Publish immutable API contract artifacts from releases #300

Merged

erik merged 2 commits from feat/task-c934d36b-contract-publication into main

2026-10-13 15:03:17 -05:00

erik commented

2026-10-13 14:55:53 -05:00

Owner

Prior versions remain intact. Changed specification bytes under an existing version are rejected; identical retries and later packages carrying the same contract preserve the original manifest/provenance. The public website reads this branch without management credentials. This is coordinated with the Slugkit.com exact-version API/documentation change. Older packages without versioned artifacts are unsupported, as clarified by the human; tests use subsequent-release fixtures, never fake published versions.

Validation: complete ./scripts/pre-pr.sh passed, including build, formatting, lint, types and 1,236 tests across workspaces. New deterministic archive coverage verifies retention, first-publication provenance, identical retry, changed-byte rejection and identity/digest validation. Integration and visual tests remain local-only. The initial real Actions publication will be verified after human-approved merge; no manual publication workaround is used.

Task: task-c934d36b. Publication and rollout policy: docs/api-contract-archive.md.

API releases currently have an authoritative packaged specification but no durable public version archive. Download the published package from npm, verify tarball integrity and its exact contract artifact/digest, and commit reference files to the independent `api-contract-archive` branch after normal API release publication. Add a dedicated workflow for the initial package 0.2.0 publication and safe retries without another npm release. Prior versions remain intact. Changed specification bytes under an existing version are rejected; identical retries and later packages carrying the same contract preserve the original manifest/provenance. The public website reads this branch without management credentials. This is coordinated with the Slugkit.com exact-version API/documentation change. Older packages without versioned artifacts are unsupported, as clarified by the human; tests use subsequent-release fixtures, never fake published versions. Validation: complete `./scripts/pre-pr.sh` passed, including build, formatting, lint, types and 1,236 tests across workspaces. New deterministic archive coverage verifies retention, first-publication provenance, identical retry, changed-byte rejection and identity/digest validation. Integration and visual tests remain local-only. The initial real Actions publication will be verified after human-approved merge; no manual publication workaround is used. Task: task-c934d36b. Publication and rollout policy: `docs/api-contract-archive.md`.

erik added 1 commit

2026-10-13 14:55:53 -05:00

feat: publish immutable API contract reference artifacts

CI / build-lint-test (pull_request) Successful in 1m0s

Details

7153072334

Task: #task-c934d36b

erik commented

2026-10-13 14:59:18 -05:00

Author

Owner

Independent review

Task: task-c934d36b. Coordinated PRs remain open.
Website PR Serve official contracts at exact-version API addresses, head ffc3b0372c443c8619fd68fb0afd7f3c678f7700: approved, no actionable findings or warnings.
Publication PR Publish immutable API contract artifacts from releases, head 715307233414dd64c4ea1ed2b4d4a437853dd9db: changes requested. Explicitly wire the existing short-lived Actions token into both the dedicated archive publication step and the normal API release archive step, consistent with existing repository release workflows.
Acceptance criteria: genuine public artifact/digest partial pending publication/deployment; exact-version documentation link partial pending deployment; two-version retention met in deterministic fixtures with production evidence pending; immutable rejection/retry met in deterministic tests with workflow correction required; documented discovery/failure policy met; public credential isolation and relocated management operations locally verified with deployment pending; local CLI update partial and intentionally deferred until deployment.
Local checks and current-head CI passed for both reviewed commits. Independent reviewer did not rerun broad checks. No merge, archive publication, production deployment or local global CLI configuration change has occurred.
Blocking findings: one in publication; none in website. Warnings: none. Next: fix credential wiring, rerun required verification/current-head CI, and obtain updated independent publication review before the human merge gate.

### Independent review - Task: task-c934d36b. Coordinated PRs remain open. - Website PR [Serve official contracts at exact-version API addresses](https://forge.caradoc.com/erik/slugkit.com/pulls/54), head `ffc3b0372c443c8619fd68fb0afd7f3c678f7700`: approved, no actionable findings or warnings. - Publication PR [Publish immutable API contract artifacts from releases](https://forge.caradoc.com/erik/slugkit/pulls/300), head `715307233414dd64c4ea1ed2b4d4a437853dd9db`: changes requested. Explicitly wire the existing short-lived Actions token into both the dedicated archive publication step and the normal API release archive step, consistent with existing repository release workflows. - Acceptance criteria: genuine public artifact/digest partial pending publication/deployment; exact-version documentation link partial pending deployment; two-version retention met in deterministic fixtures with production evidence pending; immutable rejection/retry met in deterministic tests with workflow correction required; documented discovery/failure policy met; public credential isolation and relocated management operations locally verified with deployment pending; local CLI update partial and intentionally deferred until deployment. - Local checks and current-head CI passed for both reviewed commits. Independent reviewer did not rerun broad checks. No merge, archive publication, production deployment or local global CLI configuration change has occurred. - Blocking findings: one in publication; none in website. Warnings: none. Next: fix credential wiring, rerun required verification/current-head CI, and obtain updated independent publication review before the human merge gate.

