From 5cced9ec3486fd0a3016a5ba1c00494ce7449ad5 Mon Sep 17 00:00:00 2001 From: David Ahmann <46606159+davidahmann@users.noreply.github.com> Date: Mon, 14 Sep 2026 10:49:23 -0400 Subject: [PATCH] chore(release): prepare v0.4.0 Signed-off-by: David Ahmann <46606159+davidahmann@users.noreply.github.com> --- CHANGELOG.md | 4 ++ README.md | 30 +++++++-------- docs/releases/v0.4.0.md | 38 +++++++++++++++++++ package-lock.json | 4 +- package.json | 2 +- product/PLAN.md | 16 ++++---- product/impacts/RELEASE_V0_4_0.yaml | 32 ++++++++++++++++ product/release-v0.4.0.md | 28 ++++++++++++++ product/tasks/DEVELOPMENT_READINESS.yaml | 17 ++++++++- product/tasks/RELEASE_V0_4_0.yaml | 48 ++++++++++++++++++++++++ src/version.ts | 2 +- 11 files changed, 192 insertions(+), 29 deletions(-) create mode 100644 docs/releases/v0.4.0.md create mode 100644 product/impacts/RELEASE_V0_4_0.yaml create mode 100644 product/release-v0.4.0.md create mode 100644 product/tasks/RELEASE_V0_4_0.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 5256195..8ab8cb1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,8 @@ All notable changes follow Keep a Changelog and Semantic Versioning. ## [Unreleased] +## [0.4.0] - 2026-09-14 + ### Added - Add source-only documentation guidance, a digest-pinned writing procedure, a @@ -32,6 +34,8 @@ All notable changes follow Keep a Changelog and Semantic Versioning. - Keep reusable migration knowledge separate from repository-owned acceptance and verification. Playbook corrections require a separate reviewed change and cannot recertify the run that discovered them. +- Refresh the exact zod, Node type, and TypeScript ESLint dependency pins, with + regenerated schema snapshots where zod's JSON Schema output changed. ## [0.3.2] - 2026-09-09 diff --git a/README.md b/README.md index 6fd7d0b..7a662e4 100644 --- a/README.md +++ b/README.md @@ -12,15 +12,15 @@ candidate. A separate read-only pass reviews that exact commit. Only the attended shipper can use your GitHub identity. Draft-only is the default; repositories may explicitly enable a separately approved, exact-plan merge. -Mill `0.3.2` is the current qualified public alpha and latest release on -[GitHub](https://github.com/davidahmann/mill/releases/tag/v0.3.2) and npm. It -adds bounded integration-adaptation evidence while retaining the preserved -artifact, provenance, SBOM, independent qualification, and registry/GitHub -readback required by the release path. GitHub's Latest label does not expand the -public-alpha support limits. See the [release record](docs/releases/v0.3.2.md) -for exact evidence and recovery history. The `v0.1.5` genesis release remains -the historical trust root; the `v0.2.0` tag remains preserved prepublication -evidence. +Mill `0.4.0` is the current qualified public alpha and latest release on +[GitHub](https://github.com/davidahmann/mill/releases/tag/v0.4.0) and npm. It +adds repository-owned playbooks, read-only run timelines and outcomes, and +generic development-readiness controls. The preserved artifact, provenance, +SBOM, independent qualification, and registry/GitHub readback remain required by +the release path. GitHub's Latest label does not expand the public-alpha support +limits. See the [release record](docs/releases/v0.4.0.md) for exact evidence and +recovery history. The `v0.1.5` genesis release remains the historical trust +root; the `v0.2.0` tag remains preserved prepublication evidence. ## Why Mill @@ -82,7 +82,7 @@ For its one qualified shape, Mill can: specification in this alpha. The operator supplies the structured proposal that Mill assesses and freezes. -## Repository playbooks, run timelines and outcomes (unreleased source) +## Repository playbooks, run timelines and outcomes The source branch can index small repository-owned playbooks, search compact metadata, and bind a selected set into a task's frozen context. A playbook can @@ -104,9 +104,9 @@ when present. It reports owner acceptance as `not_recorded`; checks, review and delivery cannot certify that decision. Invalid, stale or cross-candidate records block the projection. See [run