone_e_public_evaluation_current_state_closeout.py +++ b/.github/scripts/test_milestone_e_public_evaluation_current_state_closeout.py @@ -52,9 +52,10 @@ "Ethos is a deterministic document evidence layer for source-grounded verification and " "citation checking across native Ethos JSON and supported foreign parser outputs. The current " "beta includes the GitHub source repository, Rust library crates `ethos-doc-core`, " - "`ethos-verify`, and `ethos-pdf` at `0.1.2`, the Python `ethos-pdf` wheel at `0.1.2`, the " - "npm `@docushell/ethos-pdf@0.1.2` package, and GitHub Release `v0.1.2` macOS arm64/Linux x64 " - "CLI artifacts. PDFium-backed commands use caller-provided PDFium through " + "`ethos-verify`, and `ethos-pdf` at `0.2.0`, the Python `ethos-pdf` wheel at `0.2.0`, the " + "npm `@docushell/ethos-pdf@0.2.1` package, and GitHub Release `v0.2.0` macOS arm64/Linux x64 " + "CLI artifacts. npm `@docushell/ethos-pdf@0.2.0` is deprecated because it shipped stale CLI " + "binaries; use `0.2.1`. PDFium-backed commands use caller-provided PDFium through " "`ETHOS_PDFIUM_LIBRARY_PATH`." ) APPROVED_SURFACE_LINES = ( @@ -140,8 +141,31 @@ def test_current_docs_use_current_public_wording(self) -> None: " ", " ".join(line.removeprefix("> ").strip() for line in read(README).splitlines()), ) + execution_status = normalized(EXECUTION_STATUS) + self.assertIn(CURRENT_README_WORDING, readme_text, str(README)) - self.assertIn(CURRENT_README_WORDING, normalized(EXECUTION_STATUS), str(EXECUTION_STATUS)) + self.assertIn( + "Status: v0.2.0 public beta/evaluation surfaces are live for the GitHub source repository", + execution_status, + str(EXECUTION_STATUS), + ) + self.assertIn( + "Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.2.0`", + execution_status, + str(EXECUTION_STATUS), + ) + self.assertIn("the Python `ethos-pdf` wheel at `0.2.0`", execution_status, str(EXECUTION_STATUS)) + self.assertIn("npm `@docushell/ethos-pdf@0.2.1`", execution_status, str(EXECUTION_STATUS)) + self.assertIn( + "GitHub Release `v0.2.0` macOS arm64/Linux x64 CLI artifacts", + execution_status, + str(EXECUTION_STATUS), + ) + self.assertIn( + "npm `@docushell/ethos-pdf@0.2.0` is deprecated", + execution_status, + str(EXECUTION_STATUS), + ) def test_docs_reference_current_state_and_retained_blockers(self) -> None: for path in (PREP_SCOPE, ROADMAP, EXECUTION_STATUS, VALIDATION_README): diff --git a/.github/scripts/test_public_prealpha_wording_approval.py b/.github/scripts/test_public_prealpha_wording_approval.py index dc637e6..b5e5237 100644 --- a/.github/scripts/test_public_prealpha_wording_approval.py +++ b/.github/scripts/test_public_prealpha_wording_approval.py @@ -40,9 +40,10 @@ "Ethos is a deterministic document evidence layer for source-grounded verification and " "citation checking across native Ethos JSON and supported foreign parser outputs. The current " "beta includes the GitHub source repository, Rust library crates `ethos-doc-core`, " - "`ethos-verify`, and `ethos-pdf` at `0.1.2`, the Python `ethos-pdf` wheel at `0.1.2`, the " - "npm `@docushell/ethos-pdf@0.1.2` package, and GitHub Release `v0.1.2` macOS arm64/Linux x64 " - "CLI artifacts. PDFium-backed commands use caller-provided PDFium through " + "`ethos-verify`, and `ethos-pdf` at `0.2.0`, the Python `ethos-pdf` wheel at `0.2.0`, the " + "npm `@docushell/ethos-pdf@0.2.1` package, and GitHub Release `v0.2.0` macOS arm64/Linux x64 " + "CLI artifacts. npm `@docushell/ethos-pdf@0.2.0` is deprecated because it shipped stale CLI " + "binaries; use `0.2.1`. PDFium-backed commands use caller-provided PDFium through " "`ETHOS_PDFIUM_LIBRARY_PATH`." ) diff --git a/.github/scripts/test_public_surface_posture.py b/.github/scripts/test_public_surface_posture.py index d0087ab..b395ec7 100644 --- a/.github/scripts/test_public_surface_posture.py +++ b/.github/scripts/test_public_surface_posture.py @@ -51,10 +51,13 @@ def test_readme_status_matches_public_beta_evaluation_scope(self) -> None: self.assertIn("Python `ethos-pdf` wheel", normalized) self.assertIn("caller-provided PDFium", text) self.assertIn("release-scope work", text) - self.assertIn("cargo add ethos-doc-core@0.1.2", text) - self.assertIn("cargo add ethos-verify@0.1.2", text) - self.assertIn("cargo add ethos-pdf@0.1.2", text) - self.assertIn("npm install -g @docushell/ethos-pdf@0.1.2", text) + self.assertIn("cargo add ethos-doc-core@0.2.0", text) + self.assertIn("cargo add ethos-verify@0.2.0", text) + self.assertIn("cargo add ethos-pdf@0.2.0", text) + self.assertIn("python3 -m pip install ethos-pdf==0.2.0", text) + self.assertIn("npm install -g @docushell/ethos-pdf@0.2.1", text) + self.assertIn("GitHub Release `v0.2.0`", text) + self.assertIn("@docushell/ethos-pdf@0.2.0` is deprecated", text) self.assertNotIn("not production-ready", text.lower()) self.assertNotIn("not stable production surfaces", text.lower()) self.assertNotIn("contracts phase", text) diff --git a/.github/scripts/test_v0_2_0_npm_vendor_refresh.py b/.github/scripts/test_v0_2_0_npm_vendor_refresh.py new file mode 100644 index 0000000..318bdae --- /dev/null +++ b/.github/scripts/test_v0_2_0_npm_vendor_refresh.py @@ -0,0 +1,242 @@ +#!/usr/bin/env python3 +# +# Copyright 2026 The Ethos maintainers +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# + +from __future__ import annotations + +import hashlib +import json +import os +import re +import subprocess +import tempfile +import unittest +from pathlib import Path + +from makefile_guard import target_block +from validation_record_source import assert_record_source_binding + + +ROOT = Path(__file__).resolve().parents[2] +PACKAGE_DIR = ROOT / "packages/npm/ethos-pdf" +PACKAGE_TARBALL = PACKAGE_DIR / "docushell-ethos-pdf-0.2.1.tgz" +RECORD = ROOT / "docs/validation/v0-2-0-npm-vendor-refresh-validation-2026-06-25.md" +VALIDATION_README = ROOT / "docs/validation/README.md" +EXECUTION_STATUS = ROOT / "docs/execution-status.md" +PUBLIC_RELEASE_CHECKLIST = ROOT / "docs/public-release-checklist.md" + +SOURCE_SHORT = "aba17c7" +SOURCE_COMMIT = "aba17c7254f2e42b9ccbf71db1a3b53113dc0e18" +SOURCE_TREE = "2029e1a25629f80f251ac6ab670231187bada0a9" +MACOS_ARTIFACT_SHA256 = "c588ee77bbaf99a7d933673e6cd9db190f5992e47d40955def803435a9f9fc5a" +LINUX_ARTIFACT_SHA256 = "00137b20ca2c2a2d2089df1d135920b021b0905d779b1347d134e8a2fb7bfa23" +EXPECTED_FILES = { + "LICENSE", + "NOTICE", + "QUICKSTART.md", + "README.md", + "bin/ethos-pdf.js", + "package.json", + "scripts/postinstall.js", + "scripts/prepare-vendor.js", + "vendor/ethos-darwin-arm64", + "vendor/ethos-linux-x64", + "vendor/manifest.json", +} +EXPECTED_VENDOR_SHA256 = { + "vendor/ethos-darwin-arm64": "e139da8fe635a3e6a42fafb49d66fcf674dbff3d7bdd8dfe844b9eb424e5b53e", + "vendor/ethos-linux-x64": "5ab007b03eba6b1730e95053d1b0095b892a40272b610232568295a67c076a83", + "vendor/manifest.json": "a5cd55d7670e41ede06eb7955cae76a553ebf9ba506ed374d9a409b75f3dde40", +} +EXPECTED_PACK_SHASUM = "8f2e2633edb60cea415915c4646da7e9b4dfb4ed" +EXPECTED_PACK_SHA256 = "c832c9efb3fc8d5480070d8eeb76e00b73f7396d9346a1d490c6ee9109708b2b" +EXPECTED_PACK_INTEGRITY = ( + "sha512-WFNV1h/H90FssbhQBxBsriunVa1XIp8MAWeBtstJ+FKF7AsQkkXEoiSY1WQPDZ3BH6iobHuM2j/ZQ2u6zMcfdA==" +) +EXPECTED_NODE_VERSION = "v23.11.1" +EXPECTED_NPM_VERSION = "10.9.2" +PRIVATE_PATH_MARKERS = ( + "/" + "Users/", + "/" + "private/tmp", + "/" + "private/var", + "/" + "var/folders", + "saumil" + "diwaker", + "Desktop/" + "Stuff", + "project/repo/" + "ethos", +) +FORBIDDEN_APPROVALS = ( + "npm publication approved", + "npm publish approved", + "github release artifact publication approved", + "registry publication approved", + "pypi upload approved", + "release tag creation approved", + "package tag creation approved", + "public