[SDK 0.1.0] Ship a secure read-only OpenCoven SDK

[BunsDev]

Outcome

Ship the first public OpenCoven SDK as a coherent, identity-preserving read-only protocol release. A separately installed client must be able to discover the owner-local Cave and Coven authorities, verify compatibility, obtain a user-approved Cave credential, securely retain it, and read only the canonical state it was granted.

Why this is the release boundary

The repository has mature package boundaries, operation controls, package verification, stress/property tests, and a fail-closed release system. The remaining gap is the end-to-end developer journey: the release machinery is ahead of the public protocol surface and its real-consumer proof.

The first release establishes recognition and authorized observation before action. Message sends, streaming, attachments, task handoffs, and privileged GitHub mutations follow in separately reviewed authority milestones.

Included in 0.1.0

• Cave and Coven discovery
• compatibility health and minimum-client negotiation
• Cave pairing, consent, credential custody, status, and local forget
• owner-local Coven health with live peer/pipe identity validation
• canonical Cave familiars, projects, conversations, and messages
• explicit bounded pagination and reconciliation behavior
• deterministic, secret-safe CLI diagnostics and supported read commands, or an explicit decision to defer the CLI package
• non-secret profiles, redacted diagnostics, and public API governance
• packed-package consumer integration
• cross-repository real-authority conformance
• first-release security disposition
• trusted npm publishing, provenance, and registry validation

Explicitly excluded from 0.1.0

• message send, stop, retry, or stream
• conversation writes
• attachments
• task handoffs
• GitHub mutations
• speculative revision APIs
• arbitrary HTTP or private-route escape hatches
• offline mutation queues

Critical path

#32 roadmap/release-scope reconciliation
  ├─ OpenCoven/coven-cave#4869 operational capability truth
  └─ #33 source-locked Cave contract + compatibility health
       └─ #34 secure Cave discovery
            └─ #35 pairing + secure credential custody
                 ├─ #36 canonical reads + bounded pagination
                 └─ #37 CLI scope + native trust boundaries
                      └─ OpenCoven/chat#27 packed consumer/native integration
                           └─ #38 real-authority conformance

#35 + #36 ──> #39 profiles/diagnostics/API governance
#38 + #39 ──> #40 first-release security ship/block disposition
#40 ──> #41 release execution + registry/provenance validation
#41 ──> close this program

Execution checklist

Contract and release truth

• [SDK 0.1.0][P0] Reconcile roadmap, contract truth, and public release scope #32 — Reconcile roadmap, contract truth, and public release scope
• [Client v1][SDK 0.1.0 blocker] Make capability declarations operationally truthful coven-cave#4869 — Make capability declarations operationally truthful
• [SDK 0.1.0][P0] Source-lock the Cave Client v1 contract and correct compatibility health #33 — Source-lock the Cave Client v1 contract and correct compatibility health

Protocol implementation

• [SDK 0.1.0][P0] Implement secure Cave discovery and compatibility negotiation #34 — Implement secure Cave discovery and compatibility negotiation
• [SDK 0.1.0][P0] Implement Cave pairing and secure credential custody #35 — Implement Cave pairing and secure credential custody
• [SDK 0.1.0][P0] Implement canonical Cave reads and bounded pagination #36 — Implement canonical Cave reads and bounded pagination
• [SDK 0.1.0][P0] Resolve CLI scope and implement native trust boundaries #37 — Defer the private CLI from 0.1 and assign Phase 1 native trust adapters to Chat

Real consumer and evidence

• [SDK 0.1.0 blocker] Integrate the packed SDK through Chat’s native trust boundary chat#27 — Integrate the packed SDK through Chat’s native trust boundary
• [SDK 0.1.0][P0] Prove the packed SDK with cross-repository real-authority conformance #38 — Prove the packed SDK with cross-repository real-authority conformance
• [SDK 0.1.0][P1] Add non-secret profiles, redacted diagnostics, and public API governance #39 — Add non-secret profiles, redacted diagnostics, and public API governance

Release gates

• [SDK 0.1.0][P0] Complete the first-release security review and ship/block disposition #40 — Complete the first-release security review and ship/block disposition
• [SDK 0.1.0][P0] Execute the first public release and validate registry provenance #41 — Execute the first public release and validate registry provenance

