From 473299fc9ab31ee3f0da54343c77ea931e3e4c3e Mon Sep 17 00:00:00 2001 From: Jarel Remick Date: Tue, 29 Sep 2026 09:27:06 +1000 Subject: [PATCH] docs: record verified beta.16 work pilot delivery --- CHANGELOG.md | 8 +- docs/BETA16_RELEASE_DELIVERY.md | 100 ++++++++++++++++++++ docs/BETA_RELEASE_GOAL.md | 8 +- docs/RAILWAY_DEPLOYMENT.md | 30 +++++- docs/RELEASE.md | 13 ++- docs/plans/2026-09-29-work-pilot-release.md | 13 ++- 6 files changed, 161 insertions(+), 11 deletions(-) create mode 100644 docs/BETA16_RELEASE_DELIVERY.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 3cdb2f3e..348e6c9a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,19 +2,19 @@ All notable user-facing changes will be tracked here. MySkills is still prerelease software; breaking changes may happen between beta releases and will be called out in this file. -## 0.1.0-beta.16 - candidate +## 0.1.0-beta.16 - 2026-09-29 Target release: `v0.1.0-beta.16`. -Work pilot candidate; publication and deployment verification are pending. +Work pilot release; GitHub, npm beta, and hosted delivery are verified. - Enroll separate Codex and Claude global or project skill inventories. Resolve project ownership and exclusions without changing native skill inheritance. -- Preview and apply local scope migration with stale-plan checks and backups, preserving existing managed workspace bindings. +- Preview and apply local scope migration with stale-plan checks and backups, preserving existing managed workspace bindings. Require explicit acknowledgment before upgrading legacy inode-only root identities. - Select an isolated named CLI configuration for work and personal registries/accounts while retaining the existing default configuration. - Guide provider and scope setup in Connected targets, and show inventory completeness and bounded omission reasons. - Accept valid skill names in observations with structural privacy validation; retain safe upload behavior against older servers. -This release includes the matching npm CLI. Existing skill files and target identities must be preserved during upgrade. See [work pilot delivery plan](docs/plans/2026-09-29-work-pilot-release.md). +Frozen candidate: `acfb7c8c7f8bc560f6fdba13cf0414033ab6d00e`. It includes the matching CLI and excludes later GitHub authentication and team Library changes on main. Verified macOS upgrade and legacy acknowledgment preserved skill files and target identities. See [delivery evidence](docs/BETA16_RELEASE_DELIVERY.md). ## 0.1.0-beta.15 - 2026-09-28 diff --git a/docs/BETA16_RELEASE_DELIVERY.md b/docs/BETA16_RELEASE_DELIVERY.md new file mode 100644 index 00000000..71a69c83 --- /dev/null +++ b/docs/BETA16_RELEASE_DELIVERY.md @@ -0,0 +1,100 @@ +# Beta.16 release delivery + +Released: 29 September 2026. Canonical verification, GitHub/npm publication, +staging acceptance, and production acceptance are complete. + +## Scope and immutable source + +Beta.16 adds separate CLI configuration profiles, read-only global/project +inventories for Codex and Claude, scope ownership/exclusions, explicit legacy +root acknowledgment, and guided browser onboarding. Managed Codex workspaces +remain the only installation/update writer. Native provider inheritance is unchanged. + +Frozen candidate and tag `v0.1.0-beta.16`: +`acfb7c8c7f8bc560f6fdba13cf0414033ab6d00e`. +[PR #114](https://github.com/jremick/myskills/pull/114) merged as +`128850058b5939fa34e39e602eb2dbe9546db89a` through integration head +`12f1952778de7a876ec21b5b4941879b212a695f`. +Integration includes PR #116 GitHub authentication changes. Main later advanced +with PR #117 team Library changes. The frozen beta.16 release excludes both. + +## Verification + +[Candidate CI](https://github.com/jremick/myskills/actions/runs/36493093833), +[candidate CodeQL](https://github.com/jremick/myskills/actions/runs/36493093813), +[integration CI](https://github.com/jremick/myskills/actions/runs/36494128479), +and [merged-main CI](https://github.com/jremick/myskills/actions/runs/36494948297) +passed. These are separate source identities; integration success does not +change the frozen release content. + +The Windows-hosted Linux canonical gate used Node 24.20 and npm 11.12.1: +1,220 repository tests, 107 mocked browser cases, eight full-stack journeys, +and 246 PostgreSQL tests passed, plus CLI package smoke and release artifacts. +One branding browser case passed on retry. Forced architecture-retry evidence +records seven passes and one controlled case that passed on retry. + +Scope coverage passed 8/8; configuration profiles passed five journeys. The +PostgreSQL workflow used two users and a separate reviewer, with 20 denial checks. +An actual macOS beta.8-to-candidate archive upgrade preserved default config, +native Keychain session, scope bytes, and target IDs. A named profile could not +reuse default credentials. Explicit