installation wording approved", + "production-ready", +) + + +def sha256(path: Path) -> str: + return hashlib.sha256(path.read_bytes()).hexdigest() + + +def read(path: Path) -> str: + return path.read_text(encoding="utf-8") + + +def normalized(path: Path) -> str: + return re.sub(r"\s+", " ", read(path)) + + +def pack_candidate(temp: str) -> tuple[dict[str, object], str, str]: + env = {**os.environ, "npm_config_cache": str(Path(temp) / "npm-cache")} + result = subprocess.run( + ["npm", "pack", "--json"], + cwd=PACKAGE_DIR, + check=False, + encoding="utf-8", + env=env, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + ) + if result.returncode != 0: + raise AssertionError(result.stderr) + return json.loads(result.stdout)[0], env["npm_config_cache"], result.stdout + + +class V020NpmVendorRefreshTests(unittest.TestCase): + def test_vendor_payload_files_are_exact_draft_artifact_derived_binaries(self) -> None: + for relative_path, expected in EXPECTED_VENDOR_SHA256.items(): + self.assertEqual(expected, sha256(PACKAGE_DIR / relative_path)) + + manifest = json.loads(read(PACKAGE_DIR / "vendor/manifest.json")) + self.assertEqual(MACOS_ARTIFACT_SHA256, manifest["targets"]["darwin:arm64"]["release_asset_sha256"]) + self.assertEqual(LINUX_ARTIFACT_SHA256, manifest["targets"]["linux:x64"]["release_asset_sha256"]) + + def test_npm_pack_candidate_contents_and_checksums(self) -> None: + node_version = subprocess.check_output(["node", "--version"], encoding="utf-8").strip() + npm_version = subprocess.check_output(["npm", "--version"], encoding="utf-8").strip() + exact_pack_toolchain = ( + node_version == EXPECTED_NODE_VERSION and npm_version == EXPECTED_NPM_VERSION + ) + + with tempfile.TemporaryDirectory(prefix="ethos-v0-2-npm-candidate-") as temp: + try: + pack, _, _ = pack_candidate(temp) + files = {entry["path"]: entry for entry in pack["files"]} + + self.assertEqual("@docushell/ethos-pdf", pack["name"]) + self.assertEqual("0.2.1", pack["version"]) + self.assertEqual("docushell-ethos-pdf-0.2.1.tgz", pack["filename"]) + self.assertEqual(EXPECTED_FILES, set(files)) + self.assertEqual(493, files["vendor/ethos-darwin-arm64"]["mode"]) + self.assertEqual(493, files["vendor/ethos-linux-x64"]["mode"]) + for relative_path, expected in EXPECTED_VENDOR_SHA256.items(): + self.assertEqual(expected, sha256(PACKAGE_DIR / relative_path)) + if exact_pack_toolchain: + self.assertEqual(EXPECTED_PACK_SHASUM, pack["shasum"]) + self.assertEqual(EXPECTED_PACK_INTEGRITY, pack["integrity"]) + self.assertEqual(EXPECTED_PACK_SHA256, sha256(PACKAGE_TARBALL)) + finally: + PACKAGE_TARBALL.unlink(missing_ok=True) + + def test_candidate_tarball_installs_and_preserves_pdfium_boundary(self) -> None: + with tempfile.TemporaryDirectory(prefix="ethos-v0-2-npm-install-") as temp: + try: + _, _, _ = pack_candidate(temp) + env = {**os.environ, "npm_config_cache": str(Path(temp) / "npm-cache")} + install = subprocess.run( + ["npm", "install", str(PACKAGE_TARBALL), "--prefix", temp], + cwd=ROOT, + check=False, + encoding="utf-8", + env=env, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + ) + self.assertEqual(0, install.returncode, install.stderr) + + ethos = Path(temp) / "node_modules/.bin/ethos" + version = subprocess.run( + [str(ethos), "--version"], + check=False, + encoding="utf-8", + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + ) + self.assertEqual(0, version.returncode, version.stderr) + self.assertEqual("ethos 0.2.0", version.stdout.strip()) + + missing_pdfium = subprocess.run( + [str(ethos), "doctor", "--require-pdfium"], + check=False, + encoding="utf-8", + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + ) + self.assertEqual(12, missing_pdfium.returncode) + combined = missing_pdfium.stdout + missing_pdfium.stderr + self.assertIn("ethos 0.2.0", combined) + self.assertIn("darwin:arm64", combined) + self.assertIn("approved npm vendor manifest", combined) + self.assertIn("ETHOS_PDFIUM_LIBRARY_PATH", combined) + finally: + PACKAGE_TARBALL.unlink(missing_ok=True) + + def test_candidate_evidence_record_is_source_bound_indexed_and_blocked(self) -> None: + raw = read(RECORD) + record = normalized(RECORD) + readme = normalized(VALIDATION_README) + execution = normalized(EXECUTION_STATUS) + checklist = normalized(PUBLIC_RELEASE_CHECKLIST) + block = target_block("v0-2-release-prep") + draft_guard = "$(PYTHON) .github/scripts/test_v0_2_0_draft_artifact_evidence.py" + vendor_guard = "$(PYTHON) .github/scripts/test_v0_2_0_npm_vendor_refresh.py" + claims = "$(PYTHON) .github/scripts/claims_gate.py" + + assert_record_source_binding( + self, + root=ROOT, + raw_record=raw, + normalized_record=record, + validated_head=SOURCE_SHORT, + source_label="v0.2.0 npm vendor refresh", + source_commit=SOURCE_COMMIT, + source_tree=SOURCE_TREE, + ) + for expected in ( + MACOS_ARTIFACT_SHA256, + LINUX_ARTIFACT_SHA256, + EXPECTED_PACK_SHASUM, + EXPECTED_PACK_SHA256, + EXPECTED_PACK_INTEGRITY, + f"Node.js: `{EXPECTED_NODE_VERSION}`", + f"npm: `{EXPECTED_NPM_VERSION}`", + "durable package-content provenance", + "per-file vendor SHA256 values as the durable content binding", + "ethos 0.2.0", + "exit code 12", + "`@docushell/ethos-pdf@0.2.0` was published and then deprecated", + "`@docushell/ethos-pdf@0.2.1` was published", + ): + self.assertIn(expected, record) + for text in (readme, execution, checklist): + self.assertIn(RECORD.name, text) + self.assertIn("npm vendor", text.lower()) + self.assertIn("ethos 0.2.0", text) + for forbidden in FORBIDDEN_APPROVALS: + self.assertNotIn(forbidden, record.lower()) + for marker in PRIVATE_PATH_MARKERS: + self.assertNotIn(marker, raw) + self.assertIn(vendor_guard, block) + self.assertEqual(1, block.count(vendor_guard)) + self.assertLess(block.index(draft_guard), block.index(vendor_guard)) + self.assertLess(block.index(vendor_guard), block.index(claims)) + + +if __name__ == "__main__": + unittest.main() diff --git a/.github/scripts/test_v0_2_0_version_activation.py b/.github/scripts/test_v0_2_0_version_activation.py index 7b53c13..7ad8796 100644 --- a/.github/scripts/test_v0_2_0_version_activation.py +++ b/.github/scripts/test_v0_2_0_version_activation.py @@ -46,21 +46,13 @@ SOURCE_COMMIT = "523e1143bec52e16e596593f5dd649df741b4971" SOURCE_TREE = "8f13de3588a36927635a967cf120fba8f73a39f6" VERSION = "0.2.0" -PUBLIC_BASELINE = "0.1.2" +NPM_VERSION = "0.2.1" RELEASE_CANDIDATE_SENTENCE = ( "v0.2.0 release-candidate source versions are activated for JSON verification and evidence " "anchoring." ) FORBIDDEN_INSTALL_WORDING = ( - "cargo add ethos-doc-core@0.2.0", - "cargo add ethos-verify@0.2.0", - "cargo add ethos-pdf@0.2.0", - "python3 -m pip install ethos-pdf==0.2.0", "npm install -g @docushell/ethos-pdf@0.2.0", - "0.2.0 is released", - "v0.2.0 is released", - "0.2.0 is published", - "v0.2.0 is published", ) PRIVATE_PATH_MARKERS = ( "/" + "Users/", @@ -130,25 +122,25 @@ def test_rust_python_and_npm_versions_are_activated(self) -> None: self.assertGreaterEqual(lock.count(f'version = "{VERSION}"'), 7) self.assertIn(f'version = "{VERSION}"', read(PYPROJECT)) self.assertIn(f'__version__ = "{VERSION}"', read(PYTHON_INIT)) - self.assertEqual(VERSION, npm["version"]) + self.assertEqual(NPM_VERSION, npm["version"]) - def test_public_install_commands_remain_on_approved_baseline(self) -> None: + def test_public_install_commands_match_published_closeout(self) -> None: readme = read(README) claims = json.loads(read(CLAIMS))["surfaces"]["readme"]["claims"] joined_claims = "\n".join(claims) for expected in ( - f"cargo add ethos-doc-core@{PUBLIC_BASELINE}", - f"cargo add ethos-verify@{PUBLIC_BASELINE}", - f"cargo add ethos-pdf@{PUBLIC_BASELINE}", - f"python3 -m pip install ethos-pdf=={PUBLIC_BASELINE}", - f"npm