Post-0.1 roadmap

• [SDK post-0.1] Ship conversational control: create, send, stream, stop, retry, reconcile #42 — Conversational control: create, send, stream, stop, retry, reconcile
• [SDK post-0.1] Ship rich content, attachments, and explicitly confirmed privileged actions #43 — Rich content, attachments, and explicitly confirmed privileged actions
• [SDK post-0.1] Ship encrypted offline reads and advanced developer tooling #44 — Encrypted offline reads and advanced developer tooling

Parallel non-blocking maintenance

• [SDK maintenance] Audit and safely retire superseded branches, worktrees, and stash state #45 — Audit and safely retire superseded branches, worktrees, and stash state

#45 does not block 0.1.0 unless it discovers unique release-relevant work, provenance ambiguity, dirty canonical state, or verification interference.

Program rules

1. Every child issue names dependencies, blockers, non-goals, acceptance criteria, and validation evidence.
2. No issue closes on unit-test proxies alone when the behavior requires a live authority, live native trust adapter, or packed consumer.
3. No capability is considered shipped merely because it appears in a roadmap or fixture.
4. No credential, pairing secret, bearer, prompt, attachment content, socket handle, daemon output, or unsafe transport cause may enter diagnostics or retained evidence.
5. No ambiguous mutation completion may be automatically replayed.
6. Publication remains locked until every required child gate closes.
7. External mutations in [SDK 0.1.0][P0] Execute the first public release and validate registry provenance #41 require fresh explicit authorization at execution time.

Completion definition

This issue closes only when:

• every 0.1.0 checklist item above is complete;
• the exact released artifacts have a passing real-authority record;
• the security review recommends ship;
• registry bytes and provenance match the reviewed release manifest;
• ordinary future publishing uses protected OIDC with no token fallback;
• root/package documentation points to the released supported surface and its known limitations.

Plan of record

The repository roadmap/design and dependency graph are maintained by the planning PR associated with #32. Release execution evidence belongs in #41 and is linked here before closure.

[BunsDev]

The program now has three planning PRs ready for review:

• docs: establish the SDK 0.1 delivery program #46 — SDK 0.1 release design, dependency graph, roadmap, and README update
• docs: reconcile historical SDK plans with merged evidence #47 — historical plan reconciliation and active/historical plan index
• docs: plan the packed SDK consumer and conformance boundary chat#28 — packed SDK consumer, native trust, lifecycle, and conformance execution plan

Upstream capability truth remains tracked in OpenCoven/coven-cave#4869. No implementation or publication gate is considered complete merely because these planning PRs exist.

[BunsDev]

Cave’s upstream capability work now also has an executable planning PR: OpenCoven/coven-cave#4873. The full planning set is therefore:

• SDK docs: establish the SDK 0.1 delivery program #46 — 0.1 design, delivery program, roadmap, README
• SDK docs: reconcile historical SDK plans with merged evidence #47 — historical plan reconciliation
• Cave #4873 — operational Client v1 capability semantics
• Chat chore: construct SDK Beads backlog #28 — packed consumer, native trust, lifecycle, and conformance plan

SDK #46, #47, and Chat #28 have completed CI successfully. Cave #4873 is mergeable with its protected-repository CI queued.

[BunsDev]

Program milestone: canonical reads complete

The #36 canonical-read milestone is complete and merged through PR #55 at d7f9e69378d6136c2771f60b4c57d7beeaa74f6a.

Evidence includes 1,028 passing tests, packed-tarball consumer verification, strict producer fixture provenance from OpenCoven/coven-cave#5007, successful required PR checks, and successful post-merge CI and CodeQL on the exact merge.

The dependency-first critical path now advances to #37, followed by OpenCoven/chat#27 and #38. The discovery/request atomic-binding limitation remains explicitly tracked in OpenCoven/coven-cave#4996.

[BunsDev]

SDK #37 is complete. PR #57 merged the four-package 0.1 release inventory and private CLI decision as 11952ee4a20cf6d0744c9040b568715708a1e81f; PR #58 merged final plan/Bead evidence as b9bc75936cd328d7951fc1b73798b9b0a1db2e88. The reviewed head is archived at archive/2026-08-25/pr-57-cli-release-scope. Next critical-path ownership is Chat #27 for Tauri native trust and exact packed-library integration.

[BunsDev]

Release gate update: security disposition is BLOCK

The first-release review is recorded in #40 against exact SDK main commit 47a9e1415480ce2b3265a69ef9a75c52b5427057. The release-workflow injection found during review was fixed and verified through #67.

Publication remains blocked by:

• OpenCoven/coven-cave#4996: atomic request-to-Cave-instance binding;
• OpenCoven/chat#27 and [SDK 0.1.0][P0] Prove the packed SDK with cross-repository real-authority conformance #38: supported-platform packed native-trust and real-authority evidence;
• the absent protected npm-release GitHub environment and reviewer rules.

Repository locks remain closed. No release credentials, environment, tag, or publication action is authorized by this update.

[BunsDev]

Release candidate update

PR #68 merged as a86773cb6ba45084495c00ca364f8646865f1606, adding the packed browser-safe managed-native Cave boundary needed by Chat. Exact-head canonical verification, post-merge CI/security analysis, dependency/secret scans, and a focused security review passed with no new findings.

The #40 BLOCK recommendation now covers this current main revision. Remaining blockers are unchanged: OpenCoven/coven-cave#4996, OpenCoven/chat#27 / #38 real-authority evidence, and the absent protected npm-release environment.

[BunsDev]

Comprehensive open-issue audit update:

• [SDK 0.1.0][P0] Implement Cave pairing and secure credential custody #35 and [SDK 0.1.0 blocker] Integrate the packed SDK through Chat’s native trust boundary chat#27 are complete and the SDK roadmap/tracker reconciliation merged in docs: reconcile release issue status #75 (66edd4d).
• [SDK 0.1.0][P0] Prove the packed SDK with cross-repository real-authority conformance #38 now has a newly hardened passing Darwin run: OpenCoven/chat Actions 33321117493 at 3fd0ed7322c26509eef3a8d77ec87130b9862be8 (46 SDK assertions, 41 Chat assertions). It remains open for genuine linux-x64 and win32-x64 records.
• [SDK 0.1.0][P0] Complete the first-release security review and ship/block disposition #40 remains BLOCK pending the complete [SDK 0.1.0][P0] Prove the packed SDK with cross-repository real-authority conformance #38 matrix and a fresh exact-candidate review.
• [SDK 0.1.0][P0] Execute the first public release and validate registry provenance #41 remains blocked by [SDK 0.1.0][P0] Complete the first-release security review and ship/block disposition #40 and still requires explicit authorization before any tag, publishing unlock, npm bootstrap, trusted-publisher registration, or publication.
• [SDK post-0.1] Ship conversational control: create, send, stream, stop, retry, reconcile #42, [SDK post-0.1] Ship rich content, attachments, and explicitly confirmed privileged actions #43, and [SDK post-0.1] Ship encrypted offline reads and advanced developer tooling #44 remain correctly blocked post-0.1 milestones with unmet upstream contracts.

No release mutation was performed. No currently open SDK issue meets its closure criteria yet.

[BunsDev]

SDK maintenance checkpoint: cleanup and freeze-neutral repair

#167 merged as ede4701e1a8105d4f0d2b8f915424a69c2f4d721, extracting the existing publication-fixture correction from #153 without any dependency upgrades. Original authorship and the signed pre-squash checkpoint were preserved. Both required verify jobs and both required analyses passed on the exact head; the actual production identity verifier also accepts the merged source against frozen candidate acc38488f00860d246c3c553375634d64806eabb. Runtime identity remains 1cf387f4f53f456c87a51ab09ab68f7ff7291480f9a7cd3a4fe3bb70f907e56a. No production guard, package source, credential store, release environment, or acceptance criterion was changed.