outcomes](docs/run-outcome.md). -These source capabilities are not part of the current public-alpha support claim -or the published `0.3.2` package until they receive their own qualification and -release. +These capabilities are included in `0.4.0`, but they are outside the qualified +public-alpha support claim until separately qualified. They do not grant a +builder authority to change acceptance criteria, deliver, merge, or release. The source also contains a constrained pnpm workspace preparation path. It binds the pnpm version, lockfile, workspace declaration, and direct workspace package @@ -140,7 +140,7 @@ Install the qualified public alpha at its exact version with lifecycle scripts disabled: ```sh -npm install --save-dev --ignore-scripts @davidahmann/mill@0.3.2 +npm install --save-dev --ignore-scripts @davidahmann/mill@0.4.0 npx --no-install millctl --version ``` @@ -157,7 +157,7 @@ PATH="$node_bin_dir:$PATH" "$node_bin_dir/npm" run build node dist/cli.js --version ``` -The `alpha` and `latest` npm tags both resolve to `0.3.2`. Downstream +The `alpha` and `latest` npm tags both resolve to `0.4.0`. Downstream repositories should still pin the exact version so a later release cannot alter their delivery machinery implicitly. Updating an existing Mill installation is deliberate: preserve state and repository snapshots, inspect the release notes, diff --git a/docs/releases/v0.4.0.md b/docs/releases/v0.4.0.md new file mode 100644 index 0000000..964f94a --- /dev/null +++ b/docs/releases/v0.4.0.md @@ -0,0 +1,38 @@ +# Mill v0.4.0 + +`0.4.0` is a public-alpha minor release. It adds repository-owned playbooks, +read-only run timelines and outcomes, and generic development-readiness controls +for documentation and routine dependency maintenance. + +Playbooks can retain small, digest-bound operational procedures. A task still +owns its acceptance criteria and native checks. Run timelines and outcomes +project bounded, schema-checked lifecycle facts without exposing event payloads +or claiming owner acceptance. + +The package also includes a constrained pnpm workspace preparation path and +downstream Node/npm policy starters. The pnpm path is source-only and +unqualified. It does not establish support for pnpm workspaces, native builds, +or a broader application stack. + +## Install + +```sh +npm install --save-dev --ignore-scripts @davidahmann/mill@0.4.0 +npx --no-install millctl --version +``` + +Pin the exact version. The npm `latest` channel is a distribution pointer, not +an automatic-update instruction; an existing repository must deliberately +requalify changed delivery machinery. + +## Release evidence + +The annotated tag is qualified through two independent builds, a preserved +tarball, packed greenfield/adoption canaries, the pinned independent policy, +protected npm OIDC publication, registry requalification, and GitHub asset +readback. The normal GitHub Release carries the tarball, checksum, SBOM, and +final evidence after those steps complete. + +The public-alpha limits remain unchanged. This release does not add a supported +stack, grant autonomous merge or deployment authority, or establish customer or +live-provider compatibility. diff --git a/package-lock.json b/package-lock.json index 89ba890..77c1fd5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@davidahmann/mill", - "version": "0.3.2", + "version": "0.4.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@davidahmann/mill", - "version": "0.3.2", + "version": "0.4.0", "bundleDependencies": [ "typescript" ], diff --git a/package.json b/package.json index 33cf786..61a78bf 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@davidahmann/mill", - "version": "0.3.2", + "version": "0.4.0", "description": "A local-first, repo-native software factory from approved product intent to reviewed draft PRs.", "license": "Apache-2.0", "author": "David Ahmann", diff --git a/product/PLAN.md b/product/PLAN.md index bc27939..ed8e338 100644 --- a/product/PLAN.md +++ b/product/PLAN.md @@ -1,7 +1,6 @@ # Mill delivery plan -Status: public-alpha scope complete; generic development-readiness