Release: Memory Recall 2.0.0

.github/workflows/ci.yml

@@ -11,11 +11,13 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
       - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
       - run: npm ci --ignore-scripts --no-audit --no-fund
+      - run: cargo build --locked --release --manifest-path rust/Cargo.toml --package oaf
       - run: npm run bootstrap
       - run: npm run doctor
       - run: npm run ci

.github/workflows/npm-publish.yml

@@ -18,26 +18,34 @@ on:
         options:
           - trusted-publishing
           - npm-token
+      native_run_id:
+        description: Successful Rust workflow run containing the exact attested native release set
+        required: true
+        type: string
 permissions:
+  actions: read
+  artifact-metadata: write
+  attestations: write
   contents: read
   id-token: write
 jobs:
-  publish:
+  validate:
     runs-on: ubuntu-latest
     timeout-minutes: 25
-    environment: npm-release
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 22.14.0
           registry-url: https://registry.npmjs.org
           package-manager-cache: false
-      - run: npm install -g npm@latest
+      - uses: dtolnay/rust-toolchain@stable
+      - run: npm install -g [email protected]
       - name: Validate manual confirmation
         env:
           INPUT_VERSION: ${{ inputs.version }}
           INPUT_CONFIRM: ${{ inputs.confirm }}
+          INPUT_NATIVE_RUN_ID: ${{ inputs.native_run_id }}
         run: |
           ACTUAL_VERSION="$(node -p "JSON.parse(require('fs').readFileSync('package.json', 'utf8')).version")"
           EXPECTED_CONFIRM="publish memory-recall@${ACTUAL_VERSION}"
@@ -49,17 +57,244 @@ jobs:
             echo "Confirmation must exactly match: $EXPECTED_CONFIRM" >&2
             exit 1
           fi
+          if ! printf '%s' "$INPUT_NATIVE_RUN_ID" | grep -Eq '^[1-9][0-9]*$'; then
+            echo "native_run_id must be a positive GitHub Actions run ID" >&2
+            exit 1
+          fi
       - run: npm ci --ignore-scripts --no-audit --no-fund
+      - run: cargo build --locked --release --manifest-path rust/Cargo.toml --package oaf
+      - run: npm run bootstrap
       - run: npm run ci
       - run: npm run native:smoke
       - run: npm run consumer:smoke
       - run: npm run release:readiness:check
-      - run: npm publish --access public --dry-run
-      - name: Publish with npm Trusted Publishing
-        if: ${{ inputs.auth_mode == 'trusted-publishing' }}
-        run: npm publish --access public
-      - name: Publish with NPM_TOKEN fallback
-        if: ${{ inputs.auth_mode == 'npm-token' }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish --access public --provenance
+      - name: Verify source identity before packing
+        env:
+          RELEASE_COMMIT: ${{ github.sha }}
+        shell: bash
+        run: |
+          test "$(git rev-parse HEAD)" = "$RELEASE_COMMIT"
+          test -z "$(git status --porcelain --untracked-files=all)"
+      - name: Pack exact root release artifact once
+        env:
+          RELEASE_COMMIT: ${{ github.sha }}
+        shell: bash
+        run: |
+          SOURCE_CREATED="$(git show -s --format=%cI "$RELEASE_COMMIT")"
+          CREATED="$(node -e "process.stdout.write(new Date(process.argv[1]).toISOString().replace('.000Z', 'Z'))" "$SOURCE_CREATED")"
+          node scripts/native-release-set.mjs package-root --out output/root-release --commit "$RELEASE_COMMIT" --created "$CREATED"
+      - name: Validate exact root release artifact
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_COMMIT: ${{ github.sha }}
+        run: node scripts/native-release-set.mjs validate-root --artifacts output/root-release --version "$RELEASE_VERSION" --commit "$RELEASE_COMMIT" > output/root-release.validation.json
+      - name: Dry-run exact root tarball
+        shell: bash
+        run: |
+          ROOT_TARBALL="output/root-release/$(node -p "JSON.parse(require('fs').readFileSync('output/root-release/memory-recall-root-release.json', 'utf8')).package.tarball")"
+          npm publish "$ROOT_TARBALL" --access public --dry-run
+      - name: Attest root package provenance
+        uses: actions/attest@v4
+        with:
+          subject-path: output/root-release/*.tgz
+      - name: Attest root package SBOM
+        uses: actions/attest@v4
+        with:
+          subject-path: output/root-release/*.tgz
+          sbom-path: output/root-release/memory-recall-root.spdx.json
+      - name: Upload exact root release artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: memory-recall-root-release-${{ github.sha }}
+          path: output/root-release/*
