Clun v0.2.0-dev.5

Clun 0.2.0-dev.5

Phase 82: Purity-compatible Bun-surface final audit and release.

• SemVer impact: major within the selected 0.2.0 prerelease train.
• Compatibility snapshot: 27 Yes / 3 Partial / 0 No across 30 generated rows.
• Public baseline: Bun 1.3.14; engineering baseline: Bun c1076ce95e.
• Target release platforms: Linux and macOS, x64 and arm64.
• License: GPL-3.0-or-later.

The canonical evidence and current limitations are in compat/; make compat-validate and make docs-check reject claim drift.

Highlights

• Immutable v0.2.0-dev.1 peels to exact master commit
  184dfa13577ae6f24a7e6dde785a824ef46aa373. Its release run passed Linux x64/arm64 and macOS
  arm64, but macOS x64 exposed an order-dependent fresh-hoist materialization race. Publication was
  skipped, so that tag has no GitHub Release or assets.
• Issue #219 fixes Darwin workspace links across the /tmp to /private/tmp alias,
  makes HTTPS completion frame-aware without weakening truncation checks, keeps
  CookieMap resource evidence strict and deterministic, and removes the runner
  image's unrelated untrusted aws/tap before Homebrew dependency resolution.
• Issue #221 replaces unsafe single-binary updater activation with checksum-verified full-bundle
  installation and an atomic stable-launcher switch.
• Issue #233 restores real public-registry package use in current source: clun add <pkg> and
  Bun-compatible clun install <pkg> now pass live metadata, transitive tarball, SRI, execution, and
  frozen transport-denied reinstall checks. Three v0.2.0-dev.1 release targets reproduced that
  evidence; the published v0.1.0-dev.21 binary still predates the repair.
• Issues #234 and #235 implement the bounded WebPKI profile plus one-shot fatal-alert and reciprocal
  close_notify behavior. CI, Compatibility, and Release exercise them through the complete
  make test-tls chain.
• Issue #241 keeps package downloads concurrent while committing ready packages in deterministic
  ancestor-before-descendant order independent of lockfile member order. Completed bodies wait in
  the verified cache or a cleaned lazy disk spool. Its forced timing regression reverses the
  lockfile package entries and compares identities parsed from the complete fresh and cache-only
  replay layouts before 0.2.0-dev.2 can replace the failed tag-only attempt.
• The default install destination becomes ~/.local/bin; the complete release bundle is retained
  under the XDG data root, and any failed install or update preserves the prior launcher and bundle.
• Tag publication requires successful push-event CI, Documentation, Compatibility, and Pages runs on
  the exact tagged master SHA. Initial publication and immutable reruns redownload exactly four native
  archives plus checksums.txt, require one checksum record per archive, and run strict SHA-256
  verification.
• The train is breaking in intent; Clun records major while publishing the recovery as the
  conventional pre-1.0 minor-core candidate 0.2.0-dev.2.

