From cd635b180e2963f8e5f287acdaceb56bf02fb42f Mon Sep 17 00:00:00 2001 From: CompleteDotTech <5861166+CompleteDotTech@users.noreply.github.com> Date: Sun, 30 Aug 2026 07:59:10 +0000 Subject: [PATCH 1/2] docs: reconcile 0.1.0 program state Truth-keeping reconciliation for #31 against live GitHub state: - #35 is closed (pairing via #54; custody hardening via #63/#68/#69) - Chat #27 is closed with the packed-consumer integration durable on protected main and release-artifact consolidation repins recorded - #38 in-repo enforcement contract credited to PRs #73/#74; remaining input is Chat-produced schema-v2 records on the frozen matrix - delivered-foundations list extended through PR #73 Advances #31 (truth-keeping mode; children #38/#40/#41 remain open). --- docs/ROADMAP.md | 56 ++++++++++++++++++++++++++++++------------------- 1 file changed, 35 insertions(+), 21 deletions(-) diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 4e480c7..175fd0f 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -21,22 +21,33 @@ Delivered foundations include: merged through SDK PR #55; - contract fixture verification; - property, stress, package, and packed-consumer tests; -- a locked two-key release system with checksummed artifacts and OIDC-oriented publishing. +- a locked two-key release system with checksummed artifacts and OIDC-oriented publishing; +- managed native Cave credential transport and custody (PRs #63, #68) with + `hpke-bound-v1` request binding (PR #69); +- secure non-secret profiles (PR #65), redacted diagnostics (PR #66), and + frozen packed public API baselines (PR #64); +- the frozen native conformance matrix (PR #70), the conversational-control + and offline-reads implementation designs (PRs #71, #72), and the + cross-repository conformance evidence contract (PR #73). All workspace packages remain private and public publishing remains intentionally disabled. The 0.1 release inventory contains the four SDK libraries; `@opencoven/dev-cli` remains a source-tested private workspace and is excluded from release artifacts and the Changesets fixed group. -SDK [#35](https://github.com/OpenCoven/sdk/issues/35) merged through PR #69 at -`163961f4e59cfdef51d2271fa98e7c514977203f`. It adds strict discovery v2 plus -`hpke-bound-v1`, and the upstream producer/runtime authority boundary landed in +SDK [#35](https://github.com/OpenCoven/sdk/issues/35) is closed. Its pairing and +secure credential custody implementation merged through PR #54, and native +custody hardening continued through PRs #63 (managed native credential +transport), #68 (managed native credential custody), and #69 +(`hpke-bound-v1` request binding at +`163961f4e59cfdef51d2271fa98e7c514977203f`). The upstream producer/runtime +authority boundary landed in [`OpenCoven/coven-cave#5044`](https://github.com/OpenCoven/coven-cave/pull/5044) at merge commit `2a0ff9237e94e652e477b22f60fd6d721b9e6451`, closing [`OpenCoven/coven-cave#4996`](https://github.com/OpenCoven/coven-cave/issues/4996). -Issue #35 remains open only for real-authority pairing/custody evidence -covering secure-store failure/retry, restart reuse, revocation, -ambiguity handling, and no-secret retention. +Real-authority pairing/custody evidence (secure-store failure/retry, restart +reuse, revocation, ambiguity handling, no-secret retention) is owned by the +[#38](https://github.com/OpenCoven/sdk/issues/38) conformance record. SDK [#36](https://github.com/OpenCoven/sdk/issues/36) merged through PR #55 at `d7f9e69378d6136c2771f60b4c57d7beeaa74f6a`. It exposes five one-page reads @@ -51,13 +62,15 @@ SDK [#37](https://github.com/OpenCoven/sdk/issues/37) records that the private CLI is deferred from 0.1 and that Chat's Tauri layer owns the Phase 1 native trust adapters. The 0.1 native Chat/real-authority conformance matrix is now frozen to `darwin-arm64`, `linux-x64`, and `win32-x64`. Chat -[#27](https://github.com/OpenCoven/chat/issues/27) remains blocked on durable -implementation of those adapters and complete cross-repository evidence across -that matrix. Its comments cite -commit `950feb5` and branch `feat/native-sdk-integration`, but neither is -currently reachable on GitHub, so recovery or rebuild of that integration -evidence may be required before [#38](https://github.com/OpenCoven/sdk/issues/38) -can close. +[#27](https://github.com/OpenCoven/chat/issues/27) is closed: the +packed-consumer integration is durable on protected `main` (squash merge +`0021d30d0cddc5d3f00a41c55d025cf3ce4611c5`, pinning the HPKE-bound SDK merge +`163961f4e59cfdef51d2271fa98e7c514977203f` and Cave authority +`2a0ff9237e94e652e477b22f60fd6d721b9e6451`), and release-artifact +consolidation repinned the production integration to SDK `acc3848` with a +locked manifest digest. The remaining +[#38](https://github.com/OpenCoven/sdk/issues/38) input is Chat-produced +schema-v2 conformance records across the frozen matrix. ## Now — secure read-only 0.1 @@ -71,20 +84,21 @@ can close. - [#34](https://github.com/OpenCoven/sdk/issues/34) — secure Cave discovery - [#35](https://github.com/OpenCoven/sdk/issues/35) — pairing and credential - custody; strict discovery v2 + `hpke-bound-v1` merged through PR #69, but - real-authority pairing/custody evidence remains open + custody; closed — implementation merged through PR #54 with native custody + hardening through PRs #63/#68/#69 - [#36](https://github.com/OpenCoven/sdk/issues/36) — canonical reads merged through PR #55 - [#37](https://github.com/OpenCoven/sdk/issues/37) — defer private CLI from 0.1; assign Phase 1 native trust adapters to Chat ### Consumer and evidence - [Chat #27](https://github.com/OpenCoven/chat/issues/27) — packed SDK/native - integration; durable implementation and reachable GitHub evidence still - required + integration; closed with the integration durable on protected `main` - [#38](https://github.com/OpenCoven/sdk/issues/38) — cross-repository - real-authority conformance blocked on Chat #27 and complete - cross-repository evidence across the frozen `darwin-arm64`, `linux-x64`, and - `win32-x64` matrix; one passing record is required for each target + real-authority conformance; the in-repo enforcement contract landed through + PRs #73 and #74 (declared assertion registry, fail-closed aggregation, + redaction/digest scans, and release readiness bound to a single named + `aggregateRecord`, currently `null`); closure requires Chat-produced passing + records for `darwin-arm64`, `linux-x64`, and `win32-x64` - [#39](https://github.com/OpenCoven/sdk/issues/39) — profiles, diagnostics, and public API governance ### Release From 462e006b7c2cf6946c9ee3197c70bd981079e42d Mon Sep 17 00:00:00 2001 From: CompleteDotTech <5861166+CompleteDotTech@users.noreply.github.com> Date: Sun, 30 Aug 2026 09:09:41 +0000 Subject: [PATCH 2/2] ci: allow workflow dispatch (fork runner bootstrap) --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3c4c649..ec32ac3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,7 @@ on: branches: - main pull_request: + workflow_dispatch: permissions: contents: read