GraphForge v0.5.2

What's Changed

• docs(release): describe host-native offline npm rehearsal by @DecisionNerd in #318
• chore(ci): remove changelog subsystem by @DecisionNerd in #322
• fix(release): trim CARGO_REGISTRY_TOKEN before cargo publish by @DecisionNerd in #323
• fix(release): durable crates.io 429 Retry-After waits by @DecisionNerd in #324
• fix(release): refresh crate observation before authorize by @DecisionNerd in #326
• fix(release): refresh crate deps before authorize by @DecisionNerd in #328
• fix(release): no-verify crate publish; age failed attempts by @DecisionNerd in #330
• fix(release): clobber attempt/receipt uploads on recovery by @DecisionNerd in #332
• Repair the advertised node inspection API by @DecisionNerd in #346
• Use crates.io Trusted Publishing for crate releases by @DecisionNerd in #350
• fix(bindings): repair Node bulk API contract by @DecisionNerd in #351
• test(api): make public BDD fail closed by @DecisionNerd in #358
• fix(storage): abort stale optimistic validation attempts by @DecisionNerd in #364
• test(ci): measure native binding Rust coverage by @DecisionNerd in #361
• docs: install current GraphForge releases by @DecisionNerd in #375
• test(release): isolate npm publication dry-run policy by @DecisionNerd in #377
• test(core): enforce coverage ledger and foundational contracts by @DecisionNerd in #378
• test(rel): prove expression and relational-lowering boundaries by @DecisionNerd in #379
• test(exec): prove write execution and dispatch boundaries by @DecisionNerd in #380
• test(storage-api): close remaining coverage floors for #369 by @DecisionNerd in #382
• docs: dual-track CI objectives and speed as a first-class value by @DecisionNerd in #390
• test: speed make coverage-rust via profile align and parallel acceptance by @DecisionNerd in #391
• ci: accelerate Binding RC builds by @DecisionNerd in #392
• ci: rewrite storage policy for Blacksmith sticky disks and colocated cache by @DecisionNerd in #395
• ci: automate safe publish-track certification by @DecisionNerd in #393
• ci: share PR artifacts with concurrency matrix by @DecisionNerd in #394
• ci(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in #370
• chore(deps-dev): bump ruff from 0.16.0 to 0.16.1 in the development-dependencies group by @dependabot[bot] in #371
• ci(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #372
• ci(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #373
• chore(release): freeze GraphForge surfaces at 0.5.2 by @DecisionNerd in #397

Full Changelog: v0.5.1...v0.5.2

GraphForge v0.5.1

• Freeze Cargo, Python, Node/native npm, CLI, and agent-skills surfaces at
  0.5.1 and cut the dated changelog for the coordinated M1 corrective
  release (#192).
• Keep first-party crate path+version dependency pins on the same root
  version so Binding RC offline rehearsal and crates.io packaging accept
  the complete 15-crate graph (#192).
• Generate the gitignored NAPI-RS index.js / index.d.ts entrypoints
  during Binding RC candidate assembly so the main npm tarball is complete
  before offline rehearsal (#192).
• Offline Binding RC Node rehearsal installs only the host-compatible native
  npm package alongside main/CLI/skills so platform os/cpu metadata no
  longer fails the clean consumer with EBADPLATFORM (#192).
• Offline Binding RC CLI rehearsal initializes a git project before
  config validate so the clean consumer matches the real CLI project
  contract (#192).
• Retain Binding RC evidence and node-addon partitions with a multiline
  upload-artifact path so brace globs are not treated as a missing file
  set (#192).
• Replace the Python package README with a concise PyPI landing page: short
  purpose, install path, one minimal first-use example, and canonical
  docs.graphforge.sh links instead of a raw CLI command inventory (#304).
• Partition the immutable candidate into independently retained Python, npm,
  crates, evidence, and manifest artifacts; authorize every write from fresh
  registry truth; parallelize only the five native npm packages with verified
  main/CLI/skills fan-in; isolate registry credentials; remove polling sleeps;
  and always reconcile all 24 public nodes across partial job outcomes (#296).
• Add a deterministic pre-write release rehearsal that installs and executes
  the exact candidate through clean Python, Node/native, CLI, and agent-skills
  consumers, validates all crate packages and dependencies, and proves the
  24-node recovery graph sequentially across partial success, cancelled,
  timed-out, skipped, propagation-delayed, conflicting, indeterminate, and
  expired-artifact outcomes (#295).
• Derive publication recovery from the immutable candidate plus fresh PyPI,
  npm, and crates.io truth: normalize absence, accepted propagation, verified
  bytes, conflict, failure, and indeterminate evidence; bound visibility checks
  without sleeps or repeat writes; and schedule only dependency-valid absent
  nodes with available retained artifacts (#294).
• Replace checksum-only release records with a deterministic, partitioned
  candidate manifest that enforces the complete 24-node public package set,
  one root version, exact dependency edges, archive entrypoints/legal files,
  retention, and an explicit registry-independent publication state model
  before any write (#293).
• Adopt ADR 0017's single-version release invariant: all public Rust crates,
  Python and Node/native adapters, CLI, and agent skills must publish one exact
  GraphForge version, and partial-publication recovery may not introduce
  temporary or registry-specific version divergence (#292).
• Split native binaries out of the main @curatelabs/graphforge npm tarball,
  and add the explicitly authorized v0.5.0 supplemental artifact/checksum
  record so the previously unpublished main package stays below npm's payload
  limit while reusing the already-published platform packages (#287).
• Verify newly published and resumed npm packages immediately against npm's
  dist.integrity metadata, preserving exact-byte checks without failing while
  the registry's public tarball CDN is still replicating (#284).
• Add an explicit, maintainer-reasoned publication recovery dispatch that can
  resume the immutable v0.5.0 tag and retained candidate after waiving only
  the tagged changelog's stale [Unreleased] entries; all artifact, checksum,
  identity, ordering, and fail-closed registry checks remain required (#281).
• Move all public npm packages from the unavailable @graphforge scope to the
  Curate Labs-owned @curatelabs scope, using @curatelabs/graphforge for the
  native binding and @curatelabs/graphforge-* for platform, CLI, and agent
  skills packages; update release records, verification, and publication docs
  to reject the retired candidate names (#279).

GraphForge v0.5.0

GraphForge v0.5.0 is the first public M1 release.

The canonical release notes are maintained in the versioned v0.5.0 CHANGELOG section. GitHub limits release bodies to 125,000 characters, while the complete canonical notes are longer, so the tagged changelog is the authoritative unabridged record.

The attached artifact record is added by the ordered publication workflow before its first registry write.