Milestones
List view
Purpose: implement and roll out ADR 0088 — replace the ADR 0016 Corepack mechanism with digest-verified npm registry tarballs (the ADR 0084 publish-stage model extended to the build stage) as the production provisioning path for build-stage pnpm and Yarn. Rollout rules (ADR 0088, Rollout): - Rollout timing is a release-management decision and may be adjusted without a new ADR; ADR 0016 remains valid production behavior until the release carrying this mechanism. - During the Corepack window, consumer manifests pinning pnpm 12 or newer, or Yarn 6 or newer, must fail closed with a diagnostic — the project does not issue provenance it cannot stand behind. - pnpm 12 support begins with the release completing this mechanism (dual-artifact capture records both executed pnpm 12 artifacts). Yarn 6 support does not start automatically: it requires a positive integrity-channel finding (an @yarnpkg/cli-dist-equivalent registry publication, signed Yarn Switch releases, or otherwise) when Yarn 6 releases. Gate (ADR 0088, Confirmation): closes when (1) the build-and-pack specification defines registry-tarball acquisition, signature and SRI verification, launcher, and platform-matrix behavior; (2) the provenance specifications define the updated package-manager distribution descriptors, including the pnpm 12 dual-artifact record and the Yarn authority upgrade; (3) the verification policy and fixture corpus are regenerated to the new closed shape; (4) the workflow static check enforces the new provisioning steps instead of corepack enable; (5) the Corepack-regime implementation rejects pnpm 12+/Yarn 6+ manifests for the window; and (6) a live dogfood run on the first builder release carrying this mechanism demonstrates install, build, and pack for npm, pnpm 11, pnpm 12, and Yarn Berry consumers with records that bind the executed bits.
No due date•0/8 issues closedPurpose: complete trust, npm, publisher/composition, and manifest fixtures; enforce conformance CI; finish documentation and release readiness. Gate: V01–V06 complete and the plan completion definition satisfied.
No due date•0/6 issues closedPurpose: prove static workflow conformance, mutation fault handling, queue/GHES evidence, and controlled cross-surface contention. Gate: L04 complete; L04 is required by V01–V04.
No due date•0/4 issues closedPurpose: implement the composition handoff, npm release-asset mode, and end-to-end composition scenarios. Gate: X03 complete; X03 is required by L01 and L02.
No due date•0/3 issues closedPurpose: implement canonical release manifests and the producer-neutral release-asset publisher, including workflows and mutation convergence. Gate: M02 and R03 complete; both are required by X01.
No due date•0/5 issues closedPurpose: implement npm provenance inputs, signing, OIDC/registry handling, convergence, the public workflow, and live M1 dogfood. Gate: P06 cannot be replaced by dry-run, mock registry, or local simulation.
No due date•5/6 issues closedPurpose: establish dogfood readiness, trusted runtime feasibility, dependencies, platform evidence, module/CI guardrails, and fixture harness. Gate: F01, F02, and F03 block trusted implementation; F00 blocks only P06; F04–F06 and F05 must be green before Wave 1.
No due date•7/7 issues closed