From 52be6fb70c477eee1417ac6827c5b7623bef067c Mon Sep 17 00:00:00 2001 From: Daniel Parapunov Date: Sun, 28 Jun 2026 13:27:44 +0200 Subject: [PATCH 1/2] Prepare open-scaffold 0.34.0 release sync --- .../175-ambient-capture-trust-package-sync.md | 55 +++++++++++++++++ ...-175-ambient-capture-trust-package-sync.md | 61 +++++++++++++++++++ docs/CHANGELOG.md | 24 ++++++++ package-lock.json | 4 +- package.json | 2 +- tests/section-parser.test.ts | 6 +- 6 files changed, 147 insertions(+), 5 deletions(-) create mode 100644 .osc/plans/active/175-ambient-capture-trust-package-sync.md create mode 100644 .osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md diff --git a/.osc/plans/active/175-ambient-capture-trust-package-sync.md b/.osc/plans/active/175-ambient-capture-trust-package-sync.md new file mode 100644 index 00000000..f775868a --- /dev/null +++ b/.osc/plans/active/175-ambient-capture-trust-package-sync.md @@ -0,0 +1,55 @@ +# Plan: 175-ambient-capture-trust-package-sync + +## Status + +active + +## Context + +Issue #239 requests a release-prep PR for `open-scaffold@0.34.0` because npm `latest` remains `0.33.0` while `origin/main` contains package-visible work merged after `v0.33.0`. The release target must be `0.34.0`, not the stale `0.4.0`/`0.5.0` line, and the release must be cut from current `origin/main`. + +## Goal + +Prepare a draft release-sync PR for `open-scaffold@0.34.0` with package metadata, changelog, and release-prep evidence ready for owner-gated publish and GitHub Release follow-through. + +## Constraints / Out of scope + +- This plan prepares a draft PR only; it does not merge, publish to npm, create/move tags, create/move GitHub Releases, dispatch workflows, change branch protection, or touch secrets. +- Keep all release language in candidate/prep state until npm and GitHub Release proof exists. +- Follow current `origin/main` truth. The release delta includes PRs #229, #230, #232, #236, #237, and #238. +- Do not change ambient capture product behavior, local Claude/Codex user config, package publication workflow authority, or package version beyond `0.34.0`. +- Do not close issue #239 merely because the prep PR exists; owner-gated publish/release proof remains follow-through after merge. + +## Files to touch + +- `package.json` — bump the package version from `0.33.0` to `0.34.0`. +- `package-lock.json` — keep the root and `packages[""]` lockfile versions aligned with `package.json`. +- `docs/CHANGELOG.md` — add a top `v0.34.0` release-candidate entry with source PRs, evidence links, and owner-gated boundaries. +- `.osc/plans/active/175-ambient-capture-trust-package-sync.md` — this release-prep work record while in progress. +- `.osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md` — release-prep evidence note with observed verification. +- `tests/section-parser.test.ts` — update live-corpus hash comments only if validation proves the new plan/evidence records are the sole snapshot change. +- `MISSION.md` — only if `osc close` records the verified plan closeout. + +## Acceptance criteria + +- [ ] `package.json`, `package-lock.json` root, and `package-lock.json` `packages[""]` all read `0.34.0`. +- [ ] `docs/CHANGELOG.md` contains a top `v0.34.0` candidate/prep entry that links issue #239, source PRs #229, #230, #232, #236, #237, and #238, prior release `v0.33.0`, npm `0.33.0`, and this evidence note. +- [ ] The release-prep evidence note records observed version alignment, registry/release availability checks, package dry-run output, verification commands, and the no-merge/no-publish/no-release authority boundary. +- [ ] Open Scaffold plan/evidence records contain no placeholder text and validate after any intentional live-corpus hash update. +- [ ] A draft PR is opened or updated against `main` from `forge/issue-239-release-open-scaffold-ambient-capture-trust-package`, with `Closes #239` or an explicit keep-open explanation and a public-safe authority boundary. +- [ ] No forbidden external release action is performed: no merge, real publish, workflow dispatch, tag, GitHub Release, force-push, settings change, secret change, or package version beyond `0.34.0`. + +## Verification steps + +1. `node -e "const p=require('./package.json'), l=require('./package-lock.json'); if (p.version !