From 378a4e7338ac42c3e06514c1f065ece392b274c7 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 6 Aug 2026 16:42:38 +0000 Subject: [PATCH 1/3] docs: record 0.1.1 as the published release status MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The npm dist-tag `latest` and the only git tag are both `0.1.1`, but the docs still asserted `0.1.0` as the current published state — including `docs/README.md`'s "Current readiness", which declares itself the single source of truth for release status. A reader checking release status got a stale answer from the one place that promises an accurate one. `docs/README.md` now records `0.1.1` as the current release and the first one published through the OIDC pipeline (so it carries build provenance), keeping the reason `0.1.0` could not be. The echoing passages in `README.md`, `CLAUDE.md`/`AGENTS.md`, DEC-7, and the product spec's release-gate preamble keep the durable manual-bootstrap/OIDC narrative but no longer pin a version that rots — they defer to `docs/README.md` for the current release, so only one file moves each time crew publishes. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DAdcHxgLQztc5RhBRC4ag6 --- AGENTS.md | 2 +- CLAUDE.md | 2 +- README.md | 2 +- docs/README.md | 9 +++++---- docs/design/decisions.md | 9 +++++---- docs/design/product-spec.md | 5 +++-- 6 files changed, 16 insertions(+), 13 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index a1b736c..fd55d55 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -26,7 +26,7 @@ subcommand that nudges idle panes from the content-free Inbox summary without co Messages (ADR-0008). The live launch is worktree-enabled, with per-Worker isolated Task worktrees (ADR-0015). -`0.1.0` is published to npm. The first publish was a one-time manual `npm publish` +The package is published to npm. The first publish was a one-time manual `npm publish` (npm OIDC Trusted Publishing can only attach to a package that already exists); from `0.1.1`, a published GitHub Release runs `.github/workflows/publish.yml` and publishes via OIDC with provenance — no long-lived npm secret ever enters CI. `docs/README.md` diff --git a/CLAUDE.md b/CLAUDE.md index 1ff3cf9..2ef808a 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -26,7 +26,7 @@ subcommand that nudges idle panes from the content-free Inbox summary without co Messages (ADR-0008). The live launch is worktree-enabled, with per-Worker isolated Task worktrees (ADR-0015). -`0.1.0` is published to npm. The first publish was a one-time manual `npm publish` +The package is published to npm. The first publish was a one-time manual `npm publish` (npm OIDC Trusted Publishing can only attach to a package that already exists); from `0.1.1`, a published GitHub Release runs `.github/workflows/publish.yml` and publishes via OIDC with provenance — no long-lived npm secret ever enters CI. `docs/README.md` diff --git a/README.md b/README.md index fd4b8c2..b1f4659 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,7 @@ crew requires **Node.js `>=24.15`**. Its State Store — the single database fil keeps all shared state — uses the built-in `node:sqlite` module, which only ships with Node 24 and later. -`0.1.0` is published to npm. Install it globally: +crew is published to npm. Install it globally: ```sh npm install -g @dichovsky/crew diff --git a/docs/README.md b/docs/README.md index 6e3b9dc..94da5cc 100644 --- a/docs/README.md +++ b/docs/README.md @@ -59,10 +59,11 @@ the same plan), the live tmux Launcher and Relay with per-Worker isolated git wo concurrent use and security attacks, and the `crew ui` Console — a dashboard reachable only from your own computer, with live updates (SSE) and Operator actions. -`0.1.0` is published to npm as the first release. Because npm's OIDC Trusted Publishing -can only attach to a package that already exists, that first publish was a one-time -manual `npm publish` (so `0.1.0` carries no CI provenance); from `0.1.1` onward, -publishing a GitHub Release runs +`0.1.1` is the current published release on npm, and the first one published through the +OIDC pipeline, so it carries build provenance. The first release, `0.1.0`, could not: +because npm's OIDC Trusted Publishing can only attach to a package that already exists, +that first publish was a one-time manual `npm publish` (so `0.1.0` carries no CI +provenance). From `0.1.1` onward, publishing a GitHub Release runs [`.github/workflows/publish.yml`](../.github/workflows/publish.yml), which publishes to npm via OIDC — no long-lived npm secret ever enters CI — with provenance. The canonical [release-gate table](./design/product-spec.md#release-gates) records the six gates that diff --git a/docs/design/decisions.md b/docs/design/decisions.md index 2276c45..db0a31b 100644 --- a/docs/design/decisions.md +++ b/docs/design/decisions.md @@ -24,10 +24,11 @@ restate them. The executable is `crew`, the Workspace directory `.crew/`, and the State Store `.crew/state/crew.db`. The unscoped npm package name `crew` is taken, so the package publishes under the maintainer's namespace as `@dichovsky/crew` -(`npm install -g @dichovsky/crew`; the installed command is still `crew`). `0.1.0` is -published: the first publish was a one-time manual `npm publish` (npm OIDC Trusted -Publishing can only attach to a package that already exists), and from `0.1.1` a -published GitHub Release publishes via OIDC through `.github/workflows/publish.yml`. +(`npm install -g @dichovsky/crew`; the installed command is still `crew`). The package is +published to npm: the first publish (`0.1.0`) was a one-time manual `npm publish` (npm +OIDC Trusted Publishing can only attach to a package that already exists), and from +`0.1.1` a published GitHub Release publishes via OIDC through +`.github/workflows/publish.yml`. (`1.0.0` is reserved for a later stability milestone.) ### DEC-8 — Runtime and build diff --git a/docs/design/product-spec.md b/docs/design/product-spec.md index aa7a9d1..64a912f 100644 --- a/docs/design/product-spec.md +++ b/docs/design/product-spec.md @@ -105,8 +105,9 @@ requires one process that stays alive for as long as the tmux session does. ## Release gates This is the **canonical release-gate list**. Other documents reference it and must not keep a -separate copy. The first publish (`0.1.0`) has shipped to npm. Because npm's OIDC Trusted Publishing -can only attach to a package that already exists, `0.1.0` was published once by hand; +separate copy — release status included, which [docs/README.md](../README.md) owns. crew has shipped +to npm. Because npm's OIDC Trusted Publishing can only attach to a package that already +exists, the first release (`0.1.0`) was published once by hand; from `0.1.1` on, a published GitHub Release runs `.github/workflows/publish.yml`, which publishes via OIDC with provenance and no stored npm secret (see [publishing.md](../release/publishing.md)). The From 0fb71aeedcdbe6010a06415bf0851e4865fc313f Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 6 Aug 2026 16:59:03 +0000 Subject: [PATCH 2/3] docs: narrow the release-status ownership clause in the release gates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous commit told other documents not to keep a separate copy of "release status". That claim was too wide in both directions. Its "which" read as binding to the release-gate list, so the sentence appeared to hand docs/README.md ownership of the very list the same sentence calls canonical here — and `docs/design/srs.md` routes release status to this section, so a level-4 document was disclaiming a subject a level-2 document assigns it. The rule also outlawed its own paragraph: the publishing narrative is restated, legitimately, in decisions.md, CLAUDE.md/AGENTS.md, testing-strategy.md, publishing.md, and live-smoke-checklist.md, none of which fall under the summarize-and-defer carve-out docs/README.md grants. Narrow the clause to the fact that actually rots — the current published version — which is what #38 was about. The publishing narrative stays freely restatable, the SRS pointer stays honest, and docs/README.md remains the single place naming a version. Also rewrap the paragraph back into the file's band after the earlier edit, and drop a doubled statement of 0.1.0's missing provenance from docs/README.md. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DAdcHxgLQztc5RhBRC4ag6 --- docs/README.md | 9 ++++----- docs/design/product-spec.md | 12 ++++++------ 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/docs/README.md b/docs/README.md index 94da5cc..13165bd 100644 --- a/docs/README.md +++ b/docs/README.md @@ -59,11 +59,10 @@ the same plan), the live tmux Launcher and Relay with per-Worker isolated git wo concurrent use and security attacks, and the `crew ui` Console — a dashboard reachable only from your own computer, with live updates (SSE) and Operator actions. -`0.1.1` is the current published release on npm, and the first one published through the -OIDC pipeline, so it carries build provenance. The first release, `0.1.0`, could not: -because npm's OIDC Trusted Publishing can only attach to a package that already exists, -that first publish was a one-time manual `npm publish` (so `0.1.0` carries no CI -provenance). From `0.1.1` onward, publishing a GitHub Release runs +`0.1.1` is the current published release on npm and the first published through the OIDC +pipeline, so it carries build provenance. `0.1.0` does not: npm's OIDC Trusted Publishing +can only attach to a package that already exists, so the first publish was a one-time +manual `npm publish`. From `0.1.1` onward, publishing a GitHub Release runs [`.github/workflows/publish.yml`](../.github/workflows/publish.yml), which publishes to npm via OIDC — no long-lived npm secret ever enters CI — with provenance. The canonical [release-gate table](./design/product-spec.md#release-gates) records the six gates that diff --git a/docs/design/product-spec.md b/docs/design/product-spec.md index 64a912f..4f41316 100644 --- a/docs/design/product-spec.md +++ b/docs/design/product-spec.md @@ -105,12 +105,12 @@ requires one process that stays alive for as long as the tmux session does. ## Release gates This is the **canonical release-gate list**. Other documents reference it and must not keep a -separate copy — release status included, which [docs/README.md](../README.md) owns. crew has shipped -to npm. Because npm's OIDC Trusted Publishing can only attach to a package that already -exists, the first release (`0.1.0`) was published once by hand; -from `0.1.1` on, a published GitHub Release runs `.github/workflows/publish.yml`, which -publishes via OIDC with provenance and no stored npm secret (see -[publishing.md](../release/publishing.md)). The +separate copy; the **current published version** likewise lives only in +[docs/README.md](../README.md). crew has shipped to npm. Because npm's OIDC Trusted +Publishing can only attach to a package that already exists, the first release (`0.1.0`) +was published once by hand; from `0.1.1` on, a published GitHub Release runs +`.github/workflows/publish.yml`, which publishes via OIDC with provenance and no stored +npm secret (see [publishing.md](../release/publishing.md)). The SQLite-stress and Security-review gates are closed, and the Relay-proof gate's full end-to-end test — a launch against real tmux with a fake Participant standing in for a real CLI — is in place. Every part of the remaining gates that a machine From b45381f878d0bfa110979124d59e3af93b7a18aa Mon Sep 17 00:00:00 2001 From: Igor Magdich Date: Fri, 7 Aug 2026 00:11:55 +0300 Subject: [PATCH 3/3] docs: exempt CHANGELOG from the release-status ownership rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Independent review noted the new "the current published version likewise lives only in docs/README.md" reads as absolute, while CHANGELOG.md states the latest released version as any changelog must. The two do not conflict — the rule governs release-status prose, not version history — but a future editor taking "only" literally would try to reconcile them. Says so. --- docs/design/product-spec.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/design/product-spec.md b/docs/design/product-spec.md index 4f41316..6bdfaf7 100644 --- a/docs/design/product-spec.md +++ b/docs/design/product-spec.md @@ -106,7 +106,8 @@ requires one process that stays alive for as long as the tmux session does. This is the **canonical release-gate list**. Other documents reference it and must not keep a separate copy; the **current published version** likewise lives only in -[docs/README.md](../README.md). crew has shipped to npm. Because npm's OIDC Trusted +[docs/README.md](../README.md) — `CHANGELOG.md` records version history, not release +status. crew has shipped to npm. Because npm's OIDC Trusted Publishing can only attach to a package that already exists, the first release (`0.1.0`) was published once by hand; from `0.1.1` on, a published GitHub Release runs `.github/workflows/publish.yml`, which publishes via OIDC with provenance and no stored