chore: release v2.0.0-alpha.14 - #137
Merged
Merged
Conversation
The generated section carried only the fence-marker entry. Adds the artifact-names commit gate under Added, with the upgrade consequence stated plainly, plus Changed entries for the capability runner interface, the permanent-language guidance sweep, and the ship skill's stacked-pull-request handling. No entry for the artifact-names identity fixes: they correct a defect in the same unreleased batch, so no upgrading user ever saw the bug.
Version files and changelog move to 2.0.0-alpha.14, every target is rebuilt from the bumped sources, and the three capability receipts are re-recorded because the version stamps into the binary and the strict validators fail closed on stale digests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release of five landed pull requests: #134, #110, #111, #135, #136.
Contents
Added —
loaf check --hook artifact-names, a fail-closed commit gate rejecting artifact filenames that name the work unit which produced them. This activates on upgrade: a commit touching an artifact whose name carries a work identity will fail until the file is renamed.--advisorylists findings without blocking.Changed — fingerprint-only managed
AGENTS.mdfence markers; capability smoke runners now requiring explicit--client,--expected-version, and--receipt; the permanent-language guidance sweep across living documentation and distributed skills; and theshipskill's stacked-pull-request handling.No changelog entry for #136: it corrects a defect in #111, unreleased in this same batch, so no upgrading user ever saw the bug.
Validation beyond the usual gates
The guard was run read-only against 22 installed consumer projects before release. That surfaced 59 findings, of which 57 were the guard's own defects — a missing task-identity pairing and grandfathering that could not see a nested terminal status — both fixed in #136. The same 22 projects now report two findings, both genuine. The concern that motivated the scan, that matching artifact directories by basename would police unrelated directories in consumer repositories, did not occur in a single project.
Release mechanics
Prepared with
--pre-mergeduring thechange-model-hard-cutlineage freeze, which permits an explicit prerelease bump. A stale.git/index.lockinterrupted staging after the version files, changelog, and build had already been written. Nothing was tagged or pushed, and the prepared artifacts were committed directly rather than re-running the bump, which would have advanced to alpha.15.Receipts were re-recorded after the bump because the version stamps into the binary and the strict validators fail closed on stale digests — the documented post-bump step.
Verification
npm run test— all four packagesLOAF_VALIDATE_TYPESCRIPT=1 npm run build— every target rebuilt, artifacts synchronizedloaf check --hookforcheck-secrets,render-drift,ephemeral-provenance,artifact-namesTag and GitHub Release follow with
--post-mergeonce this lands.