== '0.34.0' || l.version !== '0.34.0' || l.packages[''].version !== '0.34.0') process.exit(1)"` — expected pass. +2. `npm view open-scaffold dist-tags --json` and `npm view open-scaffold@0.34.0 version --json` — before owner publishing, expected `latest` remains `0.33.0` and `0.34.0` is not found, or record environment/network failure honestly. +3. GitHub tag/release/PR overlap checks — expected no `v0.34.0` release/tag and no open overlapping PR before this draft PR. +4. `git diff --check` — expected pass. +5. `./verify.sh --strict && npm test -- --run` — configured required verification, expected pass. +6. `npm run build` — expected pass. +7. `npm pack --dry-run --json` — expected package id `open-scaffold@0.34.0`; record observed tarball/file counts. +8. `npm publish --dry-run --tag latest` — dry-run only if npm auth/network permits; if blocked, record as not observed without attempting a real publish. + +## Open questions + +- None for release-prep. npm publish, GitHub Release creation, tag/release movement, and post-publish smoke remain owner-gated follow-through after review/merge. diff --git a/.osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md b/.osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md new file mode 100644 index 00000000..b580bcb3 --- /dev/null +++ b/.osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md @@ -0,0 +1,61 @@ +# Release / Evidence Note: 175-ambient-capture-trust-package-sync + +## Summary + +Prepared the `open-scaffold@0.34.0` release-sync candidate for the ambient capture trust/setup package surface now on `origin/main`. This note records draft-PR preparation evidence only; it does not claim merge, npm publication, tag creation, GitHub Release creation, or owner approval for those follow-through actions. + +## Traceability + +- Roadmap / issue / task: https://github.com/graphanov/open-scaffold/issues/239. +- Plan: `.osc/plans/active/175-ambient-capture-trust-package-sync.md` while this prep PR is in progress; expected final path `.osc/plans/done/175-ambient-capture-trust-package-sync.md` after closeout. +- Release delta from `v0.33.0` to current `origin/main`: #229, #230, #232, #236, #237, and #238. +- Source PRs: + - #229 — https://github.com/graphanov/open-scaffold/pull/229 + - #230 — https://github.com/graphanov/open-scaffold/pull/230 + - #232 — https://github.com/graphanov/open-scaffold/pull/232 + - #236 — https://github.com/graphanov/open-scaffold/pull/236 + - #237 — https://github.com/graphanov/open-scaffold/pull/237 + - #238 — https://github.com/graphanov/open-scaffold/pull/238 +- Previous release: https://github.com/graphanov/open-scaffold/releases/tag/v0.33.0. +- npm current latest before owner publishing: https://www.npmjs.com/package/open-scaffold/v/0.33.0. +- Run ID / run packet: N/A; this release-prep slice was implemented directly from issue #239's approved design and critique. +- Branch / PR: intended branch `forge/issue-239-release-open-scaffold-ambient-capture-trust-package`; draft PR not opened from this workspace because branch creation/commit publication is blocked by environment permissions. + +## Verification + +- `npm run osc -- resume` — PASS: handoff packet compiled; unrelated active plan `163-proof-harness-v2` noted. +- `./verify.sh --quick --quiet` — PASS before content edits. +- GitHub connector PR overlap search for issue #239, title, release scope, and branch — PASS: no open overlapping PR returned before edits. +- `git fetch --prune origin` — PASS; local `HEAD` and `origin/main` both at `46fe3f405076cc02001e9d73447109fbcddadfcb` before edits. +- `git log --oneline v0.33.0..origin/main` — PASS: release delta observed as #229, #230, #232, #236, #237, and #238. +- `npm version 0.34.0 --no-git-tag-version` — PASS: package metadata bumped without tag creation. +- Version alignment command — PASS: `package.json`, package-lock root, and package-lock `packages[""]` all read `0.34.0`. +- `npm view open-scaffold dist-tags --json` — BLOCKED in this workspace: `ENOTFOUND