diff --git a/docs/README.md b/docs/README.md index c320cc0..a80b440 100644 --- a/docs/README.md +++ b/docs/README.md @@ -23,6 +23,7 @@ - [Comic Manifest CLI and offline reference flow](comic-manifest-cli.md) covers bounded local inputs, safe validate/inspect/diff/verify reports, separately consented outputs, and the synthetic #96 handoff. - [Comic Manifest conformance and security reference suite](comic-manifest-conformance.md) maps positive/negative coverage, offline adapter tests, and owner-reviewed proposed goldens. - [Comic Manifest v1 API and release guide](comic-manifest-release.md) consolidates the package/CLI surface, host adapter boundary, review workflow, compatibility, limitations, release order, and Epic #101 handoff. +- [Platform Comic Manifest v1.0.0 publication verification](comic-manifest-platform-release-v1.0.0.md) records the immutable release, exact tag target, approved asset tuples, and GitHub upload/download MIME metadata. This directory contains architecture decisions, public interfaces, operational guides, and deployment documentation for the production platform. diff --git a/docs/comic-manifest-platform-release-v1.0.0.md b/docs/comic-manifest-platform-release-v1.0.0.md new file mode 100644 index 0000000..f9df3aa --- /dev/null +++ b/docs/comic-manifest-platform-release-v1.0.0.md @@ -0,0 +1,35 @@ +# Platform Comic Manifest v1.0.0 publication verification + +**Status: published and verified.** The immutable public release is [Comic Manifest Platform v1.0.0](https://github.com/DefinitelySecureStudio/platform/releases/tag/comic-manifest/v1.0.0). + +| Field | Verified value | +| --- | --- | +| Repository | `DefinitelySecureStudio/platform` (public) | +| Tag | [`comic-manifest/v1.0.0`](https://github.com/DefinitelySecureStudio/platform/releases/tag/comic-manifest/v1.0.0) | +| Source commit | [`f0672d90a47473da6a27614cad07abc175546d67`](https://github.com/DefinitelySecureStudio/platform/commit/f0672d90a47473da6a27614cad07abc175546d67) | +| Source tree | `b876a434e5f557d88d254cd1e75a8121f23c4ba3` | +| Published | `2026-10-10T13:46:16Z` | +| Public download verification | `2026-10-10T13:46:51.832250+00:00` | +| Draft / prerelease / immutable | `false` / `false` / `true` | +| Repository immutable-release setting | Enabled; owner enforcement is off. No setting was changed. | + +GitHub reported the exact release title, tag, target commit, published state, and `immutable: true`. The tag ref resolves to the approved source commit. The owner approved the exact source identity and eight asset tuples before publication; the detached packet verifier matched the record and bytes. That verifier does not authenticate the identity of the person who wrote the approval record. + +Every public asset below was downloaded over unauthenticated HTTPS. Each request returned HTTP 200; downloaded size and SHA-256 match the approved packet. The declared media type is from the artifact manifest. GitHub upload metadata and public download response types are shown separately. + +| Asset | Bytes | SHA-256 | Declared media type | GitHub upload type | Public download type | +| --- | ---: | --- | --- | --- | --- | +| [comic-manifest-v1.0.0.source.tar.gz](https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.source.tar.gz) | 491339 | `b383cee702b4ceba0c4090bceee0c2f6c451bce18c148162543b4e1316226501` | `application/gzip` | `application/x-gtar` | `application/octet-stream` | +| [comic-manifest-v1.0.0.package.tgz](https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.package.tgz) | 225334 | `98f9ad51546620a2197672b2bfd21e6bc31f72b274dc56bb3c50590edfe493ec` | `application/gzip` | `application/x-gtar` | `application/octet-stream` | +| [comic-manifest-v1.0.0.package-lock.json](https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.package-lock.json) | 3149 | `ef90ff0593d91ed26980629ce896ac08294281ed2521db01d7e19ad89b5d87bd` | `application/json` | `application/json` | `application/octet-stream` | +| [comic-manifest-v1.0.0.sdk-contract-lock.json](https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.sdk-contract-lock.json) | 7588 | `6b4b515cc606f2c50b1baead50faaddd3d87d3a1d7b2c9b14e4170e36776dfab` | `application/json` | `application/json` | `application/octet-stream` | +| [comic-manifest-v1.0.0.context-builder-contract-lock.json](https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.context-builder-contract-lock.json) | 1366 | `297dfa1e7e1e89b63eba0df5d3e012d6243f449bdcddc9e9e34714e786f7e595` | `application/json` | `application/json` | `application/octet-stream` | +| [comic-manifest-v1.0.0.contract-lock.json](https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.contract-lock.json) | 2678 | `d74950fc19669f1187aca54669b80f32c332685ef4f3a4a8361c4a9dd1a12e7a` | `application/json` | `application/json` | `application/octet-stream` | +| [comic-manifest-v1.0.0.api-v1.json](https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.api-v1.json) | 1317 | `5f3d3e069a99f3533fb17d795d636cd9960c67ebd0be925d063652d3cfb71238` | `application/json` | `application/json` | `application/octet-stream` | +| [comic-manifest-v1.0.0.manifest.json](https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.manifest.json) | 6159 | `7e01965f6b7f2ba341073d3854185f46a95a3ed13af3862fb26f656839e4f1d6` | `application/json` | `application/json` | `application/octet-stream` | + +GitHub recorded `application/x-gtar` for the two gzip archives at upload and `application/octet-stream` for every public download. JSON assets were uploaded as `application/json`; their public downloads also returned `application/octet-stream`. These transport types do not change the manifest-declared type or release bytes. + +The additive Platform package remains version `1.2.0` and private; it was not published to npm. SDK and Context Builder lock files are historical compatibility snapshots, not republications of earlier releases. This follow-up documentation and proof record do not change the immutable release assets or source commit. + +The machine-readable proof is [`release/comic-manifest-v1.0.0-publication-proof.json`](../release/comic-manifest-v1.0.0-publication-proof.json). Epic #101 receives this verified release identity alongside the API/CLI and adapter limits, synthetic conformance evidence, provenance, and production-trust and approval boundaries described in the [release guide](comic-manifest-release.md). diff --git a/docs/comic-manifest-release.md b/docs/comic-manifest-release.md index ca7e83d..dc335e8 100644 --- a/docs/comic-manifest-release.md +++ b/docs/comic-manifest-release.md @@ -1,10 +1,10 @@ # Comic Manifest v1 API and release guide -Status: Codex Comic Manifest 1.0.0 is published immutably and its exact release -has been independently downloaded and verified. The Platform implementation is -still an unreleased Studio #99 candidate. Its proposed component tag is -`comic-manifest/v1.0.0`; the additive Platform npm package version is `1.2.0` and -the package remains private. The Platform tag and package have not been published. +Status: Codex Comic Manifest 1.0.0 and Platform Comic Manifest 1.0.0 are +published immutably, and their exact public release assets have been independently +downloaded and verified. The Platform component tag is `comic-manifest/v1.0.0`; +the additive Platform package version is `1.2.0` and remains private. The package +was not published to npm. Codex owns normative meanings and the exact contract at `contract/comic-manifest/v1.0.0`. Platform owns the implementation, CLI, @@ -16,8 +16,10 @@ Context Builder assets. See the [Codex contract guide](comic-manifest-contracts. [approvals](comic-manifest-approvals.md), [build results](comic-manifest-build-results.md), [CLI](comic-manifest-cli.md), -[conformance](comic-manifest-conformance.md), and -[renditions](comic-manifest-renditions.md) for detailed behavior. +[conformance](comic-manifest-conformance.md), +[renditions](comic-manifest-renditions.md), and +[Platform v1.0.0 publication verification](comic-manifest-platform-release-v1.0.0.md) +for detailed behavior and exact release evidence. ## Library API @@ -81,7 +83,7 @@ schema/test result establishes only its bounded machine predicate. Qualified human reviewers remain responsible for creative/editorial meaning, canon, rights, accessibility experience, disclosure, and publication authority. Changes to golden/catalog/oracle/source expectations require the owner review -paths already recorded by Issue 98; this release candidate does not edit those +paths already recorded by Issue 98; the released Platform source did not edit those bytes. The owner accepted the proposed Issue 98 golden packet at source head @@ -93,8 +95,8 @@ it did not approve Platform publication and is not represented as a human techni review of the released artifacts. The task-specific Epic #6 A3 