From 5368efd20773bd4a75d59e22ad41d8c84e6ca4f3 Mon Sep 17 00:00:00 2001 From: Chang Chia Wei Date: Fri, 21 Aug 2026 20:12:19 +0800 Subject: [PATCH] chore: prepare v0.1.0 public release --- .github/ISSUE_TEMPLATE/config.yml | 8 +++++++ .github/workflows/release.yml | 23 +++++++++++++++++-- CHANGELOG.md | 32 ++++++++++++++------------- README.md | 25 +++++++++++---------- SECURITY.md | 9 +++++--- SUPPORT.md | 23 +++++++++++++++++++ python/README.md | 20 +++++++++++++++-- python/pyproject.toml | 2 ++ scripts/tests/test_public_boundary.py | 13 +++++++++++ scripts/verify_public_boundary.py | 1 + typescript/README.md | 8 +++++++ typescript/package.json | 1 + 12 files changed, 131 insertions(+), 34 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 SUPPORT.md diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..2b56147 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: Questions and integration help + url: https://github.com/kevindechang/affect-kernel/discussions + about: Ask usage questions and discuss adapter or domain design. + - name: Report a security vulnerability + url: https://github.com/kevindechang/affect-kernel/security/advisories/new + about: Report vulnerabilities privately; do not open a public issue. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3ff6b6b..cd3c30a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,7 +1,8 @@ name: Release -# Publishes both runtimes from one tag. The full check suite must pass first, so -# a tag can never publish something CI would have rejected. +# Publishes both runtimes and GitHub release notes from one tag. The full check +# suite must pass first, so a tag can never publish something CI would have +# rejected. on: push: tags: ["v*"] @@ -96,3 +97,21 @@ jobs: - run: npm publish ./typescript --provenance --access public env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + + github-release: + needs: [pypi, npm] + if: startsWith(github.ref, 'refs/tags/v') + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: write + steps: + - name: Publish generated release notes + env: + GH_TOKEN: ${{ github.token }} + run: >- + gh release create "$GITHUB_REF_NAME" + --repo "$GITHUB_REPOSITORY" + --verify-tag + --generate-notes + --title "$GITHUB_REF_NAME" diff --git a/CHANGELOG.md b/CHANGELOG.md index 88ccd39..b8296b3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,19 @@ to a pinned vector is called out here. ## [Unreleased] -### Added +No changes yet. + +## [0.1.0] - 2026-08-21 + +First public release: the deterministic kernel extracted from +[Anjo](https://anjo.love) and generalized beyond conversation. + +The repository was briefly public as `anjo-core` before this release and was +renamed to `affect-kernel` to name the library by what it does rather than by +the application it came from. No version was ever tagged or published under the +old name, so no installed artifact is affected. + +### Evaluation and hardening - `AffectDynamics` and `RetrievalWeights`: the numeric coefficients are now caller-owned data, on the same principle that already made stage names, @@ -41,14 +53,14 @@ to a pinned vector is called out here. carries signal and that mood congruence is worth +0.012 MRR in a regime built to favour it. -### Fixed +### Corrected claims - Retracted a claim in `docs/foundations.md` and in the `recency_weight` docstring that linear-to-a-floor recency was "the least defensible" curve in the module. At a matched 30-day half-life it out-ranks both the exponential and the power-law curve. -### Changed +### Breaking pre-release changes - **Breaking (pre-release):** `CompanionState` is now `AffectState` and `CompanionEngine` is `AffectEngine`, in both runtimes, along with @@ -69,17 +81,7 @@ to a pinned vector is called out here. (`x1.10` negative, `x1.04` positive above `|v| >= 0.20`), which was implemented but undocumented. -## [0.1.0] - -First public release: the deterministic kernel extracted from -[Anjo](https://anjo.love) and generalized beyond conversation. - -The repository was briefly public as `anjo-core` before this release and was -renamed to `affect-kernel` to name the library by what it does rather than by -the application it came from. No version was ever tagged or published under the -old name, so no installed artifact is affected. - -### Added +### Initial public surface - Behaviorally aligned Python and TypeScript kernels with no runtime dependencies, both published as `affect-kernel`. @@ -108,7 +110,7 @@ old name, so no installed artifact is affected. - Public-boundary verification, pinned Gitleaks history scan, and reproducible packaging checks. -### Fixed +### Pre-release fixes - `FrozenMapping` is picklable. The default `dict` pickle protocol restores items by mutating a fresh instance, which the class refuses, so every state diff --git a/README.md b/README.md index 5fe9c13..77a8e2a 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ # Affect Kernel [![CI](https://github.com/kevindechang/affect-kernel/actions/workflows/ci.yml/badge.svg)](https://github.com/kevindechang/affect-kernel/actions/workflows/ci.yml) +[![PyPI](https://img.shields.io/pypi/v/affect-kernel.svg)](https://pypi.org/project/affect-kernel/) +[![npm](https://img.shields.io/npm/v/affect-kernel.svg)](https://www.npmjs.com/package/affect-kernel) [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE) [![Python](https://img.shields.io/badge/python-3.11%2B-blue.svg)](python/) [![Node](https://img.shields.io/badge/node-20%2B-blue.svg)](typescript/) @@ -119,22 +121,21 @@ before quoting any of this. ## Install -Neither runtime has a production dependency. Install from a checkout: +Both packages have zero runtime dependencies: ```bash -# Python 3.11+ -python -m venv .venv && source .venv/bin/activate -python -m pip install -e "./python[dev]" -pytest python/tests - -# Node.js 20+ -npm ci --prefix typescript -npm test --prefix typescript +python -m pip install affect-kernel # import affect_kernel +npm install affect-kernel ``` -> Registry releases are not published yet. Once `v0.1.0` is tagged, the -> [release workflow](.github/workflows/release.yml) publishes `affect-kernel` to PyPI -> via trusted publishing and `affect-kernel` to npm with provenance. +For a contributor checkout: + +```bash +git clone https://github.com/kevindechang/affect-kernel.git +cd affect-kernel +./scripts/setup.sh +./scripts/check.sh +``` ## Core contracts diff --git a/SECURITY.md b/SECURITY.md index 7569a61..6ae42c1 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,8 +2,12 @@ ## Supported versions -Until the first stable release, security fixes are applied to the latest commit -on `main`. +Security fixes are applied to the latest `0.1.x` release and to `main`. + +| Version | Supported | +|---|---| +| `0.1.x` | Yes | +| `< 0.1` | No | ## Reporting a vulnerability @@ -29,4 +33,3 @@ adapters belong to the application integrating them. This project will still accept reports about unsafe defaults, state-boundary violations, prompt injection across adapter boundaries, data leakage in examples/tests, and dependency or packaging vulnerabilities. - diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 0000000..e968e11 --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,23 @@ +# Support + +## Questions and integration help + +Use [GitHub Discussions](https://github.com/kevindechang/affect-kernel/discussions) +for usage questions, adapter design, and ideas that are not yet concrete feature +requests. Include your runtime and package version, and reduce examples to +synthetic data. + +## Bugs and feature proposals + +Use the repository's structured issue forms for reproducible bugs and broadly +reusable feature proposals. Search existing issues first. Real conversation +data, credentials, proprietary prompts, and production configuration do not +belong in an issue or discussion. + +## Security reports + +Follow [SECURITY.md](SECURITY.md) and use GitHub private vulnerability reporting. +Do not disclose a vulnerability in a public issue or discussion. + +This is a single-maintainer project. Expect a first response within about a +week; changes to the parity contract can take longer to review. diff --git a/python/README.md b/python/README.md index 51cc217..0921979 100644 --- a/python/README.md +++ b/python/README.md @@ -1,8 +1,24 @@ # affect-kernel for Python This directory contains the zero-runtime-dependency Python implementation of the -deterministic affect-state kernel for long-lived AI characters. Install it with -`python -m pip install -e .