From 71d08a5462ddeaa3e5f50079a969a6f501c35dae Mon Sep 17 00:00:00 2001 From: chumanic Date: Fri, 9 Oct 2026 15:21:18 +0800 Subject: [PATCH] Document verified GitHub SkillSync 0.1.4 distribution --- CHANGELOG.md | 4 ++++ README.md | 8 ++++++-- fixtures/product/delivery-coverage/README.md | 12 +++++++----- 3 files changed, 17 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d4a2314..1a65add 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ ## 0.1.4 - 2026-10-09 +GitHub release run `37897733439` succeeded. Downloaded package/SBOM/manifest +checksums and asset digests matched; isolated installation and the packaged +synthetic delivery-coverage check passed with `execution: not-run`. + - Publish new tagged packages through GitHub Releases with SHA256 checksums, validated CycloneDX SBOM and required GitHub provenance, without an npm account. - Keep npm-based CI defaults on the actually public 0.1.0 package; source and diff --git a/README.md b/README.md index 3da1e3e..9b13486 100644 --- a/README.md +++ b/README.md @@ -32,8 +32,12 @@ node dist/cli/index.js verify --path fixtures/product/trust-loop/review --target Tagged builds now publish a CLI tarball, checksums, a validated CycloneDX SBOM and a source manifest on [GitHub Releases](https://github.com/Chumaniac/skillsync/releases). -The current source candidate is 0.1.4; its release is complete only after the -matching immutable tag workflow succeeds. Installation still uses Node.js 20+ +[GitHub v0.1.4](https://github.com/Chumaniac/skillsync/releases/tag/v0.1.4) +is published. Release run 37897733439 passed its source/main binding, tests, +actual package allowlist, locked production SBOM and required GitHub provenance. +The downloaded archive, SBOM and source manifest matched their checksums and +public asset digests; an isolated install reported 0.1.4 and passed the packaged +synthetic delivery-coverage example with `execution: not-run`. Installation still uses Node.js 20+ and fetches the package's public dependencies; it needs no npm login. ```bash diff --git a/fixtures/product/delivery-coverage/README.md b/fixtures/product/delivery-coverage/README.md index 49c72e7..2cb2fd3 100644 --- a/fixtures/product/delivery-coverage/README.md +++ b/fixtures/product/delivery-coverage/README.md @@ -1,12 +1,12 @@ -# Expected delivery coverage — local candidate +# Expected delivery coverage — GitHub v0.1.4 -This source-only candidate detects a different omission from dangling references: +This packaged synthetic example detects a different omission from dangling references: all delivered rows can point to valid orders while an expected order has no rows. The synthetic expected-order table is an explicit checklist, not an authenticated order system. `require_all_targets: true` requires every declared unique target ID to appear in the selected source field at least once. The default remains false. -Build the candidate source, then run: +Build the source or install the GitHub package, then run from the repository/package root: ```bash node dist/cli/index.js artifacts --contract fixtures/product/delivery-coverage/contract.json --path fixtures/product/delivery-coverage/artifacts --format json @@ -27,5 +27,7 @@ All relation checks remain within the shared 100,000-cell index and 256-finding ceilings; the indexes store fingerprints and row numbers rather than ID contents. No runtime, network, account or real business integration is executed. -The new coverage option is in the 0.1.3 source release candidate; npm publication -is separately verified after its release workflow succeeds. +The coverage option was introduced in source 0.1.3 and is included in the +published GitHub v0.1.4 package. The packaged example passed after installing +that public archive. The npm registry remains at 0.1.0; GitHub distribution and +real business acceptance are separate evidence.