install -g @docushell/ethos-pdf@{PUBLIC_BASELINE}", + f"cargo add ethos-doc-core@{VERSION}", + f"cargo add ethos-verify@{VERSION}", + f"cargo add ethos-pdf@{VERSION}", + f"python3 -m pip install ethos-pdf=={VERSION}", + f"npm install -g @docushell/ethos-pdf@{NPM_VERSION}", ): self.assertIn(expected, readme) self.assertIn(expected, joined_claims) - self.assertIn(RELEASE_CANDIDATE_SENTENCE, normalized_markdown(README)) - self.assertIn(RELEASE_CANDIDATE_SENTENCE, joined_claims) + self.assertNotIn(RELEASE_CANDIDATE_SENTENCE, normalized_markdown(README)) + self.assertNotIn(RELEASE_CANDIDATE_SENTENCE, joined_claims) for forbidden in FORBIDDEN_INSTALL_WORDING: self.assertNotIn(forbidden, readme) self.assertNotIn(forbidden, joined_claims) diff --git a/Makefile b/Makefile index 407d554..2feb193 100644 --- a/Makefile +++ b/Makefile @@ -352,6 +352,7 @@ v0-2-release-prep: $(PYTHON) .github/scripts/test_v0_2_0_ethos_doc_core_cargo_publish_dry_run_evidence.py $(PYTHON) .github/scripts/test_v0_2_0_package_build_evidence.py $(PYTHON) .github/scripts/test_v0_2_0_draft_artifact_evidence.py + $(PYTHON) .github/scripts/test_v0_2_0_npm_vendor_refresh.py $(PYTHON) .github/scripts/claims_gate.py $(PYTHON) .github/scripts/public_boundary_claims_gate.py git diff --check diff --git a/README.md b/README.md index 9d6a16a..b0f1f46 100644 --- a/README.md +++ b/README.md @@ -11,13 +11,11 @@ > Ethos is a deterministic document evidence layer for source-grounded verification and > citation checking across native Ethos JSON and supported foreign parser outputs. The current > beta includes the GitHub source repository, Rust library crates `ethos-doc-core`, -> `ethos-verify`, and `ethos-pdf` at `0.1.2`, the Python `ethos-pdf` wheel at `0.1.2`, the npm -> `@docushell/ethos-pdf@0.1.2` package, and GitHub Release `v0.1.2` macOS arm64/Linux x64 CLI -> artifacts. PDFium-backed commands use caller-provided PDFium through +> `ethos-verify`, and `ethos-pdf` at `0.2.0`, the Python `ethos-pdf` wheel at `0.2.0`, the npm +> `@docushell/ethos-pdf@0.2.1` package, and GitHub Release `v0.2.0` macOS arm64/Linux x64 CLI +> artifacts. npm `@docushell/ethos-pdf@0.2.0` is deprecated because it shipped stale CLI +> binaries; use `0.2.1`. PDFium-backed commands use caller-provided PDFium through > `ETHOS_PDFIUM_LIBRARY_PATH`. -> v0.2.0 release-candidate source versions are activated for JSON verification and evidence -> anchoring. No `0.2.0` registry install wording is approved until publication, registry -> availability, artifact availability, and clean smoke tests are recorded. > Current execution status and release-scope notes live in `docs/execution-status.md`; > public-release hygiene gates live in `docs/public-release-checklist.md`. @@ -125,23 +123,23 @@ ethos --help To add the currently approved Rust library crates to another Rust project: ```bash -cargo add ethos-doc-core@0.1.2 -cargo add ethos-verify@0.1.2 -cargo add ethos-pdf@0.1.2 +cargo add ethos-doc-core@0.2.0 +cargo add ethos-verify@0.2.0 +cargo add ethos-pdf@0.2.0 ``` To install the Python wrapper from PyPI: ```bash -python3 -m pip install ethos-pdf==0.1.2 +python3 -m pip install ethos-pdf==0.2.0 ``` The Python wheel is a thin wrapper around a caller-provided local `ethos` CLI binary. It does not bundle the CLI or PDFium. Install or provide `ethos` separately, and keep `ETHOS_PDFIUM_LIBRARY_PATH` set for PDFium-backed commands. -The v0.2.0 release-candidate lane adds Python wrapper methods for JSON verification and evidence -anchoring through that caller-provided CLI: +The v0.2.0 Python wrapper includes JSON verification and evidence anchoring through that +caller-provided CLI: ```python from ethos_pdf import EthosCli @@ -165,7 +163,7 @@ behavior. To install the npm CLI package on a supported first-release platform: ```bash -npm install -g @docushell/ethos-pdf@0.1.2 +npm install -g @docushell/ethos-pdf@0.2.1 ethos --version ``` @@ -176,7 +174,7 @@ platforms fail before invoking a binary. PDFium-backed commands fail until Run `ethos doctor` for local setup diagnostics. Run `ethos doctor --require-pdfium` after setting `ETHOS_PDFIUM_LIBRARY_PATH` to check whether the configured PDFium is usable by Ethos. -GitHub Release `v0.1.2` also provides evaluation CLI archives for macOS arm64 and Linux x64. +GitHub Release `v0.2.0` also provides evaluation CLI archives for macOS arm64 and Linux x64. ## 2-minute PDF parse quickstart @@ -220,7 +218,7 @@ The command exits `0` and writes a verification report shaped like this: "grounding": { "parser": { "name": "ethos", - "version": "0.1.2" + "version": "0.2.0" } }, "checks": [ diff --git a/crates/ethos-core/NOTICE.md b/crates/ethos-core/NOTICE.md index a922609..64e85cc 100644 --- a/crates/ethos-core/NOTICE.md +++ b/crates/ethos-core/NOTICE.md @@ -4,5 +4,4 @@ Copyright 2026 The Ethos maintainers Licensed under the Apache License, Version 2.0. This source-tree crate bundles no third-party binary assets. Publication metadata is activated -for the approved crates.io candidate surface; public installation and registry action remain -blocked until refreshed binding and operator evidence are recorded. +for the approved crates.io surface; public installation is available from crates.io at `0.2.0`. diff --git a/crates/ethos-core/README.md b/crates/ethos-core/README.md index 354f486..9756197 100644 --- a/crates/ethos-core/README.md +++ b/crates/ethos-core/README.md @@ -4,12 +4,10 @@ types, deterministic serialization identifiers, fingerprints, stable codes, schema types, and trait boundaries. -ADR-0006 reserves the public crates.io identifier `ethos-doc-core` at -`0.0.0-reserved.0`. The Rust library name remains `ethos_core` so existing source imports keep the -same crate path while registry action remains blocked. +ADR-0006 reserves the public crates.io identifier `ethos-doc-core`. The Rust library name remains +`ethos_core` so existing source imports keep the same crate path. -For the v0.2.0 release-candidate lane, parser authors should treat this as the Rust package for -`GroundingSource` implementations: +Parser authors should treat this as the Rust package for `GroundingSource` implementations: ```toml ethos-doc-core = { version = "0.2", features = ["grounding"] } @@ -24,16 +22,10 @@ library crate is `ethos_core`. ## Publication Boundary -- Publication metadata is activated for the approved crates.io candidate surface. -- Public installation from crates.io remains blocked until refreshed tag/source binding and - operator evidence are recorded. -- The reserved crates.io placeholder remains `0.0.0-reserved.0` until registry action is - explicitly recorded. -- This README supports package-publication activation review only. +- Public installation from crates.io is available at `0.2.0`. +- The reserved crates.io placeholder remains historical; `0.2.0` is the current public package. - Source-only pre-alpha crop descriptor APIs are not part of the default public surface. They require the explicit Cargo feature `crop-element`, which exists for in-tree CLI contract work. -- v0.2.0 registry install wording remains in release-candidate status until publication, registry - availability, and clean smoke tests are recorded. ## Metadata Notes diff --git a/crates/ethos-pdf/NOTICE.md b/crates/ethos-pdf/NOTICE.md index d3e4aa6..346c757 100644 --- a/crates/ethos-pdf/NOTICE.md +++ b/crates/ethos-pdf/NOTICE.md @@ -5,5 +5,4 @@ Licensed under the Apache License, Version 2.0. This source-tree crate bundles no PDFium binary and no third-party binary assets. PDFium remains caller-provided through `ETHOS_PDFIUM_LIBRARY_PATH`. Publication metadata is activated for the -approved crates.io candidate surface; public installation and registry action remain blocked until -refreshed