registry.npmjs.org`. +- `npm view open-scaffold@0.34.0 version --json` — BLOCKED in this workspace: `ENOTFOUND registry.npmjs.org`. +- `git show-ref --verify refs/tags/v0.34.0` — PASS negative local tag check: no local `v0.34.0` tag ref. +- `gh release view v0.34.0 --repo graphanov/open-scaffold` — BLOCKED in this workspace: `gh` could not connect to `api.github.com`. +- `git diff --check` — PASS. +- `./verify.sh --strict` — PASS before live-corpus hash refresh: 10 pass / 0 fail / 0 warn. +- `npm test -- --run tests/section-parser.test.ts` — EXPECTED FAIL before live-corpus hash refresh: only the pinned plan hash changed after adding the new release-prep plan/evidence corpus (`received a2f1bd25dae3e5eeebfed71332f0dd9334b00d87a4dcd97c7fdce1b799c3c3b4`). +- `npm run build` — PASS. +- `npm pack --dry-run --json` — initial run BLOCKED by the Hermes profile npm cache (`EPERM` under `.npm/_cacache/tmp`); rerun with `npm_config_cache=/private/tmp/open-scaffold-npm-cache` PASS for `open-scaffold@0.34.0`, tarball `open-scaffold-0.34.0.tgz`, 228 files, 406175 bytes packed, 1868312 bytes unpacked, shasum `40c386f49cf4440011723af94bf63d477e410cf2`. +- `npm_config_cache=/private/tmp/open-scaffold-npm-cache npm publish --dry-run --tag latest` — PASS dry-run only; npm reported `+ open-scaffold@0.34.0`. No real publish was performed. +- `npm test -- --run tests/section-parser.test.ts` after live-corpus hash refresh — PASS: 1 file / 7 tests. +- `./verify.sh --strict && npm test -- --run` after live-corpus hash refresh — PARTIAL / BLOCKED BY SANDBOX: strict verification passed again (10 pass / 0 fail / 0 warn), then full Vitest failed because this sandbox forbids local IPC/listen operations used by `node_modules/.bin/tsx` subprocesses and cockpit loopback tests (`listen EPERM` on `/var/.../tsx-501/*.pipe` and `127.0.0.1`). Observed test summary under that environment: 51 files, 30 passed / 21 failed; 625 tests, 458 passed / 167 failed; failures were dominated by subprocess/loopback listener setup, not assertion deltas in the release-prep files. +- `TSX_DISABLE_CACHE=1 node_modules/.bin/tsx src/cli.ts verify --help` — BLOCKED by same `listen EPERM` pipe failure. +- `node --import tsx src/cli.ts verify --help` — PASS: CLI help rendered. +- `node dist/cli.js --version` — PASS: `0.34.0`. +- `node dist/cli.js verify --help` — PASS: compiled CLI help rendered. +- Draft PR body generation with `$HERMES_HOME/scripts/john_lomein_comment_templates.py pr-draft-body` — PASS: generated public-safe Summary, Scope, Out-of-scope, Verification, Risk, Linked issue, and Authority boundary sections with an explicit keep-open explanation for issue #239. +- GitHub connector `_create_branch` for `forge/issue-239-release-open-scaffold-ambient-capture-trust-package` from `main` — BLOCKED: connector call was canceled by the environment before branch mutation. +- `git switch -c forge/issue-239-release-open-scaffold-ambient-capture-trust-package` — BLOCKED: local `.git/refs/...lock` cannot be created (`Operation not permitted`). +- `git push -u origin forge/issue-239-release-open-scaffold-ambient-capture-trust-package` — BLOCKED: local branch/refspec does not exist after the branch-create failure. + +## Outcome + +Draft release-sync preparation is complete locally for `open-scaffold@0.34.0`, but branch/commit/PR publication is blocked in this managed workspace by read-only local git metadata and canceled GitHub connector branch mutation. Owner-gated follow-through remains out of scope for automation: merge, npm trusted publishing, npm `latest` movement, tag creation, GitHub Release creation/Latest movement, and post-publish smoke must happen only after explicit owner approval. + +## Follow-up + +- Before draft PR: publish these prepared local changes to `forge/issue-239-release-open-scaffold-ambient-capture-trust-package` from an environment with git metadata write access or working GitHub connector mutation, then open the draft PR with the generated public-safe body. +- After merge and owner gate: dispatch trusted publishing for `expected-version=0.34.0`, verify npm `latest`, create GitHub Release `v0.34.0`, and record post-publish smoke evidence. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 1bd29e59..a225146b 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -4,6 +4,30 @@ This is a curated human-readable changelog. It compresses the detailed `MISSION. For live package truth, check npm. For live release truth, check GitHub Releases. Repository evidence notes describe what was prepared and, when applicable, the publication proof after trusted publishing/GitHub Release follow-through. +## v0.34.0 — Ambient capture trust and setup package sync + +Status: release-sync candidate prepared for `open-scaffold@0.34.0`; not yet published to npm, not yet tagged, and no GitHub Release `v0.34.0` exists until owner-gated follow-through after review/merge. npm `latest` remains `0.33.0` before that owner action. + +Highlights: + +- Prepares the post-`v0.33.0` mainline work for the public npm package surface, cut from current `origin/main`. +- Adds the ambient capture setup helper for Codex and Claude Code, including dry-run/setup-all behavior and guarded config writes. +- Adds ambient record verification and trust-report behavior for validating captured records without exposing raw transcript contents. +- Feeds ambient capture records into `osc resume` / handoff summaries so resumed work can cite observed ambient records without treating transcripts as semantic truth. +- Adds MCP coding-agent quickstart documentation. +- Carries the `@types/node` development-dependency refresh and the `0.33.0` publication proof closeout into the release delta. +- Keeps Open Scaffold core repo-native and authority-limited: it records and verifies work artifacts, but does not grant runtime, merge, publish, release, tag, workflow-dispatch, or settings authority by itself. +- Keeps ambient capture observational. Trust reports check record shape and captured trust signals; they are not semantic correctness, compliance certification, or transcript truth beyond the captured evidence boundary. + +Evidence: + +- Issue: https://github.com/graphanov/open-scaffold/issues/239 +- Source PRs: https://github.com/graphanov/open-scaffold/pull/229, https://github.com/graphanov/open-scaffold/pull/230, https://github.com/graphanov/open-scaffold/pull/232, https://github.com/graphanov/open-scaffold/pull/236, https://github.com/graphanov/open-scaffold/pull/237, and https://github.com/graphanov/open-scaffold/pull/238 +- Release-sync plan: `.osc/plans/active/175-ambient-capture-trust-package-sync.md` +- Release-sync evidence note: `.osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md` +- Previous release: https://github.com/graphanov/open-scaffold/releases/tag/v0.33.0 +- npm current latest before owner publishing: https://www.npmjs.com/package/open-scaffold/v/0.33.0 + ## v0.33.0 — Evidence battery package sync Status: published to npm as `open-scaffold@0.33.0`; GitHub Release `v0.33.0` is Latest after owner-approved trusted publishing and release follow-through, superseding `v0.32.1`. diff --git a/package-lock.json b/package-lock.json index 30228b14..e22c1a80 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "open-scaffold", - "version": "0.33.0", + "version": "0.34.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "open-scaffold", - "version": "0.33.0", + "version": "0.34.0", "license": "MIT", "bin": { "open-scaffold": "dist/cli.js", diff --git a/package.json b/package.json index 749ed175..706fd9ed 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "open-scaffold", - "version": "0.33.0", + "version": "0.34.0", "description": "Pre-1.0 repo-native work-record CLI for AI-agent handoff, evidence, and review.", "license": "MIT", "repository": { diff --git a/tests/section-parser.test.ts b/tests/section-parser.test.ts index a7a1b440..b5054ebf 100644 --- a/tests/section-parser.test.ts +++ b/tests/section-parser.test.ts @@ -253,7 +253,8 @@ This sample must not count as the real section. // v1-public-positioning-polish closeout: added done public-positioning polish plan. // 173 closeout: moved token-efficiency proof plan to done with checked AC evidence and evidence-battery release note. // 174 release closeout: added evidence-battery