AI-review exception covered code-merge review only and did not authorize the A4 release decision. No separate human review of final -release artifacts is claimed. Platform publication still requires its own owner -decision on exact built artifact tuples. +release artifacts is claimed. The owner separately approved Platform publication for the exact built artifact +tuples now listed in the publication verification record. ## Compatibility, deprecation, and support @@ -137,82 +139,62 @@ establish Canon, permission, public disclosure, or release approval. ## Release order and Epic #101 handoff -The Codex publication and fresh immutable-download verification are complete. -This Platform adoption PR pins those exact published tuples and regenerates the -validator from the fresh download. The Platform package remains private and the -API inventory still records `candidate-unpublished`. After independent review, -merge and exact-head CI, build and inspect the Platform source/package artifacts, -then obtain a separate owner approval naming their exact tuples. Only that later -approval can authorize a Platform release and fresh verification. The readiness -check in this repository covers Codex adoption only; it is not final Platform -release readiness. After this PR is independently reviewed and merged, build the -Platform release artifact set once from the exact merge commit into a new -directory outside the checkout: -```sh -node scripts/build-comic-manifest-release.mjs /path/to/platform-release-candidate \ - --source-commit "$MERGED_COMMIT" --source-tree "$MERGED_TREE" -``` - -The builder records `build_provenance` fields as facts about that build: the -artifact set was built as an approval candidate while owner approval was absent -and Platform publication had not happened. These fields are not live publication -or approval state and are never changed after owner approval. The seven files in -the manifest plus the manifest itself form the eight-file immutable release set. - -Generate the detached approval packet from that set: +The v1 release sequence is complete. Codex Comic Manifest 1.0.0 was published +and its exact immutable assets were independently downloaded before Platform +adopted those published tuples. Platform source commit +`f0672d90a47473da6a27614cad07abc175546d67` (tree `b876a434e5f557d88d254cd1e75a8121f23c4ba3`) produced the approved candidate set. +The owner approved those exact eight tuples before publication. GitHub published +`comic-manifest/v1.0.0` immutably; its tag resolves to the source commit, and all eight +public downloads match the approved sizes and SHA-256 values. See the [Platform +v1.0.0 publication verification](comic-manifest-platform-release-v1.0.0.md) +for the release URL, exact hashes, and declared/upload/download media types. + +The additive Platform package remains private; no npm publication occurred. +The candidate manifest's `build_provenance` records build-time facts: at build +time, owner approval was absent and Platform publication had not happened. It +was not rewritten after approval or publication. The detached approval verifier +matched the owner record to the exact source and eight files; it does not +authenticate the identity of the person who supplied that record. The +repository readiness check covers Codex adoption only, not Platform release +readiness. + +For a future Platform component release, build once from its exact reviewed +merge commit into a clean directory outside the checkout: ```sh -node scripts/create-comic-manifest-approval-packet.mjs /path/to/platform-release-candidate \ - > /path/to/platform-owner-approval.json +node scripts/build-comic-manifest-release.mjs /path/to/platform-release-candidate --source-commit "$MERGED_COMMIT" --source-tree "$MERGED_TREE" ``` -The packet starts with `status: "awaiting-owner-decision"` and -`owner_approval: null`; it grants no approval. After the owner explicitly reviews -the exact source identity and all eight filename/size/SHA-256 tuples, record the -owner's decision in that separate packet by setting `status` to `approved` and -filling `owner_approval` with `decision: "approve"`, `owner: "@andrewperis"`, -an RFC 3339 `approved_at`, and a non-empty `decision_reference`, then run: +Generate a detached approval packet from those bytes: ```sh -node scripts/verify-comic-manifest-approval.mjs /path/to/platform-release-candidate \ - /path/to/platform-owner-approval.json +node scripts/create-comic-manifest-approval-packet.mjs /path/to/platform-release-candidate > /path/to/platform-owner-approval.json ``` -This verifier is read-only. It requires the explicit `@andrewperis` approval -record, exact source commit/tree/tag, exactly eight regular files, and all eight -matching filename/size/digest tuples. Missing, changed, extra, or symlinked files -and mismatched approval fields fail closed. `approval_record_matches: true` -means the declared record matches those bytes; `owner_identity_authenticated: -false` and `external_owner_authentication_required: true` mean the verifier does -not authenticate who wrote it or create an approval. Before publication, confirm -the same owner decision through the external authenticated review path and retain -its reference in `decision_reference`. - -After approval, publish those same eight files unchanged; do not rebuild after -approval. To verify a later fresh download, first download the full asset set to a -new empty directory, then run: +After the owner reviews the exact source identity and all eight filename/size/ +SHA-256 tuples, record the decision in the separate packet and run the read-only +verifier: ```sh -node scripts/verify-comic-manifest-downloads.mjs \ - /path/to/platform-release-candidate/comic-manifest-v1.0.0.manifest.json \ - /path/to/fresh-downloads +node scripts/verify-comic-manifest-approval.mjs /path/to/platform-release-candidate /path/to/platform-owner-approval.json ``` -This compares the fresh bytes to the separately retained approved build set and -rejects missing or extra files. GitHub asset metadata records `application/json` -for the Codex uploads and public downloads returned `application/octet-stream`; -both are recorded separately from each contract-declared media type. - -The local builder accepts an external commit identity only when its supplied -40-character tree hash exactly matches the clean local source tree; both values -are recorded in the artifact manifest. The adoption PR does not create a Platform -tag, release, upload or npm publication. A pre-merge PR build is review evidence -only; the owner approval packet must be generated from a fresh post-merge build. - -Epic #101 receives the verified Codex and Platform artifact tuples, API/CLI and -adapter limits, synthetic conformance evidence, source/package manifests, and -known production-trust/approval gates. It owns orchestration design; this -package adds no scheduling, retries, resumable jobs, provider routing, -generation, rendering, or distribution automation. Epic #6 and Issue #99 close -only after actual publication and fresh-download verification. +The verifier requires the exact owner, source commit/tree/tag, eight regular +files, and all matching digest tuples. `approval_record_matches: true` means +the supplied record matches the bytes; it does not authenticate the person who +wrote the record or create approval. Confirm owner approval through the +authenticated review path before publication. After approval, publish those +same eight files unchanged. Verify the tag target and release state, then +download every public asset fresh and compare its size and SHA-256 with the +approved tuples. Record GitHub upload and public-download MIME separately from +the declared media types. + +The Epic #101 handoff includes the verified Codex and Platform release tuples, +API/CLI and adapter responsibilities and limits, synthetic conformance +coverage, source/package manifests, and the production-trust and approval +gates. Epic #101 owns orchestration design; this package adds no scheduling, +retries, resumable jobs, provider routing, generation, rendering, or +distribution automation. Issue #99 and Epic #6 closeout remain separate owner +actions after independent verification; this documentation change does not +close either. diff --git a/release/comic-manifest-v1.0.0-publication-proof.json b/release/comic-manifest-v1.0.0-publication-proof.json new file mode 100644 index 0000000..a358983 --- /dev/null +++ b/release/comic-manifest-v1.0.0-publication-proof.json @@ -0,0 +1,103 @@ +{ + "format": "DefinitelySecureStudio.PlatformComicManifestPublicationProof/v1", + "repository": "DefinitelySecureStudio/platform", + "release_id": 408977943, + "release_url": "https://github.com/DefinitelySecureStudio/platform/releases/tag/comic-manifest/v1.0.0", + "title": "Comic