diff --git a/CHANGELOG.md b/CHANGELOG.md index 7b11e79..be3702d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ All notable changes use Semantic Versioning and are recorded here. ## 1.0.1 - 2026-08-21 +- Published stable/latest GitHub Release `v1.0.1` from clean source commit `572c6aa2f2b25cfce7393916e23183758851fc88`; the release-grade MIT archive SHA-256 is `0d63f0d01881947d81625012d7692c8f4f849a649c9fe637cde101345183a461`. - Relicensed the repository under the MIT License and updated release SBOM generation and verification to bind the standard SPDX `MIT` identifier. - Redesigned the README around the two-skill workflow, quick start, compatibility, security model, certification evidence, and clear release-license scope. - Published repository with `main` as default branch and preserved `v1.0.0` tag on exact certified source. diff --git a/README.md b/README.md index 1d21622..87eb4d2 100644 --- a/README.md +++ b/README.md @@ -88,14 +88,14 @@ Read the focused documentation: ## Certified release -Teamwork v1.0.0 is certified from source commit `d74b55d74956ce304ee495747729d502d15936d7`. Download the [v1.0.0 GitHub Release](https://github.com/RandyNorthrup/teamwork-skill/releases/tag/v1.0.0). Its archive SHA-256 is `d00ea706fb58455635d64c560acadcdbe16ae0910c4828fb425bf9d6c51bee34`. +Teamwork v1.0.1 is the latest MIT-licensed release, built from clean source commit `572c6aa2f2b25cfce7393916e23183758851fc88`. Download the [v1.0.1 GitHub Release](https://github.com/RandyNorthrup/teamwork-skill/releases/tag/v1.0.1). Its archive SHA-256 is `0d63f0d01881947d81625012d7692c8f4f849a649c9fe637cde101345183a461`. -That exact artifact passed 65 tests on Windows, Kubuntu, and macOS; Python 3.11–3.14 execution; official Agent Skills and SPDX validation; Gemini CLI discovery; a real Kubuntu-to-macOS transfer; and one isolated zero-history Codex continuation. +That exact source passed 65 tests across Windows, Ubuntu, and macOS on Python 3.11–3.14 in the tag-triggered hosted certification matrix. The exact published archive reports both `"ok": true` and `"release_grade": true`; its SPDX 2.3 package declares and concludes `MIT`, and its GitHub asset digest matches the published checksum sidecar. The artifact includes an SPDX 2.3 SBOM with SHA-1 and SHA-256 file checksums, per-file release digests, and source provenance. Clean builds read the version and allowlisted files from immutable Git blobs in the recorded commit with replacement objects disabled. The SHA-256 sidecar proves integrity, not publisher identity. > [!NOTE] -> Published v1.0.0 predates the MIT relicensing and still embeds its earlier proprietary notice. Release archives from v1.0.1 onward carry the MIT License and standard SPDX `MIT` package declaration. +> The real Kubuntu-to-macOS transfer and independent zero-history Codex continuation were executed with v1.0.0. They remain useful unchanged-runtime evidence but are not claimed as exact v1.0.1 artifact reruns. See [certification scope](docs/CERTIFICATION.md) for the version-by-version boundary. ## Development diff --git a/docs/CERTIFICATION.md b/docs/CERTIFICATION.md index 4540cc7..8cb3d4f 100644 --- a/docs/CERTIFICATION.md +++ b/docs/CERTIFICATION.md @@ -11,7 +11,24 @@ Do not claim higher level from documentation, simulated operating-system paths, declared agent labels, or unexecuted CI configuration. -## Current result +## Latest release: v1.0.1 + +Teamwork v1.0.1 achieved `CodeValidated`, `LocalE2ECertified`, and `CrossPlatformCertified` for the exact release source. It also passed the official Agent Skills validator and SPDX validation, but `OpenFormatValidated`, `CrossMachineTransferCertified`, and `IndependentAgentForwardTested` were not rerun against this exact artifact. + +- Release source commit: `572c6aa2f2b25cfce7393916e23183758851fc88` +- Archive: `teamwork-skills-1.0.1.zip` +- Archive SHA-256: `0d63f0d01881947d81625012d7692c8f4f849a649c9fe637cde101345183a461` +- Source state: clean, committed, SHA-1 Git object format +- Release verifier: `ok:true`, `release_grade:true`, 14 payload files plus release manifest +- License: standard MIT text; SPDX package `licenseDeclared` and `licenseConcluded` both equal `MIT` + +Pushed annotated tag `v1.0.1` identifies the release source commit. Stable/latest [GitHub Release v1.0.1](https://github.com/RandyNorthrup/teamwork-skill/releases/tag/v1.0.1) publishes the exact ZIP and checksum sidecar. GitHub asset metadata reports the same ZIP SHA-256 recorded above. + +Tag-triggered GitHub Actions run `32508818774` passed the full Windows, Ubuntu, and macOS matrix on Python 3.11–3.14, official Agent Skills validation, tag-to-`VERSION` validation, and deterministic packaging. Local clean-source certification on Windows 11 with Python 3.14.0 passed 65 tests with one expected directory-symlink privilege skip, 81.5867% branch coverage, strict mypy and Ruff gates, JSON Schema validation, extracted-release verification, and official SPDX validation. + +The payload schema remains `1.0.0`; v1.0.1 changes the package/skill version, repository license, release license metadata, documentation, and packaging tests without changing payload behavior. The v1.0.0 real cross-machine transfer, non-authoring-harness discovery, and independent-agent evidence therefore remain relevant regression context, but they do not raise the exact v1.0.1 claim level. + +## Full six-level baseline: v1.0.0 Teamwork v1.0.0 achieved all six claim levels above for this exact release: @@ -75,7 +92,8 @@ Machine-readable evidence is under `certification-results/`; `index.json` binds ## Claim boundaries -- Hosted CI evidence postdates release source `d74b55d74956ce304ee495747729d502d15936d7`; it validates the same runtime files plus CI/test portability fixes and does not redefine or rebuild the certified v1.0.0 artifact. +- v1.0.1 has exact local and hosted cross-platform source/package evidence, but no new real cross-machine transfer, Gemini CLI discovery, or independent-agent execution. Those higher-level exact-artifact claims remain attached to v1.0.0. +- Hosted CI evidence for v1.0.0 postdates release source `d74b55d74956ce304ee495747729d502d15936d7`; it validates the same runtime files plus CI/test portability fixes and does not redefine or rebuild the certified v1.0.0 artifact. - Cross-machine certification covers one Kubuntu-to-macOS route and one payload, not every transport or filesystem. - Independent-agent evidence covers one fresh Codex agent. Gemini model behavior, Claude Code model behavior, and other clients remain unclaimed. - Gemini evidence proves local discovery, not model execution.