diff --git a/CHANGELOG.md b/CHANGELOG.md index 8151648..8f2d1c4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,40 @@ # Changelog +## v0.1.0-alpha.6 (2026-10-13): a recorded crash test and a reproducible licenses archive + +Release notes: [docs/releases/v0.1.0-alpha.6.md](docs/releases/v0.1.0-alpha.6.md). + +No product code changed; the binaries differ from v0.1.0-alpha.5 only in +their version string. + +### Verification + +- `TestSIGKILLResume` records every value it checks during a SIGKILL and + resume, and compares the sequence with + `internal/orchestrator/testdata/crash-replay.json`; any difference fails + the test. Task ids and times are normalised; `-update-replay` rewrites + the file. + +### Build + +- `make dist` sets the licenses archive's permission bits instead of taking + them from the builder's umask, so local and CI builds of a tag produce the + same archive. + +### Tests and CI + +- The first-task smoke tests no longer depend on a warm Go module cache: the + offline-build test module ships a `go.sum` and its indirect requirements, + and the workflow downloads the Temporal Go SDK before the task that + builds it. + +### Documentation + +- Engineering case study (`docs/public-launch/engineering-case-study.md`). +- Adoption metrics, a first-run issue form, feedback templates and a triage + process (`docs/public-launch/`). +- Corrected two stale statements in the getting-started path. + ## v0.1.0-alpha.5 (2026-10-10): security fixes and verifiable releases Release notes: [docs/releases/v0.1.0-alpha.5.md](docs/releases/v0.1.0-alpha.5.md). diff --git a/docs/development/status.md b/docs/development/status.md index 029818c..7b0ffc9 100644 --- a/docs/development/status.md +++ b/docs/development/status.md @@ -35,7 +35,7 @@ limited validation or unstable interfaces), **planned**. | macOS support | experimental | compiles and vets for darwin/arm64 and darwin/amd64; Go installers with pinned macOS assets (real archive unpacked on Linux). Unit tests on the CI macOS runner (a8fce66): 26 of 31 test packages pass; `cli`, `frontier`, `gitops`, `sandbox` and `verify` fail (the CI step reports only). **The full flow has not been run on a Mac** | | Native Windows support | experimental | compiles and vets for windows/amd64 and arm64; container path translation, relative worktree pointers, Windows packet sanitizing, ACLs. Unit tests on the CI Windows runner (a8fce66): 17 of 31 test packages pass; `cli`, `config`, `frontier`, `gitops`, `install`, `model`, `policy`, `repointel/serena`, `sandbox`, `secrets`, `store`, `verify`, `xservice` and `scripts/serenaguard` fail (the CI step reports only). `install.ps1` parses in CI but has not been run. **The full flow has not been run on Windows**; Serena unsupported there | | Daemon, GUI | planned | | -| Release packaging, SBOM | implemented | `make dist` (binaries and SBOMs for linux, darwin and windows on amd64 and arm64, reproducible licenses archive, checksums), `scripts/sbom`; published as v0.1.0-alpha.1 (source), v0.1.0-alpha.2 (linux/amd64 binary) v0.1.0-alpha.3 (six binaries with SBOMs), v0.1.0-alpha.4 (the same, adding the cross-repository gate) and v0.1.0-alpha.5 (built and attested by the `release` workflow from the tag; SBOMs reproducible). The workflow only drafts a release; publishing needs maintainer approval. | +| Release packaging, SBOM | implemented | `make dist` (binaries and SBOMs for linux, darwin and windows on amd64 and arm64, reproducible licenses archive, checksums), `scripts/sbom`; published as v0.1.0-alpha.1 (source), v0.1.0-alpha.2 (linux/amd64 binary) v0.1.0-alpha.3 (six binaries with SBOMs), v0.1.0-alpha.4 (the same, adding the cross-repository gate), v0.1.0-alpha.5 (built and attested by the `release` workflow from the tag; SBOMs reproducible) and v0.1.0-alpha.6 (licenses archive reproducible regardless of umask). The workflow only drafts a release; publishing needs maintainer approval. | | Local escalation tier (switch to a stronger local model before frontier) | planned | motivated by the 4/4 vs 1/4 result in ADR-0007 | An implementation audit against both specifications (the original project diff --git a/docs/releases/v0.1.0-alpha.6.md b/docs/releases/v0.1.0-alpha.6.md new file mode 100644 index 0000000..4760846 --- /dev/null +++ b/docs/releases/v0.1.0-alpha.6.md @@ -0,0 +1,82 @@ +# BoundedCode v0.1.0-alpha.6 + +**A crash test that records what it saw, and a reproducible licenses archive.