Manifest Platform v1.0.0", + "tag": "comic-manifest/v1.0.0", + "source_commit": "f0672d90a47473da6a27614cad07abc175546d67", + "source_tree": "b876a434e5f557d88d254cd1e75a8121f23c4ba3", + "tag_resolved_commit": "f0672d90a47473da6a27614cad07abc175546d67", + "draft": false, + "prerelease": false, + "immutable": true, + "published_at": "2026-10-10T13:46:16Z", + "verified_at": "2026-10-10T13:46:51.832250+00:00", + "immutable_release_setting": { + "enabled": true, + "enforced_by_owner": false + }, + "verification_method": "GitHub release/ref API metadata plus unauthenticated HTTPS downloads of all eight public assets", + "artifacts": [ + { + "filename": "comic-manifest-v1.0.0.source.tar.gz", + "byte_size": 491339, + "sha256": "sha256:b383cee702b4ceba0c4090bceee0c2f6c451bce18c148162543b4e1316226501", + "declared_media_type": "application/gzip", + "github_upload_content_type": "application/x-gtar", + "public_download_content_type": "application/octet-stream", + "download_http_status": 200, + "download_url": "https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.source.tar.gz" + }, + { + "filename": "comic-manifest-v1.0.0.package.tgz", + "byte_size": 225334, + "sha256": "sha256:98f9ad51546620a2197672b2bfd21e6bc31f72b274dc56bb3c50590edfe493ec", + "declared_media_type": "application/gzip", + "github_upload_content_type": "application/x-gtar", + "public_download_content_type": "application/octet-stream", + "download_http_status": 200, + "download_url": "https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.package.tgz" + }, + { + "filename": "comic-manifest-v1.0.0.package-lock.json", + "byte_size": 3149, + "sha256": "sha256:ef90ff0593d91ed26980629ce896ac08294281ed2521db01d7e19ad89b5d87bd", + "declared_media_type": "application/json", + "github_upload_content_type": "application/json", + "public_download_content_type": "application/octet-stream", + "download_http_status": 200, + "download_url": "https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.package-lock.json" + }, + { + "filename": "comic-manifest-v1.0.0.sdk-contract-lock.json", + "byte_size": 7588, + "sha256": "sha256:6b4b515cc606f2c50b1baead50faaddd3d87d3a1d7b2c9b14e4170e36776dfab", + "declared_media_type": "application/json", + "github_upload_content_type": "application/json", + "public_download_content_type": "application/octet-stream", + "download_http_status": 200, + "download_url": "https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.sdk-contract-lock.json" + }, + { + "filename": "comic-manifest-v1.0.0.context-builder-contract-lock.json", + "byte_size": 1366, + "sha256": "sha256:297dfa1e7e1e89b63eba0df5d3e012d6243f449bdcddc9e9e34714e786f7e595", + "declared_media_type": "application/json", + "github_upload_content_type": "application/json", + "public_download_content_type": "application/octet-stream", + "download_http_status": 200, + "download_url": "https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.context-builder-contract-lock.json" + }, + { + "filename": "comic-manifest-v1.0.0.contract-lock.json", + "byte_size": 2678, + "sha256": "sha256:d74950fc19669f1187aca54669b80f32c332685ef4f3a4a8361c4a9dd1a12e7a", + "declared_media_type": "application/json", + "github_upload_content_type": "application/json", + "public_download_content_type": "application/octet-stream", + "download_http_status": 200, + "download_url": "https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.contract-lock.json" + }, + { + "filename": "comic-manifest-v1.0.0.api-v1.json", + "byte_size": 1317, + "sha256": "sha256:5f3d3e069a99f3533fb17d795d636cd9960c67ebd0be925d063652d3cfb71238", + "declared_media_type": "application/json", + "github_upload_content_type": "application/json", + "public_download_content_type": "application/octet-stream", + "download_http_status": 200, + "download_url": "https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.api-v1.json" + }, + { + "filename": "comic-manifest-v1.0.0.manifest.json", + "byte_size": 6159, + "sha256": "sha256:7e01965f6b7f2ba341073d3854185f46a95a3ed13af3862fb26f656839e4f1d6", + "declared_media_type": "application/json", + "github_upload_content_type": "application/json", + "public_download_content_type": "application/octet-stream", + "download_http_status": 200, + "download_url": "https://github.com/DefinitelySecureStudio/platform/releases/download/comic-manifest/v1.0.0/comic-manifest-v1.0.0.manifest.json" + } + ] +}