Skip to content

docs(release): record v0.3.2 publication #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
davidahmann merged 1 commit into from
Sep 9, 2026
Merged

docs(release): record v0.3.2 publication #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions docs/releases/v0.3.2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,3 +32,30 @@ final evidence after those steps complete.
The public-alpha limits remain unchanged. This release does not add a supported
stack, grant autonomous merge or deployment authority, or establish customer or
live-provider compatibility.

## Completed publication readback

The immutable candidate run
[`34387631805`](https://github.com/davidahmann/mill/actions/runs/34387631805)
and protected publish run
[`34388616783`](https://github.com/davidahmann/mill/actions/runs/34388616783)
completed on 2026-09-09. The tag commit
`b48b9b167df6b57991e03075ba5c8237a3a8554c` and reviewed candidate tree
`c486696648e9927a206933507f4257ceefa0c529` match. Both independent builders and
the final GitHub asset readback identify the preserved tarball as
`sha256:cdb123740e57562c81f6557d1ba7dfac2e243616f6e639bac1620166955bdf15`.

The registry reports integrity
`sha512-bbcwN0geCWywa1lUDWLfftTigp9IyEGaMPYSoE2/lbFIXyr4vJ0CizNTJyBfU4+dytdB3eOxJiXUuV3HiY5HeQ==`;
the protected workflow verified npm provenance and signatures, then requalified
a fresh registry download. npm `alpha` and `latest` both resolve to `0.3.2`. The
`latest` promotion used the maintainer's attended security-key challenge and did
not rebuild or republish the artifact.

The public
[GitHub Release](https://github.com/davidahmann/mill/releases/tag/v0.3.2) is
normal, not a draft or prerelease, and carries the tarball, checksum, SBOM,
prepublication evidence, and final evidence. The qualified support tuple remains
`darwin-arm64-node24-codex`, exercised with Node 24.20.0 and npm 11.19.0; it
expires at `2026-10-05T15:35:52.039Z`. Its full identity is preserved in the
candidate qualification artifact.
22 changes: 22 additions & 0 deletions product/tasks/RELEASE_V0_3_2.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,3 +48,25 @@ constraints:
stop_conditions:
- ambiguous tag, tree, artifact, candidate-run, provenance, or provider effect
- unavailable independent verification or recurring P0/P1 release finding
closure:
status: completed
owner: attended_maintainer_not_builder
recorded_at: 2026-09-09
release: v0.3.2
tag_commit: b48b9b167df6b57991e03075ba5c8237a3a8554c
reviewed_candidate_tree: c486696648e9927a206933507f4257ceefa0c529
candidate_run: 34387631805
publish_run: 34388616783
github_release_id: 385751369
npm_integrity: sha512-bbcwN0geCWywa1lUDWLfftTigp9IyEGaMPYSoE2/lbFIXyr4vJ0CizNTJyBfU4+dytdB3eOxJiXUuV3HiY5HeQ==
disposition: >-
The annotated tag, two independent artifact builders, candidate and trusted
policy verification, protected OIDC publication, npm provenance/signature
verification, registry requalification, normal GitHub Release, and npm
alpha/latest pointers all resolve to the preserved v0.3.2 artifact. The
attended latest-channel promotion did not rebuild or republish the package.
evidence:
- docs/releases/v0.3.2.md
- https://github.com/davidahmann/mill/actions/runs/34387631805
- https://github.com/davidahmann/mill/actions/runs/34388616783
- https://github.com/davidahmann/mill/releases/tag/v0.3.2