binding and operator evidence are recorded. +approved crates.io surface; public installation is available from crates.io at `0.2.0`. diff --git a/crates/ethos-pdf/README.md b/crates/ethos-pdf/README.md index 7ae3a3f..08413ff 100644 --- a/crates/ethos-pdf/README.md +++ b/crates/ethos-pdf/README.md @@ -3,22 +3,16 @@ `ethos-pdf` is the in-tree Rust crate for the PDFium-backed PDF source path behind Ethos parser traits. It normalizes parser output before data crosses the crate boundary. -ADR-0006 reserves the public crates.io identifier `ethos-pdf` at `0.0.0-reserved.0`. +ADR-0006 reserves the public crates.io identifier `ethos-pdf`. -For the v0.2.0 release-candidate lane, this crate is a continuity crate for the lockstep Rust workspace. -The release headline remains JSON verification and evidence anchoring over caller-provided source -evidence. `ethos-pdf` remains the parser/PDFium-facing crate. +For v0.2.0, this crate is a continuity crate for the lockstep Rust workspace. The release headline +is JSON verification and evidence anchoring over caller-provided source evidence. `ethos-pdf` +remains the parser/PDFium-facing crate. ## Publication Boundary -- Publication metadata is activated for the approved crates.io candidate surface. -- Public installation from crates.io remains blocked until refreshed tag/source binding and - operator evidence are recorded. -- The reserved crates.io placeholder remains `0.0.0-reserved.0` until registry action is - explicitly recorded. -- This README supports package-publication activation review only. -- v0.2.0 registry install wording remains in release-candidate status until publication, registry - availability, and clean smoke tests are recorded. +- Public installation from crates.io is available at `0.2.0`. +- The reserved crates.io placeholder remains historical; `0.2.0` is the current public package. ## PDFium Boundary diff --git a/crates/ethos-verify/NOTICE.md b/crates/ethos-verify/NOTICE.md index a922609..64e85cc 100644 --- a/crates/ethos-verify/NOTICE.md +++ b/crates/ethos-verify/NOTICE.md @@ -4,5 +4,4 @@ Copyright 2026 The Ethos maintainers Licensed under the Apache License, Version 2.0. This source-tree crate bundles no third-party binary assets. Publication metadata is activated -for the approved crates.io candidate surface; public installation and registry action remain -blocked until refreshed binding and operator evidence are recorded. +for the approved crates.io surface; public installation is available from crates.io at `0.2.0`. diff --git a/crates/ethos-verify/README.md b/crates/ethos-verify/README.md index 6247a4d..e1bdb09 100644 --- a/crates/ethos-verify/README.md +++ b/crates/ethos-verify/README.md @@ -4,10 +4,10 @@ the `GroundingSource` boundary. It depends on `ethos-core` without parser internals and keeps verification limited to the current source-tree evidence-grounding contract. -ADR-0006 reserves the public crates.io identifier `ethos-verify` at `0.0.0-reserved.0`. +ADR-0006 reserves the public crates.io identifier `ethos-verify`. -For the v0.2.0 release-candidate lane, verification consumers should treat this as the Rust package for -running checks over caller-provided `GroundingSource` evidence: +Verification consumers should treat this as the Rust package for running checks over +caller-provided `GroundingSource` evidence: ```toml ethos-doc-core = { version = "0.2", features = ["grounding"] } @@ -23,14 +23,8 @@ unverifiable source fingerprints fail closed in the report. ## Publication Boundary -- Publication metadata is activated for the approved crates.io candidate surface. -- Public installation from crates.io remains blocked until refreshed tag/source binding and - operator evidence are recorded. -- The reserved crates.io placeholder remains `0.0.0-reserved.0` until registry action is - explicitly recorded. -- This README supports package-publication activation review only. -- v0.2.0 registry install wording remains in release-candidate status until publication, registry - availability, and clean smoke tests are recorded. +- Public installation from crates.io is available at `0.2.0`. +- The reserved crates.io placeholder remains historical; `0.2.0` is the current public package. ## Metadata Notes diff --git a/docs/execution-status.md b/docs/execution-status.md index 51b85dc..4a94b8d 100644 --- a/docs/execution-status.md +++ b/docs/execution-status.md @@ -2,7 +2,9 @@ Date: 2026-06-25 Owner: product / decider -Status: Public beta evaluation is approved for the GitHub source repository; the three bounded Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.1.2`; the Python `ethos-pdf` wheel at `0.1.2`; the npm `@docushell/ethos-pdf` CLI package at `0.1.2`; and the GitHub Release `v0.1.2` macOS arm64 and Linux x64 CLI artifacts. Internal Milestone D source-only closeout remains complete, with Milestone E prep source-only closeout recorded for the internal prep boundary. Week 0 governance is accepted, WS-ENGINE Phase 1 has a real narrow PDFium path, WS-VERIFY-ALPHA has real deterministic evidence checks over native Ethos JSON and pinned OpenDataLoader output, WS-HARNESS has fail-closed readiness scaffolding, the Gate Zero corpus/hardware manifest and direct competitor lock are frozen/signed, ADR-0005 records an accepted `PROCEED` decision for internal Milestone B continuation, ADR-0006 closes package identifier/trademark validation, ADR-0007 locks the product direction, and patch `0.1.1` plus patch `0.1.2` publication/install wording closeouts are recorded for the approved evaluation surfaces. The exact current public sentence approved for source, Rust crate, Python wheel, npm package, macOS arm64 CLI artifact, and Linux x64 CLI artifact evaluation surfaces is: "Ethos is a deterministic document evidence layer for source-grounded verification and citation checking across native Ethos JSON and supported foreign parser outputs. The current beta includes the GitHub source repository, Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.1.2`, the Python `ethos-pdf` wheel at `0.1.2`, the npm `@docushell/ethos-pdf@0.1.2` package, and GitHub Release `v0.1.2` macOS arm64/Linux x64 CLI artifacts. PDFium-backed commands use caller-provided PDFium through `ETHOS_PDFIUM_LIBRARY_PATH`." Milestone C has a source-tree internal artifact-validation closeout for the RAG chunk and security-report trust-loop checks. Milestone D has a source-tree internal source-only closeout recorded in `docs/validation/milestone-d-final-closeout-validation-2026-06-19.md`; the narrow `verify_citations` v1 contract in `docs/milestone-d-verify-citations-contract.md` remains carried by the existing `ethos verify` path and fixture-backed validation. The D `crop_element` v1 contract in `docs/milestone-d-crop-element-contract.md` is carried by the source-bound `ethos crop_element` CLI command plus existing `ethos verify --crop-dir` evidence artifacts; `ethos-core::crop_element` validates request identity, resolves one native document element, and emits descriptor/rendered crop metadata for that source-only contract when caller-provided source PDF bytes are bound. The `sandbox_subprocess` v1 contract in `docs/milestone-d-sandbox-subprocess-contract.md` classifies existing PDF worker-process timeout, memory-limit, stable-error, and diagnostics-gated stderr behavior without adding hardened sandbox rules. The first Milestone E prep boundary is recorded in `docs/milestone-e-prep-scope.md`, the internal fixture-candidate inventory is recorded in `docs/milestone-e-fixture-candidates.json`, internal fixture-promotion criteria are recorded in `docs/milestone-e-fixture-promotion-criteria.json`, the internal trust-loop walkthrough plan is recorded in `docs/milestone-e-internal-trust-loop-walkthrough.json`, the internal trust-loop use protocol is recorded in `docs/milestone-e-internal-trust-loop-use-protocol.json`, the internal trust-loop rehearsal/evidence matrix is recorded in `docs/milestone-e-internal-trust-loop-rehearsal-evidence-matrix.json`, and the internal trust-loop blocker ledger is recorded in `docs/milestone-e-internal-trust-loop-blocker-ledger.json`; these E prep JSON artifacts are schema-validated by `schemas/validate_examples.py` and only identify tracked trust-loop fixture candidates, internal promotion criteria, internal walkthrough sequencing, source-checkout rules for internal use, internal evidence-lane rehearsal planning, blocked-output alignment, evidence-lane alignment, diagnostic-boundary alignment, promotion-status alignment at `not_promoted_beyond_internal_fixture_planning`, source-status alignment at `source-only-pre-alpha-internal-milestone-e-prep`, applies-to binding alignment across current E source artifacts, required-before alignment for current readiness gates including `make milestone-e-prep remains green`, validation-record source-head alignment for each `Validated source HEAD before this record` line, and explicit blocker tracking that does not resolve or soften blockers. The Milestone E prep source-only closeout is recorded in `docs/validation/milestone-e-final-closeout-validation-2026-06-20.md` and does not resolve or soften blockers outside the approved public beta evaluation surfaces. Hosted surfaces, production positioning, Windows packaged artifacts, bundled project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, public benchmark reports, public benchmark claims, and all speed/footprint/parser-quality/table-quality/production claims remain blocked. The controlled-run handoff remains `docs/gate-zero-evidence-runbook.md`; the accepted decision record is `docs/decisions/ADR-0005-gate-zero-decision.md`. +Status: v0.2.0 public beta/evaluation surfaces are live for the GitHub source repository; Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.2.0`; the Python `ethos-pdf` wheel at `0.2.0`; npm `@docushell/ethos-pdf@0.2.1`; and GitHub Release `v0.2.0` macOS arm64/Linux x64 CLI artifacts. npm `@docushell/ethos-pdf@0.2.0` is deprecated because it shipped stale CLI binaries that reported `ethos 0.1.2`; use `0.2.1`. PDFium-backed commands use caller-provided PDFium through `ETHOS_PDFIUM_LIBRARY_PATH`. Hosted surfaces, production positioning, Windows packaged artifacts, bundled project-maintained PDFium builds, public benchmark reports, public benchmark claims, speed, footprint, parser-quality, table-quality, `ethos-doc`, and `ethos-rag` remain blocked. + +Historical baseline before v0.2.0 closeout: Public beta evaluation was approved for the GitHub source repository; the three bounded Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.1.2`; the Python `ethos-pdf` wheel at `0.1.2`; the npm `@docushell/ethos-pdf` CLI package at `0.1.2`; and the GitHub Release `v0.1.2` macOS arm64 and Linux x64 CLI artifacts. Internal Milestone D source-only closeout remains complete, with Milestone E prep source-only closeout recorded for the internal prep boundary. Week 0 governance is accepted, WS-ENGINE Phase 1 has a real narrow PDFium path, WS-VERIFY-ALPHA has real deterministic evidence checks over native Ethos JSON and pinned OpenDataLoader output, WS-HARNESS has fail-closed readiness scaffolding, the Gate Zero corpus/hardware manifest and direct competitor lock are frozen/signed, ADR-0005 records an accepted `PROCEED` decision for internal Milestone B continuation, ADR-0006 closes package identifier/trademark validation, ADR-0007 locks the product direction, and patch `0.1.1` plus patch `0.1.2` publication/install wording closeouts are recorded for the approved evaluation surfaces. The exact historical public sentence approved for source, Rust crate, Python wheel, npm package, macOS arm64 CLI artifact, and Linux x64 CLI artifact evaluation surfaces was: "Ethos is a deterministic document evidence layer for source-grounded verification and citation checking across native Ethos JSON and supported foreign parser outputs. The current beta includes the GitHub source repository, Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.1.2`, the Python `ethos-pdf` wheel at `0.1.2`, the npm `@docushell/ethos-pdf@0.1.2` package, and GitHub Release `v0.1.2` macOS arm64/Linux x64 CLI artifacts. PDFium-backed commands use caller-provided PDFium through `ETHOS_PDFIUM_LIBRARY_PATH`." Milestone C has a source-tree internal artifact-validation closeout for the RAG chunk and security-report trust-loop checks. Milestone D has a source-tree internal source-only closeout recorded in `docs/validation/milestone-d-final-closeout-validation-2026-06-19.md`; the narrow `verify_citations` v1 contract in `docs/milestone-d-verify-citations-contract.md` remains carried by the existing `ethos verify` path and fixture-backed validation. The D `crop_element` v1 contract in `docs/milestone-d-crop-element-contract.md` is carried by the source-bound `ethos crop_element` CLI command plus existing `ethos verify --crop-dir` evidence artifacts; `ethos-core::crop_element` validates request identity, resolves one native document element, and emits descriptor/rendered crop metadata for that source-only contract when caller-provided source PDF bytes are bound. The `sandbox_subprocess` v1 contract in `docs/milestone-d-sandbox-subprocess-contract.md` classifies existing PDF worker-process timeout, memory-limit, stable-error, and diagnostics-gated stderr behavior without adding hardened sandbox rules. The first Milestone E prep boundary is recorded in `docs/milestone-e-prep-scope.md`, the internal fixture-candidate inventory is recorded in `docs/milestone-e-fixture-candidates.json`, internal fixture-promotion criteria are recorded in `docs/milestone-e-fixture-promotion-criteria.json`, the internal trust-loop walkthrough plan is recorded in `docs/milestone-e-internal-trust-loop-walkthrough.json`, the internal trust-loop use protocol is recorded in `docs/milestone-e-internal-trust-loop-use-protocol.json`, the internal trust-loop rehearsal/evidence matrix is recorded in `docs/milestone-e-internal-trust-loop-rehearsal-evidence-matrix.json`, and the internal trust-loop blocker ledger is recorded in `docs/milestone-e-internal-trust-loop-blocker-ledger.json`; these E prep JSON artifacts are schema-validated by `schemas/validate_examples.py` and only identify tracked trust-loop fixture candidates, internal promotion criteria, internal walkthrough sequencing, source-checkout rules for internal use, internal evidence-lane rehearsal planning, blocked-output alignment, evidence-lane alignment, diagnostic-boundary alignment, promotion-status alignment at `not_promoted_beyond_internal_fixture_planning`, source-status alignment at `source-only-pre-alpha-internal-milestone-e-prep`, applies-to binding alignment across current E source artifacts, required-before alignment for current readiness gates including `make milestone-e-prep remains green`, validation-record source-head alignment for each `Validated source HEAD before this record` line, and explicit blocker tracking that does not resolve or soften blockers. The Milestone E prep source-only closeout is recorded in `docs/validation/milestone-e-final-closeout-validation-2026-06-20.md` and does not resolve or soften blockers outside the approved public beta evaluation surfaces. Hosted surfaces, production positioning, Windows packaged artifacts, bundled project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, public benchmark reports, public benchmark claims, and all speed/footprint/parser-quality/table-quality/production claims