[SDK 0.1.0][P0] Execute the first public release and validate registry provenance

[BunsDev]

Parent: #31

Blocked by:

• [SDK 0.1.0][P0] Complete the first-release security review and ship/block disposition #40

Outcome

Execute the separately authorized first public SDK release through the repository’s existing fail-closed two-key release system, then prove that npm registry state, GitHub attestations, and clean consumer installs match the reviewed artifacts exactly.

External mutation warning

This issue contains irreversible or externally visible actions: publication unlock, tag creation, npm package bootstrap, trusted-publisher configuration, and public registry records. Each mutation requires fresh explicit maintainer authorization when executed. Creating or assigning this issue is not authorization to publish.

Required sequence

1. Release authorization

Record:

• approve or defer;
• exact fixed-group version;
• exact package set, including the decision from [SDK 0.1.0][P0] Resolve CLI scope and implement native trust boundaries #37 about @opencoven/dev-cli;
• supported Node/OS/architecture matrix;
• launch criteria and rollback owner.

2. Governance prerequisites

Confirm with evidence:

• npm organization/package-name readiness;
• maintainer accounts and required 2FA;
• least-privilege one-time bootstrap owner;
• protected npm-release GitHub environment and reviewers;
• required checks and branch-protection decision;
• no token fallback in normal publishing.

3. Reviewed unlock/version PR

• version the exact approved fixed group through Changesets;
• update changelogs and workspace-exact internal ranges;
• open repository publication locks deliberately;
• preserve protected-environment and OIDC requirements;
• pass canonical verification in a clean checkout;
• merge through review, not direct push.

4. No-publish rehearsal

• create the annotated sdk-v<version> tag at the exact reviewed commit;
• run release workflow verify mode;
• retain five-or-approved-count tarballs, manifest, checksums, and attestations;
• prove registry state is unchanged;
• compare all artifact digests with the reviewed candidate.

5. One-time bootstrap

• publish exact reviewed tarballs in canonical dependency order with an explicitly approved least-privilege credential;
• store no token in repository files, GitHub secrets for future use, workflow logs, argv, or shell history;
• revoke the credential immediately after bootstrap;
• record the audit trail and registry ownership.

6. Trusted publishing

Bind every released package to:

• OpenCoven/sdk;
• the exact release workflow identity;
• the protected npm-release environment;
• OIDC only, with no NPM_TOKEN or NODE_AUTH_TOKEN fallback.

7. Registry/provenance validation

Verify:

• versions and latest dist-tags;
• manifests, licenses, changelogs, exports, binaries, and internal ranges;
• registry tarball SHA-256 values against release manifest;
• npm provenance and GitHub attestations;
• clean ESM/type imports from blank consumers;
• global CLI behavior if released;
• future OIDC-only publication path.

Dependencies

• Explicit ship disposition: [SDK 0.1.0][P0] Complete the first-release security review and ship/block disposition #40
• Existing release-readiness mechanism and policies
• Fresh maintainer authorization for each external mutation

Blockers

• Any blocking security finding
• Missing supported-platform evidence
• Placeholder CLI still included without an explicit ship/defer decision
• Unprotected release environment or unavailable OIDC trusted publishing
• Package-name/ownership conflict
• Artifact or manifest digest mismatch

Acceptance criteria

• Authorization names version, package set, platforms, and launch criteria.
• Repository and deployment locks require independent reviewed approvals.
• Rehearsal artifacts exactly match the reviewed release candidate.
• One-time bootstrap credential is revoked and absent from retained systems.
• Every published package has the expected trusted-publisher identity.
• Normal publishing uses OIDC with no token fallback.
• Registry bytes match the release manifest and attestations.
• Clean consumers import every released package successfully.
• Global CLI commands work if the CLI was included.
• Rollback/incident contacts and support policy are published.
• [SDK 0.1.0] Ship a secure read-only OpenCoven SDK #31 closes only after validation evidence is linked.

Non-goals

No write/stream/rich-authority APIs are added here. This issue executes an approved release; it does not broaden the approved scope or waive a failed gate.

[BunsDev]

Execution status: BLOCKED - do not publish

Security review #40 recommends blocking publication at exact SDK commit 47a9e1415480ce2b3265a69ef9a75c52b5427057. The workflow injection is fixed through #67, but three launch prerequisites remain unresolved: Cave atomic instance binding (OpenCoven/coven-cave#4996), packed supported-platform native/real-authority evidence (OpenCoven/chat#27 and #38), and a separately authorized protected npm-release environment with reviewer rules.

Current safeguards remain intact: all release packages are private, publishingEnabled is false, no npm-release environment exists, and no credential/tag/publication mutation has been performed. Fresh authorization is still required for every external mutation named in this issue.

[BunsDev]

Candidate advanced; execution remains blocked

The reviewed SDK candidate is now a86773cb6ba45084495c00ca364f8646865f1606 after #68. Exact-head verification and focused security review found no new vulnerability, but #40 remains BLOCK for Cave #4996, Chat #27 / SDK #38 real-authority evidence, and the missing protected npm-release environment.

All publication locks remain closed; this update does not authorize an environment, credential, tag, unlock, or publish action.

[BunsDev]

Status update after #69: SDK PR #69 merged to main as 163961f4e59cfdef51d2271fa98e7c514977203f, and OpenCoven/coven-cave#5044 at 2a0ff9237e94e652e477b22f60fd6d721b9e6451 closed the Cave-side HPKE authority-boundary work. This issue remains locked and unauthorized: #40 is still BLOCK pending exact-candidate re-review, release.config.json still has publishingEnabled: false, and the packages remain private. No tag, environment, credential, or publish mutation is authorized.

[BunsDev]

Read-only governance audit after the platform-matrix freeze: the repository still has only the unprotected copilot environment; npm-release does not exist. main requires the two Node verification jobs plus Actions/JavaScript CodeQL and linear history, but currently requires zero approving reviews. All four intended npm package names return registry E404, so first-publish bootstrap and trusted-publisher setup remain necessary. No environment, branch protection, npm package, credential, tag, unlock, or publish mutation was performed. Establishing those prerequisites remains blocked on the fresh explicit authorization required by this issue.

[BunsDev]

Authorized release prerequisite setup completed: npm-release now exists, is restricted to main, and requires deployment review. npm organization ownership and auth-and-writes 2FA are confirmed; the four package records do not yet exist, so the documented one-time bootstrap remains required later. Packages are still private, publishingEnabled remains false, and no tag, token storage, trusted-publisher registration, bootstrap publish, or normal publication occurred. Release execution remains blocked by #40/#38.