Repository navigation
Promote the qualified 0.1.7 candidate to main and publish #228
Description
Parent
Part of #147. This is the final Phase 0 / 0.1.7 publication gate.
What to build
After the user accepts the qualified dev build, promote the exact approved 0.1.7 tree to main and publish it without adding feature or refactor deltas. Produce the release tag, artifacts, release notes, integrity evidence, and rollback pointer from the already-qualified source tree.
Acceptance criteria
- User acceptance of the dev build and the qualified candidate SHA is recorded before promotion.
-
main, the release tag, source archive, application artifacts, and version metadata resolve to the exact already-qualified source tree; any unavoidable release-only metadata is reproducible and explicitly audited. - No product behavior, dependency, protocol, provider, or client change is introduced between qualification and publication.
- Published release notes lead with the model-access-console positioning and describe the 0.1.7 stability outcomes, supported clients/routes, known limits, and rollback path.
- Artifact checksums and required signing/notarization results are retained with the release evidence.
- The 0.1.7 milestone is retired only after the published artifacts and release page are durably readable.
Activity
NOirBRight commentedon Jul 25, 2026
{ "contract": { "acceptance": [ "Explicit user acceptance identifies the exact #227 candidate before main, tag, release, or milestone state changes occur.", "The promoted main tree and tag v0.1.7 are byte-identical to the accepted candidate tree, with no release-time behavior or dependency delta.", "The release contains exactly the normal installer, debug installer, both signature files, portable archive, latest.json, and latest-debug.json for version 0.1.7, and every manifest/source field resolves to the accepted tree.", "Updater signatures and artifact SHA-256 checksums verify after upload, and a clean readback confirms every asset is durably downloadable.", "Release notes lead with CodexHub as a model-access console that is stable, visible, and reversible; they truthfully state qualified routes, supported clients, known limits, upgrade path, and rollback pointer.", "The GitHub Release is public, non-draft, non-prerelease, named CodexHub 0.1.7, and bound to tag v0.1.7 only after all integrity checks pass.", "Issue #228 and the 0.1.7 milestone are closed only after main, tag, release body, and all seven assets pass durable readback." ], "change_claims": { "paths": [], "resources": [ "main-integration-branch", "tag-v0.1.7", "github-release-v0.1.7", "0.1.7-normal-installer", "0.1.7-debug-installer", "0.1.7-updater-manifests", "0.1.7-portable-archive", "0.1.7-milestone" ] }, "dependencies": { "dispatch_after": [ 227 ], "merge_after": [ 227 ] }, "design": [ "Begin only after #227 has delivered an exact qualified dev candidate and the user has explicitly accepted that build. Record the accepted source SHA, source tree, dev artifact identity, and pre-release main rollback SHA before any publication mutation.", "Promote the accepted tree to main without adding or regenerating product, dependency, provider, client, protocol, version, or documentation changes. If the integration mechanism creates a different commit object, prove its source tree is byte-identical to the accepted candidate before continuing.", "Create immutable tag v0.1.7 on the promoted tree and produce the normal installer, debug installer, their updater signatures, the portable archive, latest.json, and latest-debug.json from that exact source. Every artifact and manifest records version 0.1.7 and the accepted source identity.", "Publish one non-prerelease GitHub Release named CodexHub 0.1.7. Its notes begin with the model-access-console positioning, summarize qualified Official and Ollama Cloud Native Responses paths and supported clients, state known limits, and provide the rollback pointer.", "Retain artifact SHA-256 checksums, updater signature validation, manifest readback, release/tag/main readback, and source-tree comparison as sanitized durable evidence. Never expose signing keys, credentials, absolute build-host paths, or private environment state.", "After durable readback, close the publication ticket and retire the 0.1.7 milestone only when all release assets are accessible. Do not admit Phase 1 implementation into this publication transaction." ], "difficulty": "heavy", "done_when": [ "The accepted #227 candidate SHA/tree and explicit user acceptance are durably recorded.", "The complete candidate-to-main diff and source-tree identity audit prove no publication-time product delta.", "Normal and debug release builds, updater manifest validation, signature validation, portable packaging, and artifact checksum generation pass from the accepted tree.", "Main, tag v0.1.7, release metadata, release notes, and all seven release assets are published once and read back successfully.", "Downloaded manifests, signatures, and SHA-256 checksums verify against the published assets without exposing secrets or host paths.", "The prior main SHA and v0.1.6 release remain the documented rollback pointer.", "Only after durable publication readback, Issue #228 and the 0.1.7 milestone are closed." ], "priority": "P1", "risk": "strict", "sha256": "730a37db41dee21a18310343479934202ff26a50d0bf70bd30d65d41131c9ebc", "unresolved_decisions": [] }, "dispatch": null }NOirBRight commentedon Jul 26, 2026
Pre-publication read-only asset audit
This is preparatory evidence only. It does not accept #227, mutate
main, createv0.1.7, or publish assets.The current public v0.1.6 release establishes the seven-asset release shape required by this contract:
CodexHub_0.1.6_x64-setup.exeCodexHub_0.1.6_x64-setup.exe.sigCodexHub_0.1.6_debug_x64-setup.exeCodexHub_0.1.6_debug_x64-setup.exe.sigCodexHub_0.1.6_portable_<source-prefix>.ziplatest.jsonlatest-debug.jsonAll seven current assets have GitHub-side SHA-256 digests and durable download URLs. The v0.1.7 publication must preserve this shape with version/source identity updated to the accepted #227 tree.
build-windows-portable.ps1can produce both normal and debug portable archives. The contract intentionally requires one public portable archive: the normal flavor. The debug flavor remains represented by the debug installer, signature, andlatest-debug.json; a debug portable must not be silently added as an eighth release asset.The current release target is a full commit SHA. #228 must likewise prove the promoted
maintree, tag, manifests, archive source prefix, and accepted #227 tree are identical before publication.NOirBRight commentedon Jul 29, 2026
Publication transaction started
User acceptance is recorded in closed #227. Accepted tree:
c103fd5faa20da9318c9a545c6c02ab78b359d14. Pre-release rollback pointer: main commitcc9df197a709fb4c7548021819ecb8fa716ed664/ releasev0.1.6. No release-time source delta is permitted.NOirBRight commentedon Jul 29, 2026
0.1.7 publication is complete.
1469577783292f5a3891609e982469d3a37ef21ec103fd5faa20da9318c9a545c6c02ab78b359d14(identical to the accepted candidate tree)v0.1.7, dereferences to the published source commitcc9df197a709fb4c7548021819ecb8fa716ed664/ prior signedv0.1.6release.No product, dependency, protocol, provider, or client delta was introduced after qualification.