remain blocked. The controlled-run handoff remains `docs/gate-zero-evidence-runbook.md`; the accepted decision record is `docs/decisions/ADR-0005-gate-zero-decision.md`. v0.2.0 release-candidate activation is recorded in `docs/v0-2-0-release-prep.md`. The release-candidate lane adds the bounded public sentence "v0.2.0 release-candidate source versions @@ -60,6 +62,12 @@ whose smoke sidecars report `ethos 0.2.0`. Artifact publication, npm vendor refr publication, tag creation, and installable `0.2.0` wording remain blocked until separate records and operator decisions pass. +v0.2.0 npm vendor refresh is recorded in +`docs/validation/v0-2-0-npm-vendor-refresh-validation-2026-06-25.md`. The checked-in npm vendor +payload comes from the validated v0.2.0 macOS arm64 and Linux x64 draft CLI artifacts. npm +`@docushell/ethos-pdf@0.2.0` was published with stale binaries and deprecated; npm +`@docushell/ethos-pdf@0.2.1` was published and registry install smoke reports `ethos 0.2.0`. + Older Milestone E paragraphs below preserve historical review records and their blockers at the time they were written. Patch `0.1.1` closeout records supersede those historical blockers only for the approved source, Rust crate, Python wheel, npm package, macOS arm64 CLI artifact, and Linux x64 CLI artifact evaluation surfaces. Patch `0.1.2` npm publication approval request is recorded in diff --git a/docs/public-boundary-claims.json b/docs/public-boundary-claims.json index ddcc333..5986165 100644 --- a/docs/public-boundary-claims.json +++ b/docs/public-boundary-claims.json @@ -5,22 +5,21 @@ "path": "README.md", "claims": [ "Ethos is a deterministic document evidence layer for source-grounded verification and citation checking across native Ethos JSON and supported foreign parser outputs.", - "The current beta includes the GitHub source repository, Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.1.2`, the Python `ethos-pdf` wheel at `0.1.2`, the npm `@docushell/ethos-pdf@0.1.2` package, and GitHub Release `v0.1.2` macOS arm64/Linux x64 CLI artifacts.", + "The current beta includes the GitHub source repository, Rust library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.2.0`, the Python `ethos-pdf` wheel at `0.2.0`, the npm `@docushell/ethos-pdf@0.2.1` package, and GitHub Release `v0.2.0` macOS arm64/Linux x64 CLI artifacts.", + "npm `@docushell/ethos-pdf@0.2.0` is deprecated because it shipped stale CLI binaries; use `0.2.1`.", "PDFium-backed commands use caller-provided PDFium through `ETHOS_PDFIUM_LIBRARY_PATH`.", - "v0.2.0 release-candidate source versions are activated for JSON verification and evidence anchoring.", - "No `0.2.0` registry install wording is approved until publication, registry availability, artifact availability, and clean smoke tests are recorded.", "PDFium-backed commands require caller-provided PDFium through `ETHOS_PDFIUM_LIBRARY_PATH`.", - "cargo add ethos-doc-core@0.1.2", - "cargo add ethos-verify@0.1.2", - "cargo add ethos-pdf@0.1.2", - "python3 -m pip install ethos-pdf==0.1.2", + "cargo add ethos-doc-core@0.2.0", + "cargo add ethos-verify@0.2.0", + "cargo add ethos-pdf@0.2.0", + "python3 -m pip install ethos-pdf==0.2.0", "The Python wheel is a thin wrapper around a caller-provided local `ethos` CLI binary.", "It does not bundle the CLI or PDFium.", "The JSON verification and evidence-anchor wrapper calls use the caller-provided CLI and do not require PDFium unless the chosen command path invokes PDFium-backed parser, crop, or render behavior.", "The npm package vendors only the approved macOS arm64 and Linux x64 CLI binaries.", - "npm install -g @docushell/ethos-pdf@0.1.2", + "npm install -g @docushell/ethos-pdf@0.2.1", "Unsupported platforms fail before invoking a binary.", - "GitHub Release `v0.1.2` also provides evaluation CLI archives for macOS arm64 and Linux x64.", + "GitHub Release `v0.2.0` also provides evaluation CLI archives for macOS arm64 and Linux x64.", "Windows packaged artifacts, bundled project-maintained PDFium builds, hosted surfaces, public benchmark reports, and launch announcements are tracked as separate release-scope work." ] } diff --git a/docs/public-release-checklist.md b/docs/public-release-checklist.md index 2e4c375..2f82340 100644 --- a/docs/public-release-checklist.md +++ b/docs/public-release-checklist.md @@ -5,12 +5,11 @@ or launch announcement. It is intentionally stricter than the day-to-day enginee ## Current Status -Ethos has approved public beta/evaluation surfaces for the GitHub source repository, Rust library -crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.1.2`, the Python `ethos-pdf` wheel -at `0.1.2`, the npm `@docushell/ethos-pdf@0.1.2` package, GitHub Release `v0.1.2` macOS arm64 and -Linux x64 CLI artifacts, and the three approved annotated package tags. The approved patch `0.1.2` -evaluation surfaces are closed by -`docs/validation/patch-0-1-2-current-state-closeout-validation-2026-06-25.md`. Hosted surfaces, +Ethos v0.2.0 public beta/evaluation surfaces are live for the GitHub source repository, Rust +library crates `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.2.0`, the Python +`ethos-pdf` wheel at `0.2.0`, npm `@docushell/ethos-pdf@0.2.1`, and GitHub Release `v0.2.0` +macOS arm64 and Linux x64 CLI artifacts. npm `@docushell/ethos-pdf@0.2.0` is deprecated because +it shipped stale CLI binaries that reported `ethos 0.1.2`; use `0.2.1`. Hosted surfaces, production positioning, Windows packaged artifacts, bundled project-maintained PDFium builds, public benchmark reports, public benchmark claims, speed, footprint, parser-quality, table-quality, `ethos-doc`, and `ethos-rag` remain blocked. @@ -57,6 +56,12 @@ sidecars report `ethos 0.2.0`. This evidence does not approve GitHub Release art publication, npm vendor refresh, registry publication, tag creation, or installable `0.2.0` wording. +v0.2.0 npm vendor refresh is recorded in +`docs/validation/v0-2-0-npm-vendor-refresh-validation-2026-06-25.md`. It refreshes the checked-in +npm vendor payload from validated v0.2.0 draft CLI artifacts. npm `@docushell/ethos-pdf@0.2.0` +was published with stale binaries and deprecated; npm `@docushell/ethos-pdf@0.2.1` is the current +package and registry install smoke reports `ethos 0.2.0`. + Patch `0.1.1` readiness prep is recorded in `docs/validation/patch-0-1-1-readiness-prep-validation-2026-06-23.md` for review only. It records candidate onboarding contents after `ethos doctor`, synthetic fixture golden-change guarding, the diff --git a/docs/validation/README.md b/docs/validation/README.md index 025dfa7..82ab9c6 100644 --- a/docs/validation/README.md +++ b/docs/validation/README.md @@ -10,6 +10,12 @@ in `docs/public-release-checklist.md`. Records: +v0.2.0 publication closeout is recorded in +`v0-2-0-publication-closeout-validation-2026-06-25.md`. It records crates.io publication for +`ethos-doc-core`, `ethos-verify`, and `ethos-pdf` at `0.2.0`; PyPI `ethos-pdf==0.2.0`; +npm `@docushell/ethos-pdf@0.2.1` after deprecating stale `0.2.0`; and GitHub Release `v0.2.0` +macOS arm64/Linux x64 CLI artifacts with checksum, inventory, and smoke evidence. + v0.2.0 release approval request is recorded in `v0-2-0-release-approval-request-validation-2026-06-25.md` for decider review only. It binds the exact source commit, version-bump plan, Rust crate set, `ethos-pdf` continuity decision, Python @@ -57,6 +63,13 @@ Linux x64 draft CLI artifacts, matching checksum sidecars, inventory sidecars, a that report `ethos 0.2.0`. Artifact publication, npm vendor refresh, registry publication, tag creation, and installable `0.2.0` wording remain blocked until separate records pass. +v0.2.0 npm vendor refresh is recorded in +`v0-2-0-npm-vendor-refresh-validation-2026-06-25.md`. It refreshes the +checked-in npm vendor payload from the validated v0.2.0 draft CLI artifacts. npm +`@docushell/ethos-pdf@0.2.0` was published with stale binaries and deprecated; npm +`@docushell/ethos-pdf@0.2.1` is the current package and registry install smoke reports +`ethos 0.2.0`. + Patch `0.1.2` closeout records now document that the approved patch `0.1.2` evaluation surfaces are closed for the GitHub source repository, Rust crates, Python wheel, npm package, macOS arm64/Linux x64 CLI artifacts, and the three approved annotated package tags. Hosted surfaces diff --git a/docs/validation/v0-2-0-npm-vendor-refresh-validation-2026-06-25.md b/docs/validation/v0-2-0-npm-vendor-refresh-validation-2026-06-25.md new file mode 100644 index 0000000..ba18074 --- /dev/null +++ b/docs/validation/v0-2-0-npm-vendor-refresh-validation-2026-06-25.md @@ -0,0 +1,177 @@ +# v0.2.0 npm Vendor Refresh Validation - 2026-06-25 + +Validated source HEAD before this record: `aba17c7`. + +v0.2.0 npm vendor refresh source commit: +`aba17c7254f2e42b9ccbf71db1a3b53113dc0e18`. + +v0.2.0 npm vendor refresh source tree: +`2029e1a25629f80f251ac6ab670231187bada0a9`. + +Status: **v0.2.0 npm vendor payload refreshed from validated draft CLI artifacts; npm 0.2.0 deprecated and corrected by npm 0.2.1** + +This record validates the checked-in `@docushell/ethos-pdf` npm vendor payload after +refreshing it from the v0.2.0 macOS arm64 and Linux x64 draft CLI artifacts recorded in +`v0-2-0-draft-artifact-evidence-validation-2026-06-25.md`. The first npm publication as +`@docushell/ethos-pdf@0.2.0` used stale binaries and is deprecated. The corrected published npm +package is `@docushell/ethos-pdf@0.2.1`, which vendors binaries that report `ethos 0.2.0`. This +record does not approve hosted surfaces, production positioning, Windows packaged artifacts, +bundled project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, public benchmark reports, or +public benchmark claims. + +## Draft Artifact Inputs + +Downloaded from GitHub Actions run `28175143857`: + +- `ethos-macos-arm64.tar.gz` + - SHA256: `c588ee77bbaf99a7d933673e6cd9db190f5992e47d40955def803435a9f9fc5a` +- `ethos-linux-x64.tar.gz` + - SHA256: `00137b20ca2c2a2d2089df1d135920b021b0905d779b1347d134e8a2fb7bfa23` + +Vendor binaries assembled with: + +```sh +node packages/npm/ethos-pdf/scripts/prepare-vendor.js +``` + +Result: + +```text +prepared vendor/ethos-darwin-arm64 +prepared vendor/ethos-linux-x64 +``` + +## Vendor Payload Checksums + +- `vendor/ethos-darwin-arm64` + - SHA256: `e139da8fe635a3e6a42fafb49d66fcf674dbff3d7bdd8dfe844b9eb424e5b53e` +- `vendor/ethos-linux-x64` + - SHA256: `5ab007b03eba6b1730e95053d1b0095b892a40272b610232568295a67c076a83` +- `vendor/manifest.json` + - SHA256: `a5cd55d7670e41ede06eb7955cae76a553ebf9ba506ed374d9a409b75f3dde40` + +## npm Pack Candidate + +Command: + +```sh +npm_config_cache= npm pack --json +``` + +Pack toolchain: + +- Node.js: `v23.11.1` +- npm: `10.9.2` + +The npm shasum, tarball SHA256, and integrity below are qualified by this exact pack toolchain +because npm's gzip/tar serialization can change across npm versions. The durable package-content +provenance is the packed file list plus the per-file vendor SHA256 values as the durable content +binding for the draft-artifact-derived vendor payload above. + +Candidate metadata: + +- package: `@docushell/ethos-pdf@0.2.1` +- filename: `docushell-ethos-pdf-0.2.1.tgz` +- npm shasum: `8f2e2633edb60cea415915c4646da7e9b4dfb4ed` +- tarball SHA256: `c832c9efb3fc8d5480070d8eeb76e00b73f7396d9346a1d490c6ee9109708b2b` +- integrity: + `sha512-WFNV1h/H90FssbhQBxBsriunVa1XIp8MAWeBtstJ+FKF7AsQkkXEoiSY1WQPDZ3BH6iobHuM2j/ZQ2u6zMcfdA==` +- size: `1858822` +- unpacked size: `3976145` +- entry count: `11` + +Packed file list: + +- `LICENSE` +- `NOTICE` +- `QUICKSTART.md` +- `README.md` +- `bin/ethos-pdf.js` +- `package.json` +- `scripts/postinstall.js` +- `scripts/prepare-vendor.js` +- `vendor/ethos-darwin-arm64` +- `vendor/ethos-linux-x64` +- `vendor/manifest.json` + +The vendor binaries were packed with executable mode `493`. + +## Local Install Smoke + +Install command: + +```sh +npm_config_cache= npm install packages/npm/ethos-pdf/docushell-ethos-pdf-0.2.1.tgz --prefix +``` + +Result: + +```text +added 1 package +``` + +Version smoke: + +```sh +/node_modules/.bin/ethos --version +``` + +Result: + +```text +ethos 0.2.0 +``` + +PDFium boundary smoke: + +```sh +/node_modules/.bin/ethos doctor --require-pdfium +``` + +Result: + +```text +exit code 12 +version: ethos 0.2.0 +platform: darwin:arm64 +packaged target: supported by the approved npm vendor manifest +ETHOS_PDFIUM_LIBRARY_PATH is unset +``` + +## Validation Command + +```sh +python3 .github/scripts/test_v0_2_0_npm_vendor_refresh.py +make v0-2-release-prep PYTHON=python3 +``` + +Result: + +```text +test_v0_2_0_npm_vendor_refresh.py: PASS (4 tests) +v0-2-release-prep: PASS +``` + +## npm Publication Correction + +- `@docushell/ethos-pdf@0.2.0` was published and then deprecated because registry install smoke + reported `ethos 0.1.2`. +- `@docushell/ethos-pdf@0.2.1` was published after local tarball smoke reported `ethos 0.2.0`. +- Registry install smoke for `@docushell/ethos-pdf@0.2.1` reported `ethos 0.2.0`. + +## Retained Blockers + +- Windows packaged artifacts remain blocked. +- Hosted surfaces remain blocked. +- Production positioning remains blocked. +- Public benchmark reports remain blocked. +- Public benchmark claims remain blocked. +- Bundled project-maintained PDFium builds remain blocked. +- `ethos-doc` remains blocked. +- `ethos-rag` remains blocked. + +## Result + +The `@docushell/ethos-pdf` npm vendor payload is refreshed from validated v0.2.0 draft CLI +artifacts. The corrected public npm package is `@docushell/ethos-pdf@0.2.1`, and it installs a +CLI that reports `ethos 0.2.0`. diff --git a/docs/validation/v0-2-0-publication-closeout-validation-2026-06-25.md b/docs/validation/v0-2-0-publication-closeout-validation-2026-06-25.md new file mode 100644 index 0000000..dc9d1d3 --- /dev/null +++ b/docs/validation/v0-2-0-publication-closeout-validation-2026-06-25.md @@ -0,0 +1,150 @@ +# v0.2.0 Publication Closeout Validation - 2026-06-25 + +Status: **v0.2.0 public beta/evaluation surfaces published and smoke-verified; npm 0.2.0 deprecated and corrected by npm 0.2.1** + +This record closes the v0.2.0 publication lane for the bounded public beta/evaluation surfaces. +It does not approve hosted surfaces, production positioning, Windows packaged artifacts, bundled +project-maintained PDFium builds, public benchmark reports, public benchmark claims, speed, +footprint, parser-quality, table-quality, `ethos-doc`, or `ethos-rag`. + +## Published Surfaces + +- crates.io: + - `ethos-doc-core = "0.2.0"` + - `ethos-verify = "0.2.0"` + - `ethos-pdf = "0.2.0"` +- PyPI: + - `ethos-pdf==0.2.0` +- npm: + - `@docushell/ethos-pdf@0.2.1` is the current package. + - `@docushell/ethos-pdf@0.2.0` is deprecated because it shipped stale CLI binaries that + reported `ethos 0.1.2`. +- GitHub Release: + - `v0.2.0` + - macOS arm64 and Linux x64 CLI artifacts, checksum sidecars, inventory sidecars, and smoke + sidecars. + +## Operator Evidence + +`cargo search ethos-doc-core --limit 1`: + +```text +ethos-doc-core = "0.2.0" # Ethos canonical document model, IDs, errors, schema types, traits, c14n and fingerprints +``` + +`cargo search ethos-verify --limit 1`: + +```text +ethos-verify = "0.2.0" # Parser-agnostic citation evidence verification over GroundingSource (alpha lands Milestone B) +``` + +`cargo search ethos-pdf --limit 1`: + +```text +ethos-pdf = "0.2.0" # PDFium backend behind EthosPdfBackend — quantize-at-extraction