diff --git a/docs/comic-manifest-release.md b/docs/comic-manifest-release.md index a4c0105..bd32376 100644 --- a/docs/comic-manifest-release.md +++ b/docs/comic-manifest-release.md @@ -162,37 +162,47 @@ authenticate the identity of the person who supplied that record. The repository readiness check covers Codex adoption only, not Platform release readiness. -For a future Platform component release, build once from its exact reviewed -merge commit into a clean directory outside the checkout: +### Reconstruct and verify the released v1 candidate -```sh -node scripts/build-comic-manifest-release.mjs /path/to/platform-release-candidate --source-commit "$MERGED_COMMIT" --source-tree "$MERGED_TREE" -``` +The builder fixes the component version at `1.0.0`, the tag at +`comic-manifest/v1.0.0`, and the artifact filename prefix at +`comic-manifest-v1.0.0`. The approval verifier accepts only that v1 release +tuple and package version `1.2.0`. Use these tools only to reconstruct and +verify the approval-candidate bytes for the already-published v1 release. -Generate a detached approval packet from those bytes: +Start from a clean checkout of released source commit +`f0672d90a47473da6a27614cad07abc175546d67` (tree +`b876a434e5f557d88d254cd1e75a8121f23c4ba3`) and build outside the checkout: ```sh -node scripts/create-comic-manifest-approval-packet.mjs /path/to/platform-release-candidate > /path/to/platform-owner-approval.json +node scripts/build-comic-manifest-release.mjs /absolute/v1.0.0-reconstruction \ + --source-commit f0672d90a47473da6a27614cad07abc175546d67 \ + --source-tree b876a434e5f557d88d254cd1e75a8121f23c4ba3 +node scripts/create-comic-manifest-approval-packet.mjs /absolute/v1.0.0-reconstruction \ + > /absolute/v1.0.0-reconstructed-packet.json ``` -After the owner reviews the exact source identity and all eight filename/size/ -SHA-256 tuples, record the decision in the separate packet and run the read-only -verifier: +Packet creation emits no owner decision. To check the reconstructed files against +the separately retained owner-approved v1 packet, run the read-only verifier: ```sh -node scripts/verify-comic-manifest-approval.mjs /path/to/platform-release-candidate /path/to/platform-owner-approval.json +node scripts/verify-comic-manifest-approval.mjs /absolute/v1.0.0-reconstruction \ + /path/to/owner-approved-v1.0.0-packet.json ``` The verifier requires the exact owner, source commit/tree/tag, eight regular -files, and all matching digest tuples. `approval_record_matches: true` means -the supplied record matches the bytes; it does not authenticate the person who -wrote the record or create approval. Confirm owner approval through the -authenticated review path before publication. After approval, publish those -same eight files unchanged. Verify the tag target and release state, then -download every public asset fresh and compare its size and SHA-256 with the -approved tuples. Record GitHub upload and public-download MIME separately from -the declared media types. - +files, and matching digest tuples. `approval_record_matches: true` only means +the record matches the bytes; it does not authenticate the person who supplied +it or create approval. + +These commands reconstruct and check v1 bytes only. They do not create or move +tags, create releases, upload files, replace release assets, or publish. Never +move the existing `comic-manifest/v1.0.0` tag or publish replacement assets. + +A future component or package version requires a separately reviewed, +version-aware builder, packet generator, and verifier, with tests that bind the +requested component version, tag, package version, and artifact filenames. +Do not reuse these v1-only tools to prepare a future release. The Epic #101 handoff includes the verified Codex and Platform release tuples, API/CLI and adapter responsibilities and limits, synthetic conformance coverage, source/package manifests, and the production-trust and approval diff --git a/release/README.md b/release/README.md index f8af337..340ac7f 100644 --- a/release/README.md +++ b/release/README.md @@ -27,30 +27,49 @@ above for current release state. The dated [verification record](comic-manifest-verification.md) remains a historical pre-publication snapshot. -### Candidate build and approval procedure +### Reconstruct and verify the released v1 candidate -For v1, the builder produced an approval-candidate set from the exact merged -commit/tree. It never creates tags, releases or uploads, and its provenance fields -describe the state when those files were built. To prepare a future version, build -into a new external directory from its exact reviewed merge commit and tree: +The builder and approval verifier are fixed to Platform Comic Manifest v1.0.0: +they hard-code component version `1.0.0`, tag `comic-manifest/v1.0.0`, and +filename prefix `comic-manifest-v1.0.0`. The exact v1 source tree uses package +version `1.2.0`. Use these commands only to reconstruct and verify the +approval-candidate set for the already-published v1 release. They do not prepare +a future version. + +Start from a clean checkout of released source commit +`f0672d90a47473da6a27614cad07abc175546d67` (tree +`b876a434e5f557d88d254cd1e75a8121f23c4ba3`) and write artifacts outside the +checkout: + +```sh +node scripts/build-comic-manifest-release.mjs /absolute/v1.0.0-reconstruction \ + --source-commit f0672d90a47473da6a27614cad07abc175546d67 \ + --source-tree b876a434e5f557d88d254cd1e75a8121f23c4ba3 +node scripts/create-comic-manifest-approval-packet.mjs /absolute/v1.0.0-reconstruction \ + > /absolute/v1.0.0-reconstructed-packet.json +``` + +Packet creation emits no owner decision. To check the reconstructed files against +the separately retained owner-approved v1 packet, run the read-only verifier: ```sh -node scripts/build-comic-manifest-release.mjs /absolute/new/output \ - --source-commit "$MERGED_COMMIT" --source-tree "$MERGED_TREE" +node scripts/verify-comic-manifest-approval.mjs /absolute/v1.0.0-reconstruction \ + /path/to/owner-approved-v1.0.0-packet.json ``` -`node scripts/create-comic-manifest-approval-packet.mjs /absolute/new/output` -prints a detached packet with no owner decision. After the owner reviews the exact -source and eight file tuples, record that decision in the detached packet and run -`node scripts/verify-comic-manifest-approval.mjs /absolute/new/output /path/to/owner-approval.json`. The verifier's `approval_record_matches: true` means the record matches all eight files; `owner_identity_authenticated: false` and `external_owner_authentication_required: true` mean it does not authenticate the -owner or authorize publication. Publish only those approved files, unchanged and -without rebuilding. -See the [API/release guide](../docs/comic-manifest-release.md) for detailed -versioning, provenance, review and media-type guidance. - +owner or authorize publication. These commands do not create or move tags, create +releases, upload files, replace release assets, or publish. Do not move +`comic-manifest/v1.0.0` or publish replacement assets. + +A future component or package version requires a separately reviewed, +version-aware workflow that binds the requested component version, tag, package +version, filenames, and approval verification rules, with tests for that version. +Do not use these v1-only commands to prepare a future release. See the +[API/release guide](../docs/comic-manifest-release.md) for the versioning and +provenance boundary. ## Context Builder v1 preparation (#86) See [release/integration guide](../docs/context-builder-v1.md). The independent