package-sync plan to done. - expect(hash(planIssueSnapshot)).toBe('3059f88200004620cb426c3b9661540848669b985e021de10969c71bba7df271'); + // 175 release prep: added ambient capture trust package-sync plan. + expect(hash(planIssueSnapshot)).toBe('a2f1bd25dae3e5eeebfed71332f0dd9334b00d87a4dcd97c7fdce1b799c3c3b4'); expect(scaffold.failures).toEqual([]); // 168: evidence note 2026-06-12-168-dollar-verb-retirement.md added to .osc/releases. // 170 review hardening: evidence note refreshed with PR URL, final test count, and Codex-reported total_tokens. @@ -264,7 +265,8 @@ This sample must not count as the real section. // v1-public-positioning-polish closeout added local evidence note; release-warning set unchanged. // 173 closeout: added source-labeled proof-battery evidence note with close decision. // 174 release closeout: added evidence-battery package-sync release note; release-warning set unchanged. - expect(hash({ failures: scaffold.failures, releases: releaseOutcomeSnapshot })).toBe('d7a3c1145aeca94f3c1f74081815847c08c3364d6734020372ebde89f55754b0'); + // 175 release prep: added ambient capture trust package-sync evidence note; release-warning set unchanged. + expect(hash({ failures: scaffold.failures, releases: releaseOutcomeSnapshot })).toBe('f0bff2acea51580dab1b6553a1535d67de1e3bb528067e331906692631ada2fe'); expect(realPlanFiles().every((path) => statSync(path).isFile())).toBe(true); }); }); From 442924f8e7e10b21ca1674083779091b849e77cc Mon Sep 17 00:00:00 2001 From: Daniel Parapunov Date: Sun, 28 Jun 2026 18:13:39 +0200 Subject: [PATCH 2/2] Fix release line docs for 0.34.0 --- README.md | 2 +- ROADMAP.md | 4 ++-- docs/STABILITY.md | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index cff3b5e5..dd3a52ea 100644 --- a/README.md +++ b/README.md @@ -80,7 +80,7 @@ Use for multi-session AI work, PRs needing intent and evidence, audit-sensitive ## Honest limits -Pre-1.0 (`v0.33.x`). Does not make your model smarter — it makes the loop around the model disciplined. Maturity contract: [`docs/STABILITY.md`](docs/STABILITY.md). Claim ledger: [`docs/PROOF_HARNESS.md`](docs/PROOF_HARNESS.md). Raw receipts: [`harness-bench`](https://github.com/graphanov/harness-bench). +Pre-1.0 (`v0.34.x`). Does not make your model smarter — it makes the loop around the model disciplined. Maturity contract: [`docs/STABILITY.md`](docs/STABILITY.md). Claim ledger: [`docs/PROOF_HARNESS.md`](docs/PROOF_HARNESS.md). Raw receipts: [`harness-bench`](https://github.com/graphanov/harness-bench). ## Key docs diff --git a/ROADMAP.md b/ROADMAP.md index 7bacd1f0..87c48722 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -40,7 +40,7 @@ Not every small task needs every link, but meaningful work should make the chain ## Historical baseline milestones -The early milestones below preserve the project-history shape that was once called v1. The current public package line is `v0.33.x` pre-1.0; these entries are proof of dogfood history, not a fresh npm/GitHub Release authorization. +The early milestones below preserve the project-history shape that was once called v1. The current public package line is `v0.34.x` pre-1.0; these entries are proof of dogfood history, not a fresh npm/GitHub Release authorization. ## Milestone 0 — Product contract and dogfood baseline @@ -397,7 +397,7 @@ Acceptance criteria: ### Milestone 18 — historical v1.0.0 stability launch -Status: completed as a historical launch line through `.osc/plans/done/069-v1-launch.md`, `.osc/releases/2026-05-25-v1-launch.md`, PR #113, and later package/release follow-through. As of the `123-evidence-chain-package-release-sync` closeout, the forward-moving channel was intentionally corrected back to pre-1.0 hardening; after the `osc capture` package sync, that current hardening line is `v0.33.x` until the public product surface earns a mature 1.0 contract. +Status: completed as a historical launch line through `.osc/plans/done/069-v1-launch.md`, `.osc/releases/2026-05-25-v1-launch.md`, PR #113, and later package/release follow-through. As of the `123-evidence-chain-package-release-sync` closeout, the forward-moving channel was intentionally corrected back