erik referenced this pull request from erik/slugkit.com

2026-10-13 14:59:18 -05:00

Serve official contracts at exact-version API addresses #54

erik added 1 commit

2026-10-13 15:00:22 -05:00

fix: explicitly supply the archive publication token

CI / build-lint-test (pull_request) Successful in 55s

Details

ff2bb09d83

Task: #task-c934d36b

erik commented

2026-10-13 15:02:25 -05:00

Author

Owner

Coordinated independent review approved

API publication PR Publish immutable API contract artifacts from releases, exact head ff2bb09d83c11508448521793a8ba05236f50613: approved. The sole prior finding is resolved by explicitly supplying the existing short-lived Actions token to both publication steps. Current-head CI run 518 passed, and full local pre-PR verification passed again (1,236 tests).
Website PR Serve official contracts at exact-version API addresses, exact head ffc3b0372c443c8619fd68fb0afd7f3c678f7700: approved. Current-head CI run 47 and complete local verification (356 tests) passed. The independent reviewer confirmed the unchanged approved head.
Blocking issues: none. Warnings: none. Both PRs are open. Required review comments are posted on both PRs and this task. Review is approved; merge approval is waiting for the human.
Acceptance criterion 1 partial: the genuinely released package artifact was validated, and exact public artifact serving is locally verified; initial archive publication/deployment remain pending.
Acceptance criterion 2 partial: exact-version documentation link and rendering are verified locally; deployment remains pending.
Acceptance criterion 3 met in deterministic tests: an earlier document remains independently accessible after subsequent publication and website recreation; fixtures are explicitly distinguished from genuine releases. Initial production will contain only contract 1.1.0 until another genuine release exists.
Acceptance criterion 4 met in deterministic tests: changed specifications are rejected, identical retries succeed, and subsequent packages sharing the contract preserve first-publication provenance. Normal Actions execution remains pending integration.
Acceptance criterion 5 met: public discovery, unsupported/unknown versions, unavailable storage and publication failures are explicitly documented.
Acceptance criterion 6 partial: caller credentials are not forwarded, existing operations pass at the new base and /api/v1 is unavailable locally; live preservation verification remains pending deployment.
Acceptance criterion 7 partial: the local global CLI configuration remains intentionally untouched until the new production route is deployed; only its Slugkit.com base address will change, with credentials and all other sites preserved.
Next after explicit human merge approval: merge both changes; run the normal archive publication workflow for API package 0.2.0; release and deploy the website through normal Actions and GitOps; update the authorized local CLI entry; verify all deployed criteria, restore image automation as appropriate, and run the close gate only with human authorization. No manual publication workaround, historical artifact fabrication or credential rotation is planned.

### Coordinated independent review approved - API publication PR [Publish immutable API contract artifacts from releases](https://forge.caradoc.com/erik/slugkit/pulls/300), exact head `ff2bb09d83c11508448521793a8ba05236f50613`: approved. The sole prior finding is resolved by explicitly supplying the existing short-lived Actions token to both publication steps. Current-head CI run 518 passed, and full local pre-PR verification passed again (1,236 tests). - Website PR [Serve official contracts at exact-version API addresses](https://forge.caradoc.com/erik/slugkit.com/pulls/54), exact head `ffc3b0372c443c8619fd68fb0afd7f3c678f7700`: approved. Current-head CI run 47 and complete local verification (356 tests) passed. The independent reviewer confirmed the unchanged approved head. - Blocking issues: none. Warnings: none. Both PRs are open. Required review comments are posted on both PRs and this task. Review is approved; merge approval is waiting for the human. - Acceptance criterion 1 partial: the genuinely released package artifact was validated, and exact public artifact serving is locally verified; initial archive publication/deployment remain pending. - Acceptance criterion 2 partial: exact-version documentation link and rendering are verified locally; deployment remains pending. - Acceptance criterion 3 met in deterministic tests: an earlier document remains independently accessible after subsequent publication and website recreation; fixtures are explicitly distinguished from genuine releases. Initial production will contain only contract 1.1.0 until another genuine release exists. - Acceptance criterion 4 met in deterministic tests: changed specifications are rejected, identical retries succeed, and subsequent packages sharing the contract preserve first-publication provenance. Normal Actions execution remains pending integration. - Acceptance criterion 5 met: public discovery, unsupported/unknown versions, unavailable storage and publication failures are explicitly documented. - Acceptance criterion 6 partial: caller credentials are not forwarded, existing operations pass at the new base and `/api/v1` is unavailable locally; live preservation verification remains pending deployment. - Acceptance criterion 7 partial: the local global CLI configuration remains intentionally untouched until the new production route is deployed; only its Slugkit.com base address will change, with credentials and all other sites preserved. - Next after explicit human merge approval: merge both changes; run the normal archive publication workflow for API package 0.2.0; release and deploy the website through normal Actions and GitOps; update the authorized local CLI entry; verify all deployed criteria, restore image automation as appropriate, and run the close gate only with human authorization. No manual publication workaround, historical artifact fabrication or credential rotation is planned.

erik referenced this pull request from erik/slugkit.com

2026-10-13 15:02:25 -05:00

Serve official contracts at exact-version API addresses #54

erik merged commit 7691a1e9a0 into main

2026-10-13 15:03:17 -05:00

erik deleted branch feat/task-c934d36b-contract-publication

2026-10-13 15:03:17 -05:00

erik referenced this pull request from a commit

2026-10-13 15:03:19 -05:00

Merge pull request 'Publish immutable API contract artifacts from releases' (#300) from feat/task-c934d36b-contract-publication into main