From 21205d246b35dbc8a5555ec4d8d56875db203d4b Mon Sep 17 00:00:00 2001 From: aarroyo Date: Mon, 27 Jul 2026 08:29:57 -0500 Subject: [PATCH 1/2] feat(release): bump the three security-affected packages to 1.2.0, fix publish metadata MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prepares the 1.2.0 release. Nothing is published by this commit. THE SCOPE WAS WRONG AND THE DRY RUN IS WHY WE KNOW -------------------------------------------------- The plan was to bump `@beyondnet/evolith-mcp` alone. That came from reading `git show --stat`, which TRUNCATES long paths with `...` — so the survey missed packages whose files sit deep in the tree. Redone with `--name-only`, the security wave (1b077ab6, 3a39dd03, 60bfc63a, 3f31fa64, 90eacdbc, 4f29e114, 8ad4e2de) touches three published packages, not one: @beyondnet/evolith-mcp 15 files (survey said 10) @beyondnet/evolith-cli 7 files (survey said 1) @beyondnet/evolith-agent-runtime 1 file (survey said none) harness-process.adapter.ts, the CWE-78 shell runner Publishing the original plan would have shipped the mcp patch and left the CLI and agent-runtime vulnerable, then closed GT-570 against it. All three go to 1.2.0. The other five public packages stay where they are: the wave did not change them, and republishing would only add registry noise. Consumers pin `^1.1.0`, which 1.2.0 satisfies, so no ranges move. PUBLISH METADATA, FOUND BY THE DRY RUN -------------------------------------- The rehearsal (run 30265298045) packed @beyondnet/evolith-sdk and reported 30 files, not one of them a licence, on an MIT project. Root cause was two-sided: four packages had no LICENSE in their directory at all, and three did not list it in `files`. Both fixed, verified with `npm pack --dry-run` — the four packages about to ship now each carry it. npm was also auto-correcting `repository.url` on every publish and saying so. Publishing through a warning means letting npm guess your metadata; all eight manifests now declare `git+https://…` explicitly, and the warning count is 0. CHANGELOG --------- The 336-line `[Unreleased]` batch is assigned to `## [1.2.0] - 2026-07-27`, with two things written down rather than tidied away: which three packages the version actually covers, and the fact that the 1.1.0 heading is dated 2026-06-16 while npm served 1.1.0 from 2026-07-18 — so part of this batch shipped inside that release with no entry of its own. The dates are left alone; the caveat is explicit so nobody reads the 1.1.0 section as a complete description of its tarballs. A GUARD CAUGHT THE BUMP, CORRECTLY ---------------------------------- `10-validate-contract-conformance` went red: the machine-contracts manifest declares `producer.version` and it must equal the CLI's package.json. Synced to 1.2.0. That is precisely the drift the guard exists to prevent. Verified: ci-runner governance 17/17 exit 0, mcp-server 403, agent-runtime 321, contracts 32, contract suite 43/43, planner self-test 11/11. The planner now resolves 4 of 8 publishable: agent-runtime@1.2.0, sdk@2.0.0, mcp@1.2.0, cli@1.2.0. Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 25 +++++++++++++++++-- .../maturity-reconciliation.json | 2 +- src/packages/agent-runtime/LICENSE | 21 ++++++++++++++++ src/packages/agent-runtime/package.json | 4 +-- src/packages/contracts/LICENSE | 21 ++++++++++++++++ src/packages/contracts/package.json | 2 +- src/packages/core-domain/package.json | 2 +- src/packages/core/package.json | 2 +- src/packages/infra-providers/package.json | 2 +- src/packages/mcp-server/LICENSE | 21 ++++++++++++++++ src/packages/mcp-server/package.json | 7 +++--- src/packages/sdk-client/LICENSE | 21 ++++++++++++++++ src/packages/sdk-client/package.json | 5 ++-- .../contracts/evolith-machine-contracts.json | 2 +- src/sdk/cli/package.json | 7 +++--- 15 files changed, 126 insertions(+), 18 deletions(-) create mode 100644 src/packages/agent-runtime/LICENSE create mode 100644 src/packages/contracts/LICENSE