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    environment: npm-release
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22.14.0
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+      - run: npm install -g [email protected]
+      - name: Download exact root release artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: memory-recall-root-release-${{ github.sha }}
+          path: output/root-release
+      - name: Validate exact root release artifact
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_COMMIT: ${{ github.sha }}
+        run: node scripts/native-release-set.mjs validate-root --artifacts output/root-release --version "$RELEASE_VERSION" --commit "$RELEASE_COMMIT" > output/root-release.validation.json
+      - name: Verify root provenance signature
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          gh attestation verify output/root-release/*.tgz \
+            --repo "$GITHUB_REPOSITORY" \
+            --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/npm-publish.yml" \
+            --signer-digest "$GITHUB_SHA" \
+            --source-digest "$GITHUB_SHA" \
+            --deny-self-hosted-runners
+      - name: Verify root SBOM signature
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          gh attestation verify output/root-release/*.tgz \
+            --repo "$GITHUB_REPOSITORY" \
+            --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/npm-publish.yml" \
+            --signer-digest "$GITHUB_SHA" \
+            --source-digest "$GITHUB_SHA" \
+            --predicate-type https://spdx.dev/Document/v2.3 \
+            --deny-self-hosted-runners
+      - name: Verify exact successful Rust workflow run
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          INPUT_NATIVE_RUN_ID: ${{ inputs.native_run_id }}
+        shell: bash
+        run: |
+          RUN_JSON="$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$INPUT_NATIVE_RUN_ID")"
+          RUN_JSON="$RUN_JSON" node --input-type=module <<'NODE'
+          const run = JSON.parse(process.env.RUN_JSON);
+          const expected = {
+            repository: process.env.GITHUB_REPOSITORY,
+            commit: process.env.GITHUB_SHA,
+            workflow: '.github/workflows/rust.yml'
+          };
+          if (run.head_repository?.full_name !== expected.repository) throw new Error('native run repository mismatch');
+          if (run.path !== expected.workflow) throw new Error('native run workflow mismatch');
+          if (run.status !== 'completed' || run.conclusion !== 'success') throw new Error('native run must be completed successfully');
+          if (run.head_sha !== expected.commit) throw new Error('native run commit mismatch');
+          if (!['push', 'workflow_dispatch'].includes(run.event)) throw new Error('native run event is not release eligible');
+          NODE
+      - name: Download exact native release artifacts
+        uses: actions/download-artifact@v8
+        with:
+          run-id: ${{ inputs.native_run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          name: memory-recall-native-release-set-${{ github.sha }}
+          path: output/native-release
+      - name: Validate complete signed native release set
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_COMMIT: ${{ github.sha }}
+        run: node scripts/native-release-set.mjs validate --artifacts output/native-release --version "$RELEASE_VERSION" --commit "$RELEASE_COMMIT" > output/native-release.validation.json
+      - name: Verify native provenance signatures
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          while IFS= read -r -d '' artifact; do
+            gh attestation verify "$artifact" \
+              --repo "$GITHUB_REPOSITORY" \
+              --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/rust.yml" \
+              --signer-digest "$GITHUB_SHA" \
+              --source-digest "$GITHUB_SHA" \
+              --deny-self-hosted-runners
+          done < <(find output/native-release -type f \( -name '*.tgz' -o -name 'native-package-*-receipt.json' \) -print0)
+      - name: Verify native SBOM signatures
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          while IFS= read -r -d '' artifact; do
+            gh attestation verify "$artifact" \
+              --repo "$GITHUB_REPOSITORY" \
+              --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/rust.yml" \
+              --signer-digest "$GITHUB_SHA" \
+              --source-digest "$GITHUB_SHA" \
+              --predicate-type https://spdx.dev/Document/v2.3 \
+              --deny-self-hosted-runners
+          done < <(find output/native-release -type f -name '*.tgz' -print0)