to pre-1.0 hardening; after the ambient capture trust package sync, that current hardening line is `v0.34.x` until the public product surface earns a mature 1.0 contract. Goal: make the adoption contract explicit before the first major-release experiment. diff --git a/docs/STABILITY.md b/docs/STABILITY.md index a059116a..31882c7a 100644 --- a/docs/STABILITY.md +++ b/docs/STABILITY.md @@ -2,7 +2,7 @@ This page is the single home for Open Scaffold's maturity boundary: what is stable, what is experimental, what is future, and what the project does not claim. Other surfaces state their promise once and link here. -The short version: Open Scaffold is on a pre-1.0 line (`v0.33.x`). The stable core is the work loop and its record — `MISSION.md` → plan → run packet or amendment → evidence → verification → close — plus the handoff/review/gate helpers (`osc first-run`, `osc handoff`, `osc review`, `osc gate`, `osc pr check`, `osc compare`, `osc trace`). Core runtime launch, root adapter dispatch, and the old harness command grammar are not current-package promises. +The short version: Open Scaffold is on a pre-1.0 line (`v0.34.x`). The stable core is the work loop and its record — `MISSION.md` → plan → run packet or amendment → evidence → verification → close — plus the handoff/review/gate helpers (`osc first-run`, `osc handoff`, `osc review`, `osc gate`, `osc pr check`, `osc compare`, `osc trace`). Core runtime launch, root adapter dispatch, and the old harness command grammar are not current-package promises. ## Honest limits @@ -13,11 +13,11 @@ Everything Open Scaffold does not claim, in one place: - **The benchmark program is pilot-grade and partly self-run.** One worker model, n=1 cells, owner-built instrument (preregistration, hidden inputs, blind double-implementation, and kill rules as mitigations); replication with humans and larger n is open work. The older bounded `examples/proof/` fixture remains a separate, narrower surface. - **It is not a compliance certification, sandbox, or security guarantee.** It produces structural evidence a process can build on; it does not replace the process. - **Humans own merge, publish, release, and deployment.** Nothing in Open Scaffold self-approves. -- **Historical `v1.0.x` packages exist** as immutable publication history; the forward line is `v0.33.x` and the next 1.0 will be cut when the contract has earned it. +- **Historical `v1.0.x` packages exist** as immutable publication history; the forward line is `v0.34.x` and the next 1.0 will be cut when the contract has earned it. ## Release status -- Current cadence: pre-1.0 hardening on the `v0.33.x` line. +- Current cadence: pre-1.0 hardening on the `v0.34.x` line. - Historical note: `v1.0.x` exists as a previously published launch line (most recent tag: `v1.0.5`) and remains immutable package/release history. - Current repository package version: check `package.json`. - Live npm package truth: check `npm view open-scaffold version dist-tags --json`. @@ -112,7 +112,7 @@ Future work can explore those areas only through explicit plans, evidence, safet ## Versioning policy -Open Scaffold uses npm package versions as public distribution coordinates. The current `v0.33.x` line is intentionally pre-1.0: it communicates that the core work-record pattern is usable and the framework cleanup has narrowed/reduced the package surface, but the product is still earning its long-term stable contract. +Open Scaffold uses npm package versions as public distribution coordinates. The current `v0.34.x` line is intentionally pre-1.0: it communicates that the core work-record pattern is usable and the framework cleanup has narrowed/reduced the package surface, but the product is still earning its long-term stable contract. The previously published `v1.0.x` packages remain immutable historical artifacts. They should be treated as an over-eager launch line, not as a reason to force every future change through mature-1.0 pressure. A future real 1.0 should be cut only after the adoption path, public package surfaces, runtime boundaries, and evidence/tracing primitives feel durable enough to sustain that promise.