legacy acknowledgment of two active global +roots preserved target IDs, generation, and consent, with exact-byte private +backups. Local-file fingerprints matched before and after the checks. +Subsequent Codex and Claude observation uploads succeeded. They legitimately +refreshed cached target update timestamps; post-upload scope bytes are not +claimed identical. Remote observation digests matched and target IDs/generations +were preserved. Structural comparison confirmed only cached update timestamps +changed. Both inventories remain incomplete; accepted upload is not completeness. +Production CLI doctor passed all nine checks with the existing MFA-verified +Keychain session at `2026-09-28T23:19Z`. + +## Artifacts and publication + +All five downloaded GitHub release assets match local bytes and checksums. +Tagged workflow metadata identifies the frozen source; its source archive +matches the canonical archive byte-for-byte. + +| Archive | Bytes | SHA-256 | +| --- | --- | --- | +| Source | 11,089,920 | `c1b0bf6126e32a47cebc09e0943a8d6688e844ee22099e6fce39e4d31e0968af` | +| CLI | 325,804 | `dcca9c0d31aa8a87ec2ee030b6a7d54af9ec279e95421e05b56144e10562a3b1` | + +- [Tagged workflow](https://github.com/jremick/myskills/actions/runs/36495005150): completed successfully on the frozen candidate. Downloaded metadata, source archive, and checksums were verified; source matches the canonical artifact. +- [GitHub prerelease](https://github.com/jremick/myskills/releases/tag/v0.1.0-beta.16): published `2026-09-28T23:15:46Z`; tag and all five downloaded assets verified. +- npm: registry version `0.1.0-beta.16` and beta selector verified. Registry tarball bytes, SHA-1, and SHA-512 integrity match the candidate. Fresh-cache exact-version and beta-selector installs passed validation and scanning. Latest and alpha remain `0.1.0-alpha.3`. This registry smoke used Node 24.21 and npm 11.19.1, separately from the canonical gate. + +## Production acceptance + +API `96e7dc80-b1c4-43ad-a9c1-6d8465f55b30` and web +`ca6d4399-0cae-4f72-af9e-943ef43ebfc5` report SUCCESS, beta.16, and the frozen +candidate. API readiness includes observation privacy. All 21 HTTP checks passed, +including same-origin identity, anonymous denial, and HTML revalidation. +The log sample covered 73 API and 80 web lines with zero fault matches; +54 web lines were nginx notices. No failed deployment was reported. +Desktop browser acceptance at 1280 × 900 preserved the existing owner/MFA session. +Both global inventories showed incomplete status and bounded findings. Claude +global/project setup commands included the work profile and quoted paths. The +existing private exact release showed its Approved/Passed status, export command, +and four-file text preview. No browser error was sampled; no application data was +changed by these browser checks. + +## Staging acceptance + +API `70461dc1-e6b7-4146-9633-07bc5ccdb73f` and web +`88d64e2b-ad6e-403a-a38c-5998dfc4b7d1` were accepted for the candidate. +Evidence includes 21 HTTP checks; owner login, private package access, and +logout; and public browser catalog/detail rendering. The log sample covered +79 API and 103 web lines with zero fault matches; 54 were nginx notices. +Staging acceptance does not establish production delivery. + +## Recovery and limits + +Retain migration `0034_observation_slug_privacy`; do not rewrite applied history. +Use forward migrations and a tested forward fix. A completed backup captured at +`2026-09-28T16:02:16.488Z` passed the 26-hour freshness policy. No restore is claimed. +Device-plus-inode checks do not prove against same-device inode reuse. + +The work pilot uses a separate future work-hosted instance and macOS clients +with Codex and Claude Code. Work infrastructure setup has not been completed. +Global/Claude targets are inventory-only; provider runtime recognition remains +separate evidence. Project de-scoping changes MySkills ownership only. diff --git a/docs/BETA_RELEASE_GOAL.md b/docs/BETA_RELEASE_GOAL.md index 2852bfe6..350a2540 100644 --- a/docs/BETA_RELEASE_GOAL.md +++ b/docs/BETA_RELEASE_GOAL.md @@ -1,11 +1,15 @@ # Operational Beta Delivery Brief Version: 0.1.0-beta.16 -Last updated: 2026-09-28 +Last updated: 2026-09-29 Target release: `v0.1.0-beta.16`. -Status: beta.16 work pilot candidate; release gates and publication are pending. See [delivery plan](plans/2026-09-29-work-pilot-release.md). +Status: beta.16 implementation, canonical verification, staging/production +acceptance, and GitHub/npm publication are complete for frozen source +`acfb7c8c7f8bc560f6fdba13cf0414033ab6d00e`. +Later GitHub authentication and team Library changes on main are excluded. See the +[Beta.16 release delivery](BETA16_RELEASE_DELIVERY.md). ## Beta.15 Release Record diff --git a/docs/RAILWAY_DEPLOYMENT.md b/docs/RAILWAY_DEPLOYMENT.md index 