lives here (WS-ENGINE, Milestone A) +``` + +`python3 -m pip index versions ethos-pdf`: + +```text +ethos-pdf (0.2.0) +Available versions: 0.2.0, 0.1.2, 0.1.1, 0.1.0, 0.0.0.post0 +LATEST: 0.2.0 +``` + +PyPI clean venv smoke: + +```text +Successfully installed ethos-pdf-0.2.0 +0.2.0 +``` + +`npm view @docushell/ethos-pdf dist-tags versions --json`: + +```json +{ + "dist-tags": { + "latest": "0.2.1" + }, + "versions": [ + "0.0.0-reserved.0", + "0.1.0", + "0.1.1", + "0.1.2", + "0.2.0", + "0.2.1" + ] +} +``` + +`npm view @docushell/ethos-pdf@0.2.0 --json` contains: + +```json +{ + "deprecated": "Do not use: published with stale CLI binary reporting ethos 0.1.2. Use a later 0.2.x patch release." +} +``` + +`npm view @docushell/ethos-pdf@0.2.1 version dist.shasum`: + +```text +version = '0.2.1' +dist.shasum = '95a55f89347ed8159d08aa31d59bf81e08337793' +``` + +npm clean install smoke: + +```text +added 1 package, and audited 2 packages in 493ms +found 0 vulnerabilities +ethos 0.2.0 +``` + +`gh release view v0.2.0 --json tagName,isDraft,isPrerelease,url`: + +```json +{ + "isDraft": false, + "isPrerelease": false, + "tagName": "v0.2.0", + "url": "https://github.com/docushell/ethos/releases/tag/v0.2.0" +} +``` + +Downloaded GitHub Release CLI artifact digest verification: + +```text +ethos-macos-arm64.tar.gz + actual: 3c4fd236b1f76b87d0c765be5a35d9fd1476cac8475552a281f37df1d2fca06d + checksum: 3c4fd236b1f76b87d0c765be5a35d9fd1476cac8475552a281f37df1d2fca06d + inventory: 3c4fd236b1f76b87d0c765be5a35d9fd1476cac8475552a281f37df1d2fca06d + ok: True +ethos-linux-x64.tar.gz + actual: 0a1173471a9a4f1f8a2b9e60fa8192ab2af4796170b8f407883299dd85148ca7 + checksum: 0a1173471a9a4f1f8a2b9e60fa8192ab2af4796170b8f407883299dd85148ca7 + inventory: 0a1173471a9a4f1f8a2b9e60fa8192ab2af4796170b8f407883299dd85148ca7 + ok: True +``` + +Local macOS CLI artifact smoke: + +```text +ethos 0.2.0 +Deterministic PDF parsing, RAG artifacts, and citation evidence verification +``` + +GitHub Actions release workflow: + +```text +Run release (28189912786) completed with 'success' +``` + +## Retained Blockers + +- Windows packaged artifacts remain blocked. +- Bundled project-maintained PDFium builds remain blocked. +- Hosted surfaces remain blocked. +- Production positioning remains blocked. +- Public benchmark reports and public benchmark claims remain blocked. +- Speed, footprint, parser-quality, table-quality, and production claims remain blocked. +- `ethos-doc` and `ethos-rag` remain blocked as public package/product surfaces. diff --git a/packages/npm/ethos-pdf/QUICKSTART.md b/packages/npm/ethos-pdf/QUICKSTART.md index f10cc54..0c40259 100644 --- a/packages/npm/ethos-pdf/QUICKSTART.md +++ b/packages/npm/ethos-pdf/QUICKSTART.md @@ -8,6 +8,14 @@ The package does not bundle PDFium. Commands that parse or crop PDFs require a caller-provided PDFium dynamic library. +Install the current npm package with: + +```sh +npm install -g @docushell/ethos-pdf@0.2.1 +``` + +Version `0.2.0` is deprecated because it shipped stale CLI binaries that reported `ethos 0.1.2`. + ## Vendor Binary Assembly Before publication, assemble the package vendor payload from the approved GitHub Release archives: diff --git a/packages/npm/ethos-pdf/README.md b/packages/npm/ethos-pdf/README.md index 7a7b03f..0516844 100644 --- a/packages/npm/ethos-pdf/README.md +++ b/packages/npm/ethos-pdf/README.md @@ -1,6 +1,6 @@ # @docushell/ethos-pdf -`@docushell/ethos-pdf` is the npm binary package scaffold for the Ethos CLI. +`@docushell/ethos-pdf` is the npm binary package for the Ethos CLI. Supported first-release targets: @@ -31,5 +31,6 @@ Vendor assembly: - the script extracts the `ethos` executable from each archive and writes `vendor/ethos-darwin-arm64` and `vendor/ethos-linux-x64`. -The package is not approved for public publication until the final release approval record binds the -source commit, package version, artifact checksums, and exact public wording. +The current npm package is `@docushell/ethos-pdf@0.2.1`, which vendors CLI binaries that report +`ethos 0.2.0`. Version `0.2.0` is deprecated because it shipped stale CLI binaries that reported +`ethos 0.1.2`. diff --git a/packages/npm/ethos-pdf/package.json b/packages/npm/ethos-pdf/package.json index 2722c25..b8cc610 100644 --- a/packages/npm/ethos-pdf/package.json +++ b/packages/npm/ethos-pdf/package.json @@ -1,6 +1,6 @@ { "name": "@docushell/ethos-pdf", - "version": "0.2.0", + "version": "0.2.1", "description": "Ethos PDF CLI binary package for document evidence workflows.", "license": "Apache-2.0", "repository": { diff --git a/packages/npm/ethos-pdf/vendor/ethos-darwin-arm64 b/packages/npm/ethos-pdf/vendor/ethos-darwin-arm64 index 0a9573e..dd0cc41 100755 Binary files a/packages/npm/ethos-pdf/vendor/ethos-darwin-arm64 and b/packages/npm/ethos-pdf/vendor/ethos-darwin-arm64 differ diff --git a/packages/npm/ethos-pdf/vendor/ethos-linux-x64 b/packages/npm/ethos-pdf/vendor/ethos-linux-x64 index 4fee720..26fe8d9 100755 Binary files a/packages/npm/ethos-pdf/vendor/ethos-linux-x64 and b/packages/npm/ethos-pdf/vendor/ethos-linux-x64 differ diff --git a/packages/npm/ethos-pdf/vendor/manifest.json b/packages/npm/ethos-pdf/vendor/manifest.json index 0facdff..b31bbda 100644 --- a/packages/npm/ethos-pdf/vendor/manifest.json +++ b/packages/npm/ethos-pdf/vendor/manifest.json @@ -5,12 +5,12 @@ "darwin:arm64": { "binary": "ethos-darwin-arm64", "release_asset": "ethos-macos-arm64.tar.gz", - "release_asset_sha256": "7da7da71fb0c21b25cd2ffc198480ee80bf9f0c9e70e461cffbdcbdda8d7023c" + "release_asset_sha256": "c588ee77bbaf99a7d933673e6cd9db190f5992e47d40955def803435a9f9fc5a" }, "linux:x64": { "binary": "ethos-linux-x64", "release_asset": "ethos-linux-x64.tar.gz", - "release_asset_sha256": "4e260b464dc9557bc31c29fb1d1dfa75311fe12734bc79af4a31e1649797e456" + "release_asset_sha256": "00137b20ca2c2a2d2089df1d135920b021b0905d779b1347d134e8a2fb7bfa23" } } } diff --git a/python/QUICKSTART.md b/python/QUICKSTART.md index a0944f7..2619a2f 100644 --- a/python/QUICKSTART.md +++ b/python/QUICKSTART.md @@ -6,7 +6,7 @@ It does not bundle Ethos or PDFium. Install the published evaluation wheel from PyPI with: ```sh -python3 -m pip install ethos-pdf==0.1.2 +python3 -m pip install ethos-pdf==0.2.0 ``` ## PDFium Setup diff --git a/python/README.md b/python/README.md index 93f6c03..28db322 100644 --- a/python/README.md +++ b/python/README.md @@ -5,13 +5,11 @@ This directory contains the `ethos-pdf` Python package source for Ethos. Install the published evaluation wheel from PyPI with: ```sh -python3 -m pip install ethos-pdf==0.1.2 +python3 -m pip install ethos-pdf==0.2.0 ``` -`v0.2.0` release-candidate source versions are activated for JSON verification and evidence-anchor -wrapper calls through a caller-provided `ethos` CLI binary. Do not use `0.2.0` install wording -until the package is published, matching CLI artifacts are available, and the post-publication -smoke tests are recorded. +`v0.2.0` adds JSON verification and evidence-anchor wrapper calls through a caller-provided +`ethos` CLI binary. The Python wheel does not bundle the CLI or PDFium. The package exposes a public semver API beginning at `0.1.0` for Python `>=3.8`. Patch releases must not break public function signatures, exception classes, or documented return shapes. Minor @@ -110,7 +108,7 @@ surface. Non-bound evidence-anchor outcomes are returned as structured reports, Verify exit semantics: - exit `0` with JSON returns a report; -- exit `1` with JSON returns a negative verification report; +- exit `1` with JSON returns a negative verification report when `fail_on_ungrounded=True`; - exit `>=2` raises `EthosCommandError` or a more specific subclass. Run the focused tests with: