release: prepare and publish Coven v0.4.8 #1203

Goal

Publish Coven v0.4.8 through the existing protected workflows, following docs/reference/releasing.md. All five canonical npm packages should expose 0.4.8 as latest. The GitHub Release should carry the four native archives, both Automations contract bundles and SHA256SUMS.

Tagged: the signed annotated tag v0.4.8 (tag object 7ad49854eda074aa12deb6d1b18d84f81dcb696a, pointing at eb3273e1) was pushed with maintainer authorization. Release npm packages run 37121331044 is in progress.

Candidate

main at eb3273e19670d2ab5bf1374783d96c11a50b0be2. It is v0.4.7 plus four changes:

• fix(daemon): orphan running sessions whose harness is gone #1197: orphan running sessions whose harness is gone (Daemon keeps sessions 'running' after their process is gone; only a restart marks them orphaned #1196).
• fix(release): accept npm's unprefixed trusted publisher config ids #1198: accept npm's unprefixed trusted publisher config ids.
• fix(release): wait for npm to serve a just-published version #1199: wait for npm to serve a just-published version before the GitHub Release step.
• fix(automations): publish a rich revision's document digest (#1054) #1200: publish a rich revision's document digest (P0: Complete executable Automations v1 command and lifecycle parity #1054).

Gates

• Exact-commit main CI: CI run 37109729013 succeeded on the main push at the candidate, attempt 2. 18 jobs passed and 5 were skipped by existing policy. PR gate passed, as did Rust tests on Linux, Windows and macOS, Windows Threads daemon tests, and all four npm onboarding targets.

  • In attempt 1, every job passed except npm onboarding smoke (windows). It ran all four pre-publish checks, including the packaged user journey, then failed while deleting its temp project: EPERM, because Windows still held a lock from the daemon the journey had just stopped.
  • Attempt 2 re-ran only that job and PR gate. The release's exact-source check reads the latest attempt.
  • test-cli-prepublish: Windows scratch cleanup fails with EPERM after the daemon stops #1201 tracks the flake, and fix(release): retry the prepublish temp-project cleanup on Windows (#1201) #1202 fixes it. It is not part of this release.

• Pre-publish smoke (node scripts/test-cli-prepublish.mjs) from a clean detached checkout at the candidate, dry-run version v0.4.8, macOS ARM64: all 4 checks passed. Those cover:

  • prerequisites;
  • the onboarding, PR-readiness and publish guardrails;
  • npm publish --dry-run staging;
  • a packed wrapper-plus-native install with the full installed-user journey.

  As for v0.4.7, the release build and the secret scan ran separately first, and the smoke then reused that build (--skip-build --skip-secrets-scan).

• Secret guard: no current-tree or history findings.

• Release stress, ten iterations per platform: run 37110140969 at the candidate passed on Ubuntu, macOS 26 and Windows. After a warm-up build, each surface ran ten iterations with no failures: Windows PTY timeout and process cleanup on Windows, and claim acquisition, memory migration, process cleanup, PTY timeout and short socket homes on Ubuntu and macOS.

• Version availability: 0.4.8 is unpublished for @opencoven/cli, -macos, -macos-x64, -linux-x64 and -windows, whose latest is 0.4.7. No v0.4.8 tag exists locally or on the remote.

• Signed-tag policy: the maintainer's local SSH signing key is the single entry in NPM_RELEASE_ALLOWED_SIGNERS, and it verifies the v0.4.7 tag.

• Certification packet (operator step): the maintainer ran the interactive reports with the candidate binary. Each report holds only the seven packet fields:

  • claude: CLI 2.1.288, completed: true, exit_class: completed.
  • codex: CLI 0.160.0, completed: true, exit_class: completed.
  • copilot: CLI 1.0.91, completed: true, exit_class: completed.

  All three ran on macos-aarch64 with candidate_commit eb3273e19670d2ab5bf1374783d96c11a50b0be2.

• Push the signed annotated tag after explicit authorization. git verify-tag v0.4.8 reports a good signature from the allowed signer's key.

