Ship self-contained NarrowsLink v0.1.0 release

[zrack]

Operator outcome

Ships NarrowsLink v0.1.0 as a reproducible local operator distribution. The package contains the production UI, managed authenticated UDP bridge, deterministic Harbor relay fixture, and offline receiver CLI. narrowslink serve starts the application and bridge together without a source checkout, Vite, runtime npm dependencies, or manual token transfer.

Release engineering

• Builds twice from separate staging roots and requires byte-identical public assets.
• Publishes a payload-reconciled release manifest, normalized CycloneDX 1.5 SBOM, and SHA256SUMS.
• Requires a clean annotated v0.1.0 tag at the exact release commit in strict mode.
• Installs the tarball offline into a temporary global prefix and drives acceptance through the installed command.
• Adds verify-before-publish GitHub release automation with pinned action revisions and Node/npm versions.

Acceptance evidence

npm run check passed locally:

• TypeScript validation
• 235 Vitest tests across 23 files
• production UI and CLI builds
• receiver CLI smoke
• 33 source Playwright checks across Chromium, Firefox, and WebKit
• byte-identical double release build
• 3 installed-release acceptance checks across Chromium, Firefox, and WebKit

The artifact gate performs real UDP capture → version 2 .nlsession → replay → operator-authored half-open range, marker, and note → .nlb export → verification with the receiver shipped in the same tarball. It then replaces the installed bytes at the same origin and proves the session library and operator workspace reopen intact.

Compatibility and boundaries

• Session formats v1 and v2 remain unchanged; evidence bundle format remains v3.
• Stable-origin upgrades and package removal preserve browser-held sessions and workspace data; exported files are untouched.
• Release assets and evidence bundles remain unsigned. Checksums establish byte consistency, not publisher, author, or build-environment authenticity.
• Physical Web Serial hardware and manual assistive-technology certification remain explicit manual boundaries.