65101407..d350bac9 100644 --- a/docs/RAILWAY_DEPLOYMENT.md +++ b/docs/RAILWAY_DEPLOYMENT.md @@ -1,13 +1,37 @@ # Railway Deployment Version: 0.1.0-beta.16 -Last updated: 2026-09-28 +Last updated: 2026-09-29 This is the deployment runbook for the owner-controlled public beta at `myskills.sh`. -The current beta.15 delivery is tracked in [Beta.15 Release Delivery](BETA15_RELEASE_DELIVERY.md). +The current beta.16 delivery is tracked in [Beta.16 Release Delivery](BETA16_RELEASE_DELIVERY.md). The historical operational beta evidence remains in [Operational Beta Delivery](OPERATIONAL_BETA_DELIVERY.md). -## Current beta.15 deployment +## Current beta.16 deployment + +On 29 September 2026, staging and production were promoted from frozen source +`acfb7c8c7f8bc560f6fdba13cf0414033ab6d00e` in API-ready-then-web order. +Later GitHub authentication and team Library changes on main are excluded. + +| Environment | API deployment | Web deployment | +| --- | --- | --- | +| Staging | `70461dc1-e6b7-4146-9633-07bc5ccdb73f` | `88d64e2b-ad6e-403a-a38c-5998dfc4b7d1` | +| Production | `96e7dc80-b1c4-43ad-a9c1-6d8465f55b30` | `ca6d4399-0cae-4f72-af9e-943ef43ebfc5` | + +All four report SUCCESS, beta.16, and the frozen source revision. Each environment +passed 21 HTTP checks. Production CLI doctor passed nine checks with the existing +MFA-verified Keychain session. Desktop browser acceptance preserved owner/MFA +authentication and verified inventory details, setup commands, and an existing +private exact-release package preview. The production log sample contained +73 API and 80 web lines, including 54 nginx notices, with zero application fault matches. + +The completed recovery point from `2026-09-28T16:02:16.488Z` passed the 26-hour +freshness policy. No restore is claimed. Retain forward migration +`0034_observation_slug_privacy` and applied history; use a tested forward fix. +The beta.15 deployment pair below remains a historical recovery reference, +not verified downgrade compatibility with the migrated schema. + +## Historical beta.15 deployment On 28 September 2026, staging and production were promoted from `0415a160b56dac79900a698c8d378e7083ecd194` in API-ready-then-web order. diff --git a/docs/RELEASE.md b/docs/RELEASE.md index 3a7cc5e7..80e04b1f 100644 --- a/docs/RELEASE.md +++ b/docs/RELEASE.md @@ -1,12 +1,23 @@ # Release Process Version: 0.1.0-beta.16 -Last updated: 2026-09-28 +Last updated: 2026-09-29 MySkills beta releases are verification-first and approval-gated. A passing command is evidence about one commit; it is not permission to create a tag, publish a package, create a GitHub Release, push an image, or deploy production. The archived alpha criteria remain in [Alpha Release Goal](ALPHA_RELEASE_GOAL.md). The current acceptance ledger is [Public Beta Delivery Brief](BETA_RELEASE_GOAL.md). +## Beta.16 release record + +Frozen candidate and tag `v0.1.0-beta.16` use +`acfb7c8c7f8bc560f6fdba13cf0414033ab6d00e`. Canonical, CI, tagged verification, +staging, and production acceptance passed. GitHub assets and npm beta.16 +publication are verified; npm latest and alpha remain `0.1.0-alpha.3`. Later GitHub authentication and team Library changes on main are excluded. +Retain forward migration +`0034_observation_slug_privacy` and applied migration history. See +[Beta.16 release delivery](BETA16_RELEASE_DELIVERY.md) for separate publication +and production evidence. + ## Beta.15 release record Saved branding controls the browser tab title and favicon at myskills.sh. diff --git a/docs/plans/2026-09-29-work-pilot-release.md b/docs/plans/2026-09-29-work-pilot-release.md index 139c7aa3..9036d848 100644 --- a/docs/plans/2026-09-29-work-pilot-release.md +++ b/docs/plans/2026-09-29-work-pilot-release.md @@ -1,6 +1,8 @@ # Work pilot release -Target: `v0.1.0-beta.16`. Status: implementation and verification in progress. +Target: `v0.1.0-beta.16`. Implementation, canonical verification, staging/production +acceptance, and GitHub/npm publication are complete. Work-instance setup remains +a separate future deployment. ## Approved outcome @@ -73,3 +75,12 @@ Implementation workers record focused evidence under ignored `dist/work-pilot-verification/`. The release record must distinguish the tested commit, merged commit, tagged artifacts, npm publication, and deployed services. Passing earlier scope tests or live enrollment does not replace the release gate. + +## Delivery evidence + +The frozen candidate/tag is `acfb7c8c7f8bc560f6fdba13cf0414033ab6d00e`. +The frozen release excludes later GitHub authentication and team Library changes +on main. Canonical, CI, tagged-artifact, +staging, native upgrade, and observation-preservation evidence is recorded in +[Beta.16 release delivery](../BETA16_RELEASE_DELIVERY.md). That record separates +npm registry verification, GitHub publication, and production acceptance.