increment -active +Status: public-alpha scope complete; generic development-readiness landed Owner: David Ahmann @@ -28,13 +27,12 @@ synthetic provider-change fixture. It does not turn local evidence into customer acceptance, introduce provider monitoring or customer systems, or expand public-alpha support. -The active source-only increment is -[generic development readiness](development-readiness.md). It adds a narrow DCO -exception for verified Dependabot commits, repository-owned documentation -guidance, packaged downstream policy starters, and one constrained pnpm -workspace preparation shape. It does not change branch protection, add a -product-specific integration, claim Docker qualification, or expand the -published support matrix. +The [generic development-readiness](development-readiness.md) increment is +landed. It adds a narrow DCO exception for verified Dependabot commits, +repository-owned documentation guidance, packaged downstream policy starters, +and one constrained pnpm workspace preparation shape. It does not change branch +protection, add a product-specific integration, claim Docker qualification, or +expand the published support matrix. 1. **Foundation:** repository constitution, exact-version CLI, compact schemas, static source/repository inspection, native CI, and security/release design. diff --git a/product/impacts/RELEASE_V0_4_0.yaml b/product/impacts/RELEASE_V0_4_0.yaml new file mode 100644 index 0000000..74fc82d --- /dev/null +++ b/product/impacts/RELEASE_V0_4_0.yaml @@ -0,0 +1,32 @@ +schemaVersion: "2" +id: mill-release-v0.4.0 +status: approved +approved_by: davidahmann +approval_source: >- + Attended Codex conversation on 2026-09-14: “fastforward local main and now + lets do new release incl npm and docs update where needed”. +source_base: 3311f30e907adaf59494899bb324b4db31efd6e2 +authority: product/release-v0.4.0.md +affected_invariants: + - INV-HUMAN-AUTHORITY + - INV-EXACT-EVIDENCE + - INV-DOWNSTREAM-INDEPENDENT +material_changes: + - Advances the immutable package identity to v0.4.0. + - Publishes the already reviewed playbook, timeline, outcome and generic + development-readiness capabilities without expanding the support matrix. + - Updates installation and release documentation to the new exact version. +affected_surfaces: + - package and CLI version identity + - public README, changelog, release record, product plan and task closure + - exact release record, npm environment admission, and public distribution +verification: + - native check, exact-candidate audit, complete-diff review, and green PR + - annotated-tag identity and two independent candidate builds + - independent policy, registry-package, npm provenance, and GitHub-asset + readback +exceptions: + - This attended maintainer release may merge, create and push the annotated + v0.4.0 tag, add its exact npm-environment rule, publish one preserved + artifact, create the normal GitHub Release, and promote only its alpha and + latest npm dist-tags as specified in its authority record. diff --git a/product/release-v0.4.0.md b/product/release-v0.4.0.md new file mode 100644 index 0000000..25cc07b --- /dev/null +++ b/product/release-v0.4.0.md @@ -0,0 +1,28 @@ +# v0.4.0 attended release authority + +## Authorization + +David Ahmann authorized this release in the attended Codex conversation on +2026-09-14: “fastforward local main and now lets do new release incl npm and +docs update where needed”. + +The authorization covers the exact `v0.4.0` public-alpha release from the +reviewed current-main candidate: version and documentation updates; the exact +GitHub `npm` environment tag rule; an annotated tag; candidate and protected +publish workflows; one preserved npm artifact; the normal GitHub Release; npm +`alpha` and `latest`; and provider readback. + +It does not authorize a wildcard, bypass, weaker trusted publishing, a change to +prior tags, releases or packages, or a broader public support claim. + +## Scope and stop conditions + +The candidate ships the generic development-readiness and already merged +playbook, timeline and outcome