ATape v0.5.8

ATape v0.5.8: Static update discovery and bounded Collector handoff

This coordinated patch contains @atape/cli and all seven official Adapters
at 0.5.8. It includes the static discovery work from
PR #223 and the Collector stop-probe
fix from PR #222.

The Authentication epoch remains auth-v1, including the 180 days absolute Web
Session lifetime. Unified artifact release and minimum CLI metadata are 0.5.8.
Package publication does not deploy a Server or change an existing Instance's
minimum CLI version.

Changes and delivery

New clients discover complete release bundles from https://updates.atape.net
through Cloudflare Workers Static Assets. The v1/v2 catalogs and immutable exact
descriptors use the existing domain protocols; npm still serves package archives.
The serialized publisher validates every advertised public package byte, retains
historical exact descriptors and refuses catalog regression or immutable changes
before deploying one complete static snapshot.

Discovery reuses a validated catalog for 12 hours and reuses immutable exact
bundle receipts. Expired verified catalogs can serve a compatible target during
transport failure; malformed metadata, damaged local state and integrity failures
remain errors. Transient metadata requests can retry at most three times within
one ten-second request budget, with cancellation and short Retry-After support.
Using stale discovery retains the durable retry schedule even when that cached
target successfully upgrades; it does not reset to a daily success schedule.

Collector stop probes now reject cancelled, late, empty or partial timeout output
as proof of exit. A live PID remains distinct from confirmed exit, and force
termination requires a fresh ownership check. Closing timed-out probe readers
prevents an inherited pipe from extending the bounded handoff. These changes do
not authorize signals to a process whose ownership cannot be confirmed.

Capture contract atape.client.v3-capture.v2, update control
atape.update-control.v1 and the compiled
atape.capture-migration.v1 / journal-v7-to-v8 plan are unchanged. Existing
0.5.7 clients discover this complete release through the retained GitHub bridge;
the new selected generation then uses the CDN. That initial old-client discovery
can still be delayed by GitHub availability or its existing due schedule. Deploying
static files alone does not replace installed binaries or make immutable 0.5.3
cross its unsupported initial state boundary.

See the automatic update guide,
explicit migration guide
and static publication contract.
Existing provider and Server prerequisites, including experimental
Cursor requirements, remain unchanged.

Candidate validation and manual acceptance disclosure

The frozen 0.5.8 candidate must pass repository, installed CLI/Adapter, historical
client and migration, PostgreSQL, dependency/container security, Go race/fuzz,
self-host configuration and paired restore gates before publication. Preparing
these notes claims no 0.5.8 CI, npm publication or native unattended upgrade result.
The 0.5.6 → 0.5.7 acceptance
and static distribution evidence
retain their recorded scope; they are not a 0.5.7 → 0.5.8 delivery attestation.

Staging evidence remains pending. All ten manual
checks are unverified and waived for publication only:

• candidate-artifacts: manual candidate artifact acceptance.
• official-topology: the official deployment topology.
• github-provider-staging-smoke: live GitHub Provider staging smoke.
• official-domain-egress-deny-smoke: official-domain egress isolation.
• two-user-two-team: two-user/two-Team acceptance.
• waf-tls-callback: WAF, TLS and callback configuration.
• backup-restore: operational backup and restore.
• observability-secret-sample: observability secret sampling.
• rollback: operational rollback exercise.
• release-signoff: manual release signoff.

On 2026-10-11 in Asia/Singapore, the user explicitly requested:
“那你发布下新版 CLI 和官方 Adapter 吧，让现有用户自动升级接入 CDN。”
The next coordinated patch selected for that request is 0.5.8. Under
ADR-0048, this
authorizes the candidate-bound manual-only waiver; automated gates remain
mandatory. It does not authorize Server deployment or production database migration.