• Postflight:

  • npm: @opencoven/cli, -macos, -macos-x64, -linux-x64 and -windows all serve 0.4.8 as latest. Release npm packages run 37121331044 succeeded, and provenance verifies for all five packages.
  • GitHub Release: v0.4.8 was published by the authorized recovery, run 37126445853, after the automatic step failed on release-github: verify-npm-provenance fails before the npm wait starts (TDZ), v0.4.8 has no GitHub Release #1204 (fixed by fix(release): start the GitHub Release CLI after its declarations (#1204) #1205; see the comments below). It carries the four native archives, both contract bundles and SHA256SUMS. shasum -c SHA256SUMS passes for all four archives.
  • Contract bundles: both verify against the bundleSha256 values the job recorded.
    • coven-automations-v1-contract-eb3273e1….tar.gz: d8dd645d…, 19 files, content ef266d16…, unchanged from v0.4.7.
    • The authority profile bundle: cb03d445…, 12 files, content 87119cd8….
  • Fresh consumer install: npm install @opencoven/cli@0.4.8 reports coven v0.4.8 (engine coven-code 0.8.0, pinned 0.8.0). npm audit signatures reports verified registry signatures and attestations.
  • SDK daemon canary: test(coven): pin the daemon canary to v0.4.8 and require revision digests sdk#339 (5414c18b) re-pins it to 0.4.8 and now requires every lifecycle event to carry its revision's definition integrity. v0.4.8 passes, and v0.4.7 fails at definition.created.

Certification (operator step)

Use the release binary built from the clean candidate checkout:

• coven v0.4.7-4-geb3273e1
• SHA-256 70b5c09881f1d04f72ea773c465ded7d8dc28e6c5f8eaf111f4e66b308f4fb62

Run these in an interactive terminal on a machine with all three providers authenticated. Each run spends one bounded real provider turn.

COVEN=<candidate checkout>/target/aarch64-apple-darwin/release/coven
mkdir -p ~/coven-cert-v0.4.8
"$COVEN" setup codex   --verify-only --report-json ~/coven-cert-v0.4.8/codex.json
"$COVEN" setup claude  --verify-only --report-json ~/coven-cert-v0.4.8/claude.json
"$COVEN" setup copilot --verify-only --report-json ~/coven-cert-v0.4.8/copilot.json
jq -r '"\(.harness) \(.completed) \(.candidate_commit)"' ~/coven-cert-v0.4.8/*.json

Every line must read true eb3273e19670d2ab5bf1374783d96c11a50b0be2.

Publication (requires authorization)

git fetch origin --tags
git tag -s v0.4.8 eb3273e19670d2ab5bf1374783d96c11a50b0be2 -F ~/coven-v0.4.8-tag-notes.md
git push origin v0.4.8

The drafted annotation, which becomes the GitHub Release notes, is in the first comment.

GitHub Release step

This was meant to be the first release where #1199's npm wait made recovery unnecessary. Instead, the step failed in nine seconds with Cannot access 'REGISTRY_VISIBILITY_DEADLINE_MS' before initialization, because the script started its CLI before the wait's constants were initialized (#1204).

• fix(release): start the GitHub Release CLI after its declarations (#1204) #1205 moves the CLI start to the end of the file and adds an entrypoint guard test.
• The authorized workflow_dispatch recovery then succeeded.
• The next release should exercise the npm wait itself.

Scope notes

• The Automations manifests remain proposed with productionReady:false.
• Runtime Authority stays disabled: production supplies no adapter and no trusted keys.
• Open work stays open: P0: Complete executable Automations v1 command and lifecycle parity #1054 (five commands held for P0: Bind automation runs to principal authority, familiar revisions, capabilities, approvals, and receipts #857, and the Cave canary), P0: Bind automation runs to principal authority, familiar revisions, capabilities, approvals, and receipts #857, P0: Build automations conformance, chaos, SLO, and operator diagnostics #858, P0: enforce exact-commit release governance and shipped-truth attestation #805, and P0: Produce authenticated terminal observations for native Automations coven-runtimes#48.