capabilities through the existing independently +qualified release path. Historical tags, published package versions, release +records, and provider evidence remain immutable. + +Stop before publication if the candidate tag, source tree, preserved artifact, +candidate run, qualification, npm provenance, registry readback, or GitHub asset +identity differs. A failed candidate or ambiguous external effect requires a new +reviewed version; it never permits retagging or republishing. diff --git a/product/tasks/DEVELOPMENT_READINESS.yaml b/product/tasks/DEVELOPMENT_READINESS.yaml index 1942298..6764490 100644 --- a/product/tasks/DEVELOPMENT_READINESS.yaml +++ b/product/tasks/DEVELOPMENT_READINESS.yaml @@ -1,6 +1,6 @@ schemaVersion: "2" task_id: mill-development-readiness -status: approved +status: closed owner: davidahmann base_commit: b41dea8d41753fdc0c5f10c3032344aef8273417 execution_mode: approved_native_maintainer @@ -42,3 +42,18 @@ constraints: stop_conditions: - ambiguous authority, secret disclosure or unavailable mandatory gate - recurring same-subsystem P0 or P1 finding +closure: + status: completed + owner: attended_maintainer_not_builder + recorded_at: 2026-09-14 + implementation_merges: [13a9178, 7face17, 3311f30] + disposition: >- + The generic controls, regression coverage, documentation and packed policy + starters merged through reviewed pull requests. The source-only pnpm path + remains unqualified, and no downstream setting, customer system or release + was changed by this implementation increment. + evidence: + - product/development-readiness.md + - https://github.com/davidahmann/mill/pull/43 + - https://github.com/davidahmann/mill/pull/44 + - https://github.com/davidahmann/mill/pull/45 diff --git a/product/tasks/RELEASE_V0_4_0.yaml b/product/tasks/RELEASE_V0_4_0.yaml new file mode 100644 index 0000000..6ca2546 --- /dev/null +++ b/product/tasks/RELEASE_V0_4_0.yaml @@ -0,0 +1,48 @@ +schemaVersion: "2" +task_id: mill-release-v0.4.0 +status: approved +owner: davidahmann +base_commit: 3311f30e907adaf59494899bb324b4db31efd6e2 +execution_mode: approved_native_maintainer +authority: product/release-v0.4.0.md +impact_manifest: product/impacts/RELEASE_V0_4_0.yaml +objective: >- + Ship the exact v0.4.0 public-alpha artifact with current installation and + release documentation. +allowed_paths: + - package.json + - package-lock.json + - src/version.ts + - README.md + - CHANGELOG.md + - docs/releases/v0.4.0.md + - product/PLAN.md + - product/development-readiness.md + - product/release-v0.4.0.md + - product/impacts/RELEASE_V0_4_0.yaml + - product/tasks/DEVELOPMENT_READINESS.yaml + - product/tasks/RELEASE_V0_4_0.yaml +authority_preparation_paths: + - product/** + - docs/releases/** +acceptance_items: + - R040-01 public installation and current-release documentation name v0.4.0 + - R040-02 the package and CLI identify v0.4.0 + - R040-03 the source-only pnpm boundary remains explicit in release material + - R040-04 native check, exact-candidate audit, complete review, and PR checks + pass + - R040-05 annotated tag, candidate, protected publication, readback, release, + and npm alpha/latest pointers all bind to the same preserved artifact +validation_commands: + - npm run check + - node dist/cli.js --json --cwd . audit + - MILL_RELEASE_TAG=v0.4.0 node scripts/verify-release-tag.mjs +required_reviews: + - read-only review of the complete committed Mill release-preparation diff +constraints: + - single attended maintainer writer + - exact v0.4.0 environment-tag admission only; no wildcard or bypass + - preserve all historical tags, npm versions, releases, and evidence +stop_conditions: + - ambiguous tag, tree, artifact, candidate-run, provenance, or provider effect + - unavailable independent verification or recurring P0/P1 release finding diff --git a/src/version.ts b/src/version.ts index 794ea93..6028608 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1,3 +1,3 @@ export const MILL_PACKAGE = "@davidahmann/mill"; -export const MILL_VERSION = "0.3.2"; +export const MILL_VERSION = "0.4.0"; export const RESULT_SCHEMA_VERSION = "1";