** + +No product code has changed since [v0.1.0-alpha.5](v0.1.0-alpha.5.md): the +binaries differ only in their version string. This alpha publishes the +crash-recovery test's own record of a kill and resume, makes every release +file reproducible regardless of the builder's umask, and fixes two smoke +tests that passed only on a warm module cache. + +The local default, Qwen3.6-35B-A3B on Linux with an NVIDIA GPU, is still the +only validated configuration. + +## Verification + +- **A recorded crash and resume.** `TestSIGKILLResume` kills a runner + process with SIGKILL in the middle of an agent turn, checks that a second + runner is refused while the lease is fresh, and that a third takes over + once it is stale and finishes the task. It now writes down every value it + checks, in order, and compares the sequence with + [`internal/orchestrator/testdata/crash-replay.json`](../../internal/orchestrator/testdata/crash-replay.json). + - **Any difference fails the test,** so a passing CI run proves the file is + what a real kill and resume produced at that commit. + - **Normalised:** task ids and wall-clock times are replaced by + placeholders, so the file is identical on every run. + - **Rewriting it** on purpose: `go test ./internal/orchestrator -run + '^TestSIGKILLResume$' -update-replay`. + +## Releases you can verify + +- **Reproducible licenses archive.** `make dist` now fixes the archive's + permission bits instead of taking them from the builder's umask, so a + local rebuild matches the CI release byte for byte. With alpha.5 this held + only under `umask 022`. +- Attestation and rebuild steps are unchanged: + [Verifying a release](../development/release.md#verifying-a-release). + +## Tests and CI + +- **Smoke tests without a warm module cache.** Two first-task smoke tests + passed only on machines whose Go module cache was already populated. The + offline-build test module now ships a `go.sum` and lists its indirect + requirements, and the workflow downloads the Temporal Go SDK before the + task that builds it. + +## Documentation + +- **[Engineering case study](../public-launch/engineering-case-study.md):** + problem, architecture, every evaluation with its numbers, the documented + false verification passes, limitations and lessons. +- **Adoption and feedback:** what counts as external adoption, a first-run + issue form, templates for reproduction records and outside feedback, and a + triage process. +- **Corrections** to two stale statements in the getting-started path. + +**Benchmarks for this release.** No product code has changed since alpha.5, +whose benchmark section still applies; the task and infrastructure +benchmarks were not re-run. + +## Known limitations + +1. **Serena's pinned Python environment** (`configs/serena/uv.lock`) pins + urllib3 2.7.0 and Werkzeug 3.1.7, which have open advisories + (GHSA-vxq7-64xx-v4gw, GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g and + GHSA-g6x2-hccm-hh4m; fixed in urllib3 2.8.0 and Werkzeug 3.1.9). Upgrading + them needs the licence review the pin policy requires. +2. **Earlier limitations.** The limitations of + [v0.1.0-alpha.5](v0.1.0-alpha.5.md#known-limitations) still apply. + +## Assets + +- **Binaries:** `boundedcode-linux-amd64`, `boundedcode-linux-arm64`, + `boundedcode-darwin-amd64`, `boundedcode-darwin-arm64`, + `boundedcode-windows-amd64.exe` and `boundedcode-windows-arm64.exe`. + They are static (CGO disabled). +- **`SHA256SUMS`:** checksums, verified by the installers. +- **`SBOM--.spdx.json`:** an SPDX 2.3 software bill of materials + for each binary. +- **`boundedcode-v0.1.0-alpha.6-licenses.tar.gz`:** `LICENSE`, `NOTICE`, + `THIRD_PARTY_NOTICES.md`, and the license texts of every Go module + compiled into the binaries (`LICENSES/go`) and of the upstream + components (`LICENSES/upstream`).