Coven v0.4.8

Coven v0.4.8

Coven publishes one digest per Automations definition revision, stops
sessions from staying running after their harness is gone, and makes the
GitHub Release step wait for npm instead of failing on a fresh publish.

npm install -g @opencoven/cli@0.4.8
coven doctor

Automations

• A richly authored definition revision is now identified everywhere by its
  document's JCS integrity, the value definition.create.v1 and
  definition.revise.v1 return. Lifecycle events, occurrence.get,
  occurrence.list and occurrence.history, run.get, and the Runtime
  Authority execution binding all publish it, and so do the receipts built
  from that binding. In v0.4.7 they published the digest of the projected
  routine instead. That digest has no revision field, so two paused revisions
  with the same body shared it, and a receipt never matched the integrity a
  client held.
• Scheduling and dispatch still fence on the routine digest, which is
  unchanged. Legacy and routine-bodied revisions publish it as before.
• Events written by v0.4.7 are immutable and keep the digest they were written
  with. A stored receipt may name either digest of its revision.

Daemon

• A session whose harness is gone no longer stays running until the next
  daemon restart. Every 30 seconds the daemon checks the sessions it
  registered. One that has left the live registry, or whose harness process
  group no longer exists, becomes orphaned after a two-minute grace. Its
  live handle is then released the way a normal exit releases it.

Release tooling

• The GitHub Release step waits up to 15 minutes for npm to serve a version
  it has just published, instead of failing on the registry's propagation
  delay. Each request is bounded by the time left. v0.4.4, v0.4.6 and v0.4.7
  each needed a manual recovery for this.
• Provenance verification accepts npm's unprefixed trusted publisher config
  ids as well as the oidc: form.

Coven remains an early MVP. The Automations manifests remain proposed with
productionReady:false. A trusted Runtime Authority adapter still waits on
these open decisions:

• principal authentication;
• familiar binding issuance;
• Threads decision signing;
• terminal observation production (#857, OpenCoven/coven-runtimes#48).

Exact source: eb3273e19670d2ab5bf1374783d96c11a50b0be2.
-----BEGIN SSH SIGNATURE-----
U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAguzqcpSw/45XOhNc1hxn3wh4+l3
iP5p67B5VL9yjNXwMAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
AAAAQB/OBaBw1v3KdTD1WX/03ZltOeIUYR5XQCq1YULlt6jRGBBQC+sQT7RnWEw8znk/kL
6DpYjaYdiwXV6crn+6eAs=
-----END SSH SIGNATURE-----