+      - name: Prove exact root install, uninstall, and clean reinstall
+        shell: bash
+        run: |
+          export MEMORY_RECALL_ROOT_PACKAGE_TARBALL="$(node -p "require('path').resolve('output/root-release', JSON.parse(require('fs').readFileSync('output/root-release.validation.json', 'utf8')).artifact.tarball)")"
+          export MEMORY_RECALL_NATIVE_PACKAGE_TARBALL="$(node -p "require('path').resolve('output/native-release', JSON.parse(require('fs').readFileSync('output/native-release.validation.json', 'utf8')).artifacts.find(({ target }) => target === 'linux-x64-gnu').tarball)")"
+          test -f "$MEMORY_RECALL_ROOT_PACKAGE_TARBALL"
+          test -f "$MEMORY_RECALL_NATIVE_PACKAGE_TARBALL"
+          node scripts/native-code-intelligence-consumer-smoke.mjs
+      - name: Publish native packages
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_COMMIT: ${{ github.sha }}
+          AUTH_MODE: ${{ inputs.auth_mode }}
+          NODE_AUTH_TOKEN: ${{ inputs.auth_mode == 'npm-token' && secrets.NPM_TOKEN || '' }}
+        run: node scripts/native-release-set.mjs publish-native --artifacts output/native-release --version "$RELEASE_VERSION" --commit "$RELEASE_COMMIT" --auth-mode "$AUTH_MODE"
+      - name: Verify native packages on npm
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_COMMIT: ${{ github.sha }}
+        run: node scripts/native-release-set.mjs verify-registry --artifacts output/native-release --version "$RELEASE_VERSION" --commit "$RELEASE_COMMIT"
+      - name: Dry-run root package after native registry verification
+        shell: bash
+        run: |
+          ROOT_TARBALL="output/root-release/$(node -p "JSON.parse(require('fs').readFileSync('output/root-release/memory-recall-root-release.json', 'utf8')).package.tarball")"
+          npm publish "$ROOT_TARBALL" --access public --dry-run
+      - name: Publish exact root package
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_COMMIT: ${{ github.sha }}
+          AUTH_MODE: ${{ inputs.auth_mode }}
+          NODE_AUTH_TOKEN: ${{ inputs.auth_mode == 'npm-token' && secrets.NPM_TOKEN || '' }}
+        run: node scripts/native-release-set.mjs publish-root --artifacts output/root-release --native-artifacts output/native-release --version "$RELEASE_VERSION" --commit "$RELEASE_COMMIT" --auth-mode "$AUTH_MODE"
+      - name: Verify root package on npm
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_COMMIT: ${{ github.sha }}
+        run: node scripts/native-release-set.mjs verify-root-registry --artifacts output/root-release --version "$RELEASE_VERSION" --commit "$RELEASE_COMMIT"
+
+  registry-consumer:
+    name: Published package consumer (${{ matrix.target }})
+    needs: publish
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: darwin-arm64
+            runner: macos-15
+          - target: darwin-x64
+            runner: macos-15-intel
+          - target: linux-arm64-gnu
+            runner: ubuntu-22.04-arm
+          - target: linux-x64-gnu
+            runner: ubuntu-22.04
+          - target: win32-x64
+            runner: windows-2025
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22.14.0
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+      - run: npm install -g [email protected]
+      - run: npm ci --ignore-scripts --no-audit --no-fund
+      - name: Fetch the published root and matching native package
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          NATIVE_TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          mkdir -p output/registry-consumer
+          npm pack "memory-recall@${RELEASE_VERSION}" --pack-destination output/registry-consumer --json > output/registry-consumer/root.json
+          npm pack "@memory-recall/native-${NATIVE_TARGET}@${RELEASE_VERSION}" --pack-destination output/registry-consumer --json > output/registry-consumer/native.json
+          ROOT_TARBALL="$(node -e "const [pack]=JSON.parse(require('fs').readFileSync('output/registry-consumer/root.json', 'utf8')); process.stdout.write(require('path').resolve('output/registry-consumer', pack.filename));")"
+          NATIVE_TARBALL="$(node -e "const [pack]=JSON.parse(require('fs').readFileSync('output/registry-consumer/native.json', 'utf8')); process.stdout.write(require('path').resolve('output/registry-consumer', pack.filename));")"
+          test -f "$ROOT_TARBALL"
+          test -f "$NATIVE_TARBALL"
+          printf 'MEMORY_RECALL_ROOT_PACKAGE_TARBALL=%s\n' "$ROOT_TARBALL" >> "$GITHUB_ENV"
+          printf 'MEMORY_RECALL_NATIVE_PACKAGE_TARBALL=%s\n' "$NATIVE_TARBALL" >> "$GITHUB_ENV"
+      - name: Prove clean global install, MCP, uninstall, and reinstall
+        run: node scripts/native-code-intelligence-consumer-smoke.mjs