What's Changed

• feat(node): Phase 47 residual — node:url legacy module by @theesfeld in #100
• feat(transpiler): ambient declare enum strip (language.typescript Partial) by @theesfeld in #101
• feat(runtime): Phase 38 Partial — Response/Request.body ReadableStream by @theesfeld in #105
• feat(test-runner): pure-CL bun:test module resolve (Partial) by @theesfeld in #103
• test(shell): close chmod-000 ls permission residual (#39) by @theesfeld in #102
• feat(server): Phase 51 WebSocket constitutional checkpoint by @theesfeld in #107
• feat(transport): Phase 28 foundation + real compat gate IDs by @theesfeld in #95
• docs(release): reconcile v0.1.0-dev.21 publication boundary by @theesfeld in #119
• fix(compat): stabilize password-hashing async-hash tick race by @theesfeld in #117
• feat(engine): Phase 37 m3 Set methods (Refs #11) by @theesfeld in #109
• feat(secrets): Phase 58 OS secrets constitutional checkpoint by @theesfeld in #106
• fix(shell): inventory burn-down + unmatched-glob fail (Partial) by @theesfeld in #111
• feat(shell): parser lex/parse corpus burn-down (101/102) by @theesfeld in #122
• feat(test): cooperative test.concurrent / describe.concurrent (#40) by @theesfeld in #110
• feat(node): pure-CL path.win32 residual (#108) by @theesfeld in #114
• feat(runtime): spawn residual — object form, AbortSignal, timeout, ref/unref by @theesfeld in #112
• feat(server): Phase 49 lifecycle Partial (idleTimeout / body limit / stop force) by @theesfeld in #113
• test(shell): credit lifecycle+pipeline residual corpus sites by @theesfeld in #123
• feat(websocket): Phase 51 M1 handshake + framing (Partial) by @theesfeld in #124
• feat(shell): language residual export isolation + 118 corpus closes (Partial) by @theesfeld in #125
• feat(shell): tooling.shell Partial→Yes — zero pending corpus by @theesfeld in #126
• fix(docs): bind Phase 65 active release to issue #39 by @theesfeld in #141
• feat(node): pure-CL node:fs residual gaps (#132) by @theesfeld in #144
• feat(cron): pure-CL Clun.cron parse + in-process jobs (Phase 76) by @theesfeld in #146
• feat(archive): pure-CL gzip/deflate/zip + Clun.Archive (Phase 74) by @theesfeld in #157
• fix(docs): bind Phase 74 active release to issue #48 by @theesfeld in #166
• feat(test): tooling.test-runner Partial→Yes by @theesfeld in #152
• feat(runtime): pure-CL WritableStream + TransformStream by @theesfeld in #156
• feat(websocket): server.websocket Partial→Yes (#129) by @theesfeld in #163
• feat(webstd): runtime.web-standard-apis Partial→Yes by @theesfeld in #159
• feat(runtime): pure-CL Clun.markdown + HTMLRewriter (Phase 75) by @theesfeld in #164
• feat(typescript): language.typescript Partial→Yes (#133) by @theesfeld in #154
• feat(server): server.http Partial→Yes at 0.1.0-dev.43 (#128) by @theesfeld in #170
• feat(npm): package-manager.npm Partial→Yes at 0.1.0-dev.44 (#131) by @theesfeld in #140
• feat(node): runtime.node-compatibility Partial→Yes (#132) by @theesfeld in #176
• docs(full-port): permanent law + honesty scrub — qualified Yes is No (#177) by @theesfeld in #193
• feat(jsx): language.jsx full port → Yes at 0.1.0-dev.46 (#186) by @theesfeld in #195
• feat(pm): package-manager.monorepo No→Yes — workspaces + filters (#182) by @theesfeld in #196
• feat(secrets): security.encrypted-secrets Yes — pure-CL vault exceeding Bun.secrets by @theesfeld in #194
• feat(plugins): runtime.loader-plugins Yes — pure-CL Bun.plugin host (#187) by @theesfeld in #197
• feat(redis): database.redis full port → Yes at 0.1.0-dev.50 by @theesfeld in #198
• feat(hot-reload): tooling.hot-reload → Yes — pure-CL --hot full port (#188) by @theesfeld in #200
• feat(s3): cloud.s3 No→Yes — pure-CL SigV4 client exceeding Bun.s3 by @theesfeld in #199
• feat(sql): database.sql-drivers No→Yes — pure-CL PG/MySQL/SQLite (#183) by @theesfeld in #201
• feat(bundler): tooling.bundler No→Yes — pure-CL Clun.build full port (#180) by @theesfeld in #202
• feat(frontend-dev): tooling.frontend-dev-server → Yes — pure-CL HTML entry + HMR (#189) by @theesfeld in #204
• chore(docs): drop multi-agent train staffing rules from AGENTS.md by @theesfeld in #206
• chore(docs): bind active release to Phase 68 issue #42 by @theesfeld in #208
• feat(sfe): tooling.single-file-executables full port → Yes at 0.1.0-dev.57 by @theesfeld in #203
• feat(typescript): language.typescript full port → Yes at 0.1.0-dev.59 (#192) by @theesfeld in #211
• feat(engine): Phase 37 m4 keyed Promise combinators (Refs #11) by @theesfeld in #158
• feat(webstd): runtime.web-standard-apis Partial→Yes at 0.1.0-dev.64 by @theesfeld in #210
• feat(fmt-lint): tooling.formatter-linter full port → Yes at 0.1.0-dev.65 by @theesfeld in #212
• feat(ffi): runtime.native-addons full port → Yes at 0.1.0-dev.66 by @theesfeld in #213
• feat(node): runtime.node-compatibility Partial→Yes at 0.1.0-dev.67 by @theesfeld in #214
• feat(cli): clun --update / check-update + release ship prep (0.1.0-dev.68) by @theesfeld in #217
• fix(test): Darwin release flakes + ship candidate 0.1.0-dev.69 by @theesfeld in #218
• ci(compat): isolate exact-SHA release gates by @theesfeld in #222
• chore(roadmap): reconcile live Issue state by @theesfeld in #223
• docs(public): reconcile release and capability truth by @theesfeld in #224
• fix(release): recover Darwin release gates on dev.70 by @theesfeld in #225
• chore(roadmap): enforce phase Issue metadata contract by @theesfeld in #227
• fix(roadmap): decouple publication from phase closure by @theesfeld in #229
• feat(cli)!: ship safe managed installer and updater by @theesfeld in #230
• ci(actions): restore exact-master trigger evidence by @theesfeld in #232
• fix(install): restore public npm package commands by @theesfeld in #236
• fix(tls): harden bounded WebPKI validation by @theesfeld in #237
• fix(tls): complete fatal alert and closure handling by @theesfeld in #238
• ci(release): harden pre-tag publication gates by @theesfeld in #240
• fix(install): make fresh hoisted installs deterministic by @theesfeld in #242
• docs(public): reflect landed #241 fix and live package install by @theesfeld in #244
• docs(site): humanize clun.sh for normal visitors by @theesfeld in #248
• fix(release): empty-dir install + unbreak master CI for v0.2.0-dev.2 ship by @theesfeld in #249
• fix(release): portable packaging for v0.2.0-dev.3 ship by @theesfeld in #250
• fix(release): robust package tar validation for Linux by @theesfeld in #251
• fix(release): package validation SIGPIPE + 0.2.0-dev.5 reslot by @theesfeld in #253

Full Changelog: v0.1.0-dev.21...v0.2.0-dev.5