{
"protocol": "atape.release-bundle.v1",
"version": "0.5.8",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-oepXN4VV+WtoXd7MonxUIO0+JJbFpwgcVU0okPzjTfEnFWj5QiR5EkMJIoGSoFKpjA4UXWxVPq/N/OYVdzVvjQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.8.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-Tdp88bsSufXtwib09/3u+NEFSLPKW15oL1fTYa9rZYmkSo9w26GhaEgOJAPwFi51YVpjW1BLJ2k530DEP0YI9A==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.8.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-itVpG1/0kNnTTgyVdCdtZcVZH9icpNXfE1OT4aFMC2dIXOrhT0+5iq2uryQqwleQH7+5dFrUCTzPImd/5MbHGw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.8.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-mV72aHdmauN3XxrawgLMJYgxuIdHQ3OGT9k2fYXkFMpKaL+gWYK1i74csJiTpFXfMtj/mHVEUSjaNz4KDbnXaA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.8.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-212KBdkSETy31mZi2UMStxESElyepkF14PElIn/Wg5lnbvHmYKHkpRbDNqD8ZPzURShIIHFSl88uojnpJ5cPJw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.8.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-Eu9tfLEqpekKhOJfYeNFQJKwkEgKlOwHgjcyt0yeBySEggv7/6CHMtzlsXImEDtLFWHKNuS0uNQSqeNsRIE0Fg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.8.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-KmYjZyxWphHbA8LfeP/12gmLjn2UbTyqWUdSIl6QTP0cnoV9Y9TNNn9mNeDqQ9QWnNcbrDE5FCGGFnxJUPt5Fg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.8.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-zSoXd95XwgXVy6ulGbFrtH5uDAPHossC5MU6Sxl3IG85MvxGgFA+Shae9bVMRI7bfX+/AhuCde67Gv9N6sIzlw==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.8.tgz"
}
]
}

{
"protocol": "atape.release-bundle.v2",
"version": "0.5.8",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-oepXN4VV+WtoXd7MonxUIO0+JJbFpwgcVU0okPzjTfEnFWj5QiR5EkMJIoGSoFKpjA4UXWxVPq/N/OYVdzVvjQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.8.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-Tdp88bsSufXtwib09/3u+NEFSLPKW15oL1fTYa9rZYmkSo9w26GhaEgOJAPwFi51YVpjW1BLJ2k530DEP0YI9A==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.8.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-itVpG1/0kNnTTgyVdCdtZcVZH9icpNXfE1OT4aFMC2dIXOrhT0+5iq2uryQqwleQH7+5dFrUCTzPImd/5MbHGw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.8.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-mV72aHdmauN3XxrawgLMJYgxuIdHQ3OGT9k2fYXkFMpKaL+gWYK1i74csJiTpFXfMtj/mHVEUSjaNz4KDbnXaA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.8.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-212KBdkSETy31mZi2UMStxESElyepkF14PElIn/Wg5lnbvHmYKHkpRbDNqD8ZPzURShIIHFSl88uojnpJ5cPJw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.8.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-Eu9tfLEqpekKhOJfYeNFQJKwkEgKlOwHgjcyt0yeBySEggv7/6CHMtzlsXImEDtLFWHKNuS0uNQSqeNsRIE0Fg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.8.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-KmYjZyxWphHbA8LfeP/12gmLjn2UbTyqWUdSIl6QTP0cnoV9Y9TNNn9mNeDqQ9QWnNcbrDE5FCGGFnxJUPt5Fg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.8.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-zSoXd95XwgXVy6ulGbFrtH5uDAPHossC5MU6Sxl3IG85MvxGgFA+Shae9bVMRI7bfX+/AhuCde67Gv9N6sIzlw==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.8.tgz"
}
],
"migration": {
"protocol": "atape.capture-migration.v1",
"id": "journal-v7-to-v8",
"fromCaptureStateContracts": [
"atape.client.v3-capture.v1",
"atape.client.v3-capture.v2"
]
}
}