All open SDK issues and dependency PRs were reviewed. Current dispositions:

Work	Disposition
#38	Still requires accepted three-platform real-authority evidence. The active conformance continuation owns platform repairs, authority rebinding, and its protected dispatch; this maintenance pass did not launch a competing run or claim an aggregate.
#40	Remains BLOCK pending accepted conformance and the required exact-candidate ship/block disposition.
#41	Remains gated by the security disposition and fresh explicit authorization for external release mutations. No tag, publishing unlock, trusted-publisher setup, or publication was performed.
#42 and #44	Remain post-release milestones gated by #41 and their upstream contracts.
#43	Remains dependent on #42 and explicit privileged-action authority.
#80	The immutable artifact canary is already landed through #106. Live APIs remain gated by upstream protocol/certification work; OpenCoven/coven#855 and OpenCoven/coven#858 are still open.
#153	Fixture repair is now separated and merged; dependency upgrades remain deferred. The real identity guard includes every root devDependency and essentially the full lockfile, so reverting esbuild alone is insufficient. The original Copilot CI approval gate was not bypassed.
#154 and #155	Both exact heads fail the unchanged frozen-source identity guard. Their protocol/native major upgrades require a lifted freeze or an explicitly approved and qualified replacement candidate, not weakened version assertions.

The umbrella remains open and its unmet acceptance boxes remain unchecked. No other issue was closed on unit-test or fixture evidence alone.

Local cleanup retired 10 stale SDK worktrees and 10 local branches using exact merge evidence, original-history bundles, and non-forced deletion. My temporary repair checkout and its branch were also removed after archival. At 2026-09-09T10:29:19.862Z, 10 registered SDK worktrees and 12 local branches remained; two new active conformance worktrees/branches appeared during the pass and were intentionally preserved. The two dirty worktrees, two unresolved branches, independent dependency clones, and non-Git operator scratch remain protected. Recovery bundles and machine-readable reports remain local; no private backup contents were uploaded.

[BunsDev]

SDK merge-through checkpoint

The requested dependency PRs and the related runtime follow-up are now on main:

PR	Result	Merge
#153	Development-tool updates, landed by the parallel continuation	ede83ee9454cbe1ebf17663c999a5be4afcb87c8
#154	canonicalize 4, landed by the parallel continuation	827aef4be9c504f632f5d6022833c373a14cf9ef
#155	keyring 2 and aligned package contracts, landed by the parallel continuation	6526b56b30c9a9c1c072caf2f0022d3427ae18db
#174	Correct native false/absent deletion outcomes, provider-fault coverage, native OS coverage, and authenticated JCS Unicode regressions	ffe2a8b59f0d0555824d7d12b82e3cd649229475

All review-conversation pages for these four PRs are accounted for; no unresolved threads remain. The completed follow-up review recommended approval and generated no findings. The exact follow-up head passed all required checks and the Linux/macOS/Windows native jobs; post-merge CI run 34349217182 also passed. The final SDK queue inspection found 0 open PRs.

The follow-up fixed a real issue beyond version assertions: the adapter discarded keyring 2's boolean deletion result, incorrectly returning deleted when an entry vanished after its read. It now returns false/absent while preserving redacted backend failures. Canonicalize 3 accepted both malformed surrogate cases; canonicalize 4 rejects them through the existing bounded SDK error and still accepts a valid surrogate pair. No Cave runtime or release guard was relaxed.

Release boundary remains separate. These are development-main changes, not qualification of the frozen candidate acc38488f00860d246c3c553375634d64806eabb. Root package/lock bytes are also validator-bound; old frozen evidence must not silently qualify the upgraded dependency graph. Publishing/source/validator guards remain intact, and no release authorization, tag, credential, protected variable, or publication action was performed. This update does not close the release umbrella or its unmet release gates.

The owned temporary checkout and both owned local branches were removed without force after preserving their complete history in a verified local recovery bundle. Other active, dirty, and unresolved work was left untouched.

[BunsDev]

The replacement-candidate independent security review is now recorded at #40 (comment). It covers package candidate6526b56, SDK validatorba4b8c8 and Chat producer6ab87e1, including the exact paired Windows image/Visual Studio policy. No high-confidence exploitable vulnerabilities were found; public runtime and frozen artifact identities remain unchanged. Overall recommendation is BLOCK pending accepted #38 native/attested aggregate evidence; #40 remains open for that final disposition and #41 is not authorized by this review.