Skip to content

Mill v0.2.1

Choose a tag to compare

View all tags
@davidahmann davidahmann released this 05 Sep 09:24
· 8 commits to main since this release
v0.2.1
a2dcd27
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Mill v0.2.1

The latest Mill release on GitHub. Mill remains a qualified public alpha, not a general enterprise-stack or production-readiness certification. GitHub's Latest designation is a distribution setting; it does not expand the qualified support tuple.

What changed

  • Source-backed follow-up plans compile into dependency-aware bounded tasks.
  • Brownfield discovery supplies bounded task and review context; native Node adoption remains experimental.
  • Local review covers the complete base-to-candidate diff, including preparation changes.
  • Committed validation failures permit one bounded, scope-preserving repair generation.
  • Attended merge plans support separately approved exact-head merges; draft-only remains the default. Builders and reviewers never receive forge mutation authority.
  • Privacy, effect reconciliation, phase-specific producer-bound CI, status, and usage reporting are strengthened.
  • Release runners explicitly prepare the digest-pinned verifier before publication, guarded by native workflow-policy tests.

Install

npm install --save-dev --ignore-scripts @davidahmann/mill@0.2.1
npx --no-install millctl --version

npm alpha and latest both point to 0.2.1. The owner separately approved the latest dist-tag promotion; registry readback verified the unchanged artifact integrity. Pin the exact version deliberately. Existing repositories must requalify after updating their Mill pin. Do not assume an older binary can interpret newer approval state.

Qualification and provenance

  • Reviewed source PR: #23, following architecture PR #22.
  • Exact tagged commit: a2dcd27fa01df9a609b3d057d14dca25c0895262.
  • Reviewed and resulting-main tree: 477d6f7fbca7502a5d6aea6545c2f34bd85c8665.
  • Candidate qualification run 33957390470 passed two independent clean builds, packed-artifact qualification, and the separately pinned v0.1.5 verifier.
  • Source native validation passed 270 tests with 81.31% branch coverage. All five dependent live canary steps passed; a separate seeded regression was rejected and recovery verified.
  • Preserved package SHA-256: dfa6e6415145db46479caf8168730d31fee7668de180ac119b3f4a169a660dbe.
  • npm provenance, registry signatures, registry-downloaded package qualification, and GitHub asset readback were verified. No package was rebuilt or republished during recovery.
  • Attached qualification.json defines the exact macOS arm64 / Node 24.20.0 / npm 11.19.0 / Docker 29.7.2 / Codex CLI 0.153.1 tuple and bundled Node/TypeScript/Next.js recipe. Qualification was exercised on September 5, 2026 and expires October 5, 2026 at 09:11:04 UTC. Other tuples and arbitrary-stack/pnpm adoption are not qualified.
  • Attached release-evidence-final.json binds the reviewed source, two builds, preserved artifact, qualification, SBOM, registry, and GitHub release. Keep the v0.1.5 trust-root artifacts.

Publication recovery record

OIDC publish run 33957855919 successfully published the preserved package, verified npm signatures, and passed registry-package qualification. Its final GitHub readback failed because an already-public, empty release and a separate workflow draft shared tag v0.2.1; tag-based download selected the empty public release.

After explicit owner approval, the attended maintainer attached the same verified artifacts to public release ID 383198362, downloaded and checked every asset, and assembled final evidence using the tagged release tools. The workflow remains failed as historical evidence; it was not rerun. Duplicate draft ID 383199322 remains untouched. GitHub Latest promotion was separately approved by the owner. The annotated tag and npm version were not changed.

The v0.2.0 tag is retained as held prepublication evidence; no 0.2.0 npm publication or GitHub Release was attempted.

Known limits

Native Node ESM/npm adoption is experimental, not arbitrary-stack or pnpm support. Five live steps do not establish statistical reliability, productivity gains, or enterprise production readiness. Provider currency cost was unavailable and is not estimated.

Known maintainer-disposition P2: run state purge from a surviving original checkout, not an authority worktree scheduled for deletion. Preserve an external state backup and committed Git branches first. Using a deletable worktree as the command root can leave cleanup incomplete.

Full changelog: v0.1.5...v0.2.1

Assets 13
Loading