create mode 100644 src/packages/mcp-server/LICENSE create mode 100644 src/packages/sdk-client/LICENSE diff --git a/CHANGELOG.md b/CHANGELOG.md index 36da07c3e..725562a55 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,10 +2,31 @@ ## [Unreleased] +## [1.2.0] - 2026-07-27 + Changes accumulated since the 1.0.0 release of 2026-06-28. Automated changelog generation was disconnected during this period (GT-552), so these entries were -reconstructed from the commit history. The version number for this batch is -deliberately unassigned. +reconstructed from the commit history. + +**Which packages this version covers.** Only the three published packages the +security wave actually touched are released at 1.2.0: +`@beyondnet/evolith-mcp` (15 files), `@beyondnet/evolith-cli` (7) and +`@beyondnet/evolith-agent-runtime` (1 — the `harness-process.adapter.ts` shell +runner, CWE-78). The other five public packages stay at their current versions +because the wave did not change them; publishing them again would only add noise +to the registry. + +**A caveat about 1.1.0, recorded rather than tidied away.** The heading below is +dated 2026-06-16, but npm served `1.1.0` from **2026-07-18** — so part of the +batch in this section shipped inside that release without a changelog entry of +its own. The dates are left as they are; do not read the 1.1.0 section as a +complete description of what the 1.1.0 tarballs contained. + +**Why this section was unassigned until now.** The security fixes below landed on +2026-07-23, five days after 1.1.0 reached the registry, and there was no +automated path to publish seven of the eight packages — so they could not ship +(GT-570). That path now exists (`npm-release.yml`), which is what makes assigning +a version here meaningful instead of aspirational. ### Security Hardening (Phases 1-7) diff --git a/reference/core/control-center/maturity-reports/maturity-reconciliation.json b/reference/core/control-center/maturity-reports/maturity-reconciliation.json index c47a119bd..f37fdf55a 100644 --- a/reference/core/control-center/maturity-reports/maturity-reconciliation.json +++ b/reference/core/control-center/maturity-reports/maturity-reconciliation.json @@ -11,7 +11,7 @@ }, "evidence": { "closureRecords": 543, - "cliPackage": "@beyondnet/evolith-cli@1.1.0", + "cliPackage": "@beyondnet/evolith-cli@1.2.0", "adrCount": 139, "rulesetCount": 167, "schemaCount": 45 diff --git a/src/packages/agent-runtime/LICENSE b/src/packages/agent-runtime/LICENSE new file mode 100644 index 000000000..55439217c --- /dev/null +++ b/src/packages/agent-runtime/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 BeyondNet Code + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/src/packages/agent-runtime/package.json b/src/packages/agent-runtime/package.json index 8fddea381..f64be44e4 100644 --- a/src/packages/agent-runtime/package.json +++ b/src/packages/agent-runtime/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-agent-runtime", - "version": "1.1.0", + "version": "1.2.0", "description": "Evolith Agent Runtime — decoupled agentic layer that operates Evolith Core through Ports & Adapters (.harness, Core Evaluation, OPA, Tracker, Memory, Scheduler, Hermes). Hexagonal; no runtime/LLM technology is a domain dependency.", "license": "MIT", "main": "dist/index.js", @@ -47,7 +47,7 @@ "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme", "repository": { "type": "git", - "url": "https://github.com/beyondnetcode/evolith_arch32.git", + "url": "git+https://github.com/beyondnetcode/evolith_arch32.git", "directory": "src/packages/agent-runtime" } } diff --git a/src/packages/contracts/LICENSE b/src/packages/contracts/LICENSE new file mode 100644 index 000000000..55439217c --- /dev/null +++ b/src/packages/contracts/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 BeyondNet Code + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/src/packages/contracts/package.json b/src/packages/contracts/package.json