`; run its tests with `python -m pytest`. +deterministic affect-state kernel for long-lived AI characters. + +```bash +python -m pip install affect-kernel +``` + +```python +from affect_kernel import AffectState, appraise_turn + +state = AffectState() +result = appraise_turn(state, "CURIOSITY") +print(result.state.mood) +``` + +The [repository README](https://github.com/kevindechang/affect-kernel#readme) +contains runnable headless examples, benchmark results, limitations, and the +cross-runtime contract. From a source checkout, run `./scripts/setup.sh` and +`./scripts/check.sh` at the repository root. The package deliberately leaves model inference, persistence, and retrieval I/O behind injected protocols. Its cross-runtime guarantee covers deterministic, diff --git a/python/pyproject.toml b/python/pyproject.toml index 5eb383c..f0d8bb9 100644 --- a/python/pyproject.toml +++ b/python/pyproject.toml @@ -38,6 +38,8 @@ dependencies = [] Homepage = "https://github.com/kevindechang/affect-kernel" Repository = "https://github.com/kevindechang/affect-kernel" Issues = "https://github.com/kevindechang/affect-kernel/issues" +Changelog = "https://github.com/kevindechang/affect-kernel/blob/main/CHANGELOG.md" +Documentation = "https://github.com/kevindechang/affect-kernel/tree/main/docs" [project.optional-dependencies] dev = [ diff --git a/scripts/tests/test_public_boundary.py b/scripts/tests/test_public_boundary.py index f3ee982..c5152fd 100644 --- a/scripts/tests/test_public_boundary.py +++ b/scripts/tests/test_public_boundary.py @@ -116,6 +116,19 @@ def test_boundary_rejects_binary_payload_in_an_allowed_directory( assert any("binary file is not allowed" in error for error in errors) +def test_boundary_allows_reviewed_support_policy( + tmp_path: Path, + fixture: dict[str, Any], + continuity_fixture: dict[str, Any], +) -> None: + _write_minimal_candidate(tmp_path, fixture, continuity_fixture) + (tmp_path / "SUPPORT.md").write_text("# Support\n", encoding="utf-8") + + errors = verify(tmp_path) + + assert not any("unexpected top-level entries" in error for error in errors) + + def test_boundary_scans_force_tracked_ignored_paths( tmp_path: Path, fixture: dict[str, Any], diff --git a/scripts/verify_public_boundary.py b/scripts/verify_public_boundary.py index b902f5d..e624cad 100755 --- a/scripts/verify_public_boundary.py +++ b/scripts/verify_public_boundary.py @@ -33,6 +33,7 @@ "README.md", "ROADMAP.md", "SECURITY.md", + "SUPPORT.md", "bench", "docs", "examples", diff --git a/typescript/README.md b/typescript/README.md index dee4b66..32ec069 100644 --- a/typescript/README.md +++ b/typescript/README.md @@ -5,6 +5,14 @@ characters. It provides deterministic affect, appraisal, memory scoring, presenc surfacing, and an engine with injected model, appraisal, storage, and retrieval adapters. Application instructions and prompt wording remain caller-owned. +```sh +npm install affect-kernel +``` + +The [repository README](https://github.com/kevindechang/affect-kernel#readme) +contains runnable headless examples, benchmark results, limitations, and the +cross-runtime contract. + The engine runtime-validates unknown gate output, normalizes built-in or explicitly registered custom intents, and propagates gate errors unless `gateFallback` is supplied. `AppraisalPolicy` is a synchronous injection seam; `DEFAULT_APPRAISAL_POLICY` preserves diff --git a/typescript/package.json b/typescript/package.json index 74a5570..7a20e1d 100644 --- a/typescript/package.json +++ b/typescript/package.json @@ -2,6 +2,7 @@ "name": "affect-kernel", "version": "0.1.0", "description": "Deterministic affect-state kernel for long-lived AI characters, model-agnostic", + "author": "Chang Chia Wei", "keywords": [ "affect", "appraisal",