Skip to content

Document v1.0.1 release evidence #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RandyNorthrup merged 1 commit into from
Aug 21, 2026
Merged

Document v1.0.1 release evidence #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ All notable changes use Semantic Versioning and are recorded here.

## 1.0.1 - 2026-08-21

- Published stable/latest GitHub Release `v1.0.1` from clean source commit `572c6aa2f2b25cfce7393916e23183758851fc88`; the release-grade MIT archive SHA-256 is `0d63f0d01881947d81625012d7692c8f4f849a649c9fe637cde101345183a461`.
- Relicensed the repository under the MIT License and updated release SBOM generation and verification to bind the standard SPDX `MIT` identifier.
- Redesigned the README around the two-skill workflow, quick start, compatibility, security model, certification evidence, and clear release-license scope.
- Published repository with `main` as default branch and preserved `v1.0.0` tag on exact certified source.
Expand Down
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,14 +88,14 @@ Read the focused documentation:

## Certified release

Teamwork v1.0.0 is certified from source commit `d74b55d74956ce304ee495747729d502d15936d7`. Download the [v1.0.0 GitHub Release](https://github.com/RandyNorthrup/teamwork-skill/releases/tag/v1.0.0). Its archive SHA-256 is `d00ea706fb58455635d64c560acadcdbe16ae0910c4828fb425bf9d6c51bee34`.
Teamwork v1.0.1 is the latest MIT-licensed release, built from clean source commit `572c6aa2f2b25cfce7393916e23183758851fc88`. Download the [v1.0.1 GitHub Release](https://github.com/RandyNorthrup/teamwork-skill/releases/tag/v1.0.1). Its archive SHA-256 is `0d63f0d01881947d81625012d7692c8f4f849a649c9fe637cde101345183a461`.

That exact artifact passed 65 tests on Windows, Kubuntu, and macOS; Python 3.11–3.14 execution; official Agent Skills and SPDX validation; Gemini CLI discovery; a real Kubuntu-to-macOS transfer; and one isolated zero-history Codex continuation.
That exact source passed 65 tests across Windows, Ubuntu, and macOS on Python 3.11–3.14 in the tag-triggered hosted certification matrix. The exact published archive reports both `"ok": true` and `"release_grade": true`; its SPDX 2.3 package declares and concludes `MIT`, and its GitHub asset digest matches the published checksum sidecar.

The artifact includes an SPDX 2.3 SBOM with SHA-1 and SHA-256 file checksums, per-file release digests, and source provenance. Clean builds read the version and allowlisted files from immutable Git blobs in the recorded commit with replacement objects disabled. The SHA-256 sidecar proves integrity, not publisher identity.

> [!NOTE]
> Published v1.0.0 predates the MIT relicensing and still embeds its earlier proprietary notice. Release archives from v1.0.1 onward carry the MIT License and standard SPDX `MIT` package declaration.
> The real Kubuntu-to-macOS transfer and independent zero-history Codex continuation were executed with v1.0.0. They remain useful unchanged-runtime evidence but are not claimed as exact v1.0.1 artifact reruns. See [certification scope](docs/CERTIFICATION.md) for the version-by-version boundary.

## Development

Expand Down
22 changes: 20 additions & 2 deletions docs/CERTIFICATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,24 @@

Do not claim higher level from documentation, simulated operating-system paths, declared agent labels, or unexecuted CI configuration.

## Current result
## Latest release: v1.0.1

Teamwork v1.0.1 achieved `CodeValidated`, `LocalE2ECertified`, and `CrossPlatformCertified` for the exact release source. It also passed the official Agent Skills validator and SPDX validation, but `OpenFormatValidated`, `CrossMachineTransferCertified`, and `IndependentAgentForwardTested` were not rerun against this exact artifact.

- Release source commit: `572c6aa2f2b25cfce7393916e23183758851fc88`
- Archive: `teamwork-skills-1.0.1.zip`
- Archive SHA-256: `0d63f0d01881947d81625012d7692c8f4f849a649c9fe637cde101345183a461`
- Source state: clean, committed, SHA-1 Git object format
- Release verifier: `ok:true`, `release_grade:true`, 14 payload files plus release manifest
- License: standard MIT text; SPDX package `licenseDeclared` and `licenseConcluded` both equal `MIT`

Pushed annotated tag `v1.0.1` identifies the release source commit. Stable/latest [GitHub Release v1.0.1](https://github.com/RandyNorthrup/teamwork-skill/releases/tag/v1.0.1) publishes the exact ZIP and checksum sidecar. GitHub asset metadata reports the same ZIP SHA-256 recorded above.

Tag-triggered GitHub Actions run `32508818774` passed the full Windows, Ubuntu, and macOS matrix on Python 3.11–3.14, official Agent Skills validation, tag-to-`VERSION` validation, and deterministic packaging. Local clean-source certification on Windows 11 with Python 3.14.0 passed 65 tests with one expected directory-symlink privilege skip, 81.5867% branch coverage, strict mypy and Ruff gates, JSON Schema validation, extracted-release verification, and official SPDX validation.

The payload schema remains `1.0.0`; v1.0.1 changes the package/skill version, repository license, release license metadata, documentation, and packaging tests without changing payload behavior. The v1.0.0 real cross-machine transfer, non-authoring-harness discovery, and independent-agent evidence therefore remain relevant regression context, but they do not raise the exact v1.0.1 claim level.

## Full six-level baseline: v1.0.0

Teamwork v1.0.0 achieved all six claim levels above for this exact release:

Expand Down Expand Up @@ -75,7 +92,8 @@ Machine-readable evidence is under `certification-results/`; `index.json` binds

## Claim boundaries

- Hosted CI evidence postdates release source `d74b55d74956ce304ee495747729d502d15936d7`; it validates the same runtime files plus CI/test portability fixes and does not redefine or rebuild the certified v1.0.0 artifact.
- v1.0.1 has exact local and hosted cross-platform source/package evidence, but no new real cross-machine transfer, Gemini CLI discovery, or independent-agent execution. Those higher-level exact-artifact claims remain attached to v1.0.0.
- Hosted CI evidence for v1.0.0 postdates release source `d74b55d74956ce304ee495747729d502d15936d7`; it validates the same runtime files plus CI/test portability fixes and does not redefine or rebuild the certified v1.0.0 artifact.
- Cross-machine certification covers one Kubuntu-to-macOS route and one payload, not every transport or filesystem.
- Independent-agent evidence covers one fresh Codex agent. Gemini model behavior, Claude Code model behavior, and other clients remain unclaimed.
- Gemini evidence proves local discovery, not model execution.
Expand Down