index 014cb9276..8e4a85815 100644 --- a/src/packages/contracts/package.json +++ b/src/packages/contracts/package.json @@ -53,7 +53,7 @@ "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme", "repository": { "type": "git", - "url": "https://github.com/beyondnetcode/evolith_arch32.git", + "url": "git+https://github.com/beyondnetcode/evolith_arch32.git", "directory": "src/packages/contracts" } } diff --git a/src/packages/core-domain/package.json b/src/packages/core-domain/package.json index c973e4f29..27c944c4f 100644 --- a/src/packages/core-domain/package.json +++ b/src/packages/core-domain/package.json @@ -98,7 +98,7 @@ "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme", "repository": { "type": "git", - "url": "https://github.com/beyondnetcode/evolith_arch32.git", + "url": "git+https://github.com/beyondnetcode/evolith_arch32.git", "directory": "src/packages/core-domain" } } diff --git a/src/packages/core/package.json b/src/packages/core/package.json index 7d92326bd..22a6f58c7 100644 --- a/src/packages/core/package.json +++ b/src/packages/core/package.json @@ -37,7 +37,7 @@ "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme", "repository": { "type": "git", - "url": "https://github.com/beyondnetcode/evolith_arch32.git", + "url": "git+https://github.com/beyondnetcode/evolith_arch32.git", "directory": "src/packages/core" } } diff --git a/src/packages/infra-providers/package.json b/src/packages/infra-providers/package.json index 8ba5c1a2a..343e001ff 100644 --- a/src/packages/infra-providers/package.json +++ b/src/packages/infra-providers/package.json @@ -38,7 +38,7 @@ "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme", "repository": { "type": "git", - "url": "https://github.com/beyondnetcode/evolith_arch32.git", + "url": "git+https://github.com/beyondnetcode/evolith_arch32.git", "directory": "src/packages/infra-providers" } } diff --git a/src/packages/mcp-server/LICENSE b/src/packages/mcp-server/LICENSE new file mode 100644 index 000000000..55439217c --- /dev/null +++ b/src/packages/mcp-server/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 BeyondNet Code + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/src/packages/mcp-server/package.json b/src/packages/mcp-server/package.json index d3c952140..b39dcb32d 100644 --- a/src/packages/mcp-server/package.json +++ b/src/packages/mcp-server/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-mcp", - "version": "1.1.0", + "version": "1.2.0", "description": "Evolith MCP Gateway — NestJS-based Model Context Protocol server for AI agents. Supports stdio and SSE transports.", "main": "dist/main.js", "types": "dist/main.d.ts", @@ -33,7 +33,8 @@ ], "files": [ "dist/", - "README.md" + "README.md", + "LICENSE" ], "dependencies": { "@beyondnet/evolith-agent-runtime": "^1.1.0", @@ -91,7 +92,7 @@ "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme", "repository": { "type": "git", - "url": "https://github.com/beyondnetcode/evolith_arch32.git", + "url": "git+https://github.com/beyondnetcode/evolith_arch32.git", "directory": "src/packages/mcp-server" }, "publishConfig": { diff --git a/src/packages/sdk-client/LICENSE b/src/packages/sdk-client/LICENSE new file mode 100644 index 000000000..55439217c --- /dev/null +++ b/src/packages/sdk-client/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 BeyondNet Code + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/src/packages/sdk-client/package.json b/src/packages/sdk-client/package.json index 170be5869..b8786130a 100644 --- a/src/packages/sdk-client/package.json +++ b/src/packages/sdk-client/package.json @@ -7,7 +7,8 @@ "main": "dist/index.js", "types": "dist/index.d.ts", "files": [ - "dist" + "dist", + "LICENSE" ], "scripts": { "build": "tsc -p tsconfig.json", @@ -51,7 +52,7 @@ "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme", "repository": { "type": "git", - "url": "https://github.com/beyondnetcode/evolith_arch32.git", + "url": "git+https://github.com/beyondnetcode/evolith_arch32.git", "directory": "src/packages/sdk-client" }, "publishConfig": { diff --git a/src/rulesets/contracts/evolith-machine-contracts.json b/src/rulesets/contracts/evolith-machine-contracts.json index c5d612868..f845a72d6 100644 --- a/src/rulesets/contracts/evolith-machine-contracts.json +++ b/src/rulesets/contracts/evolith-machine-contracts.json @@ -3,7 +3,7 @@ "compatibilityPolicy": "semver-major", "producer": { "package": "@beyondnet/evolith-cli", - "version": "1.1.0" + "version": "1.2.0" }, "schemas": [ { diff --git a/src/sdk/cli/package.json b/src/sdk/cli/package.json index 209873340..877afa976 100644 --- a/src/sdk/cli/package.json +++ b/src/sdk/cli/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-cli", - "version": "1.1.0", + "version": "1.2.0", "description": "Evolith CLI - Governance, standards validation, and AI agent integration for satellite repositories", "main": "dist/main.js", "bin": { @@ -52,7 +52,7 @@ "license": "MIT", "repository": { "type": "git", - "url": "https://github.com/beyondnetcode/evolith_arch32.git", + "url": "git+https://github.com/beyondnetcode/evolith_arch32.git", "directory": "src/sdk/cli" }, "engines": { @@ -64,7 +64,8 @@ "shell/", "templates/", "README.md", - "ARCHITECTURE.md" + "ARCHITECTURE.md", + "LICENSE" ], "dependencies": { "@clack/prompts": "1.5.1", From 92d794ddb041bdf8074f9d947e498962d52be431 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Mon, 27 Jul 2026 08:37:54 -0500 Subject: [PATCH 2/2] fix(docs): regenerate the product inventory for the 1.2.0 CLI bump MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `Validate documentation` failed on #225. The first run died on an ECONNRESET fetching typescript-eslint during `npm ci` — a genuine network flake — and the rerun revealed what it had been masking: `11-validate-product-docs` reporting "Product inventory is stale". The cause is the bump itself. That validator asserts the CLI version advertised in `product/products/smart-cli/*` matches `src/sdk/cli/package.json`, and checks the generated inventory against the installable surface. Moving the CLI to 1.2.0 invalidated both. Regenerated with the generator rather than edited by hand: @beyondnet/evolith-cli@1.2.0 — 35 commands, 50 tools, 12 resources, 8 prompts, 45 schemas. WHY MY LOCAL RUN WAS GREEN AND CI WAS NOT ----------------------------------------- `ci-runner.mjs` only adds `11-validate-product-docs` to the set when it detects a code change, so `ci-runner governance` never executed it locally while the `Validate documentation` job in CI did. That is a blind spot in the local verification routine, not a difference in the code: a green `ci-runner governance` does not imply a green required check. Worth remembering — it is the same shape as the other local-vs-runner gaps this session (a stale dist, a gitignored directory, a threshold measured on the wrong machine), and the fix is the same: verify where it is enforced. Ran the code-triggered validators individually afterwards: 01, 04, 05, 08, 10, 19, 20 and 24 all exit 0. Co-Authored-By: Claude Opus 5 --- product/products/smart-cli/product-inventory.es.md | 2 +- product/products/smart-cli/product-inventory.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/product/products/smart-cli/product-inventory.es.md b/product/products/smart-cli/product-inventory.es.md index 2f743b05b..a3822c62c 100644 --- a/product/products/smart-cli/product-inventory.es.md +++ b/product/products/smart-cli/product-inventory.es.md @@ -7,7 +7,7 @@ Inventario generado de la superficie instalable de Evolith CLI y MCP. No editar | Campo | Valor | |---|---| -| Package | `@beyondnet/evolith-cli@1.1.0` | +| Package | `@beyondnet/evolith-cli@1.2.0` | | Binary | `evolith`, `evolith-cli` | | CLI commands | 35 | | MCP tools | 50 | diff --git a/product/products/smart-cli/product-inventory.md b/product/products/smart-cli/product-inventory.md index d16c711d1..4b910ff7e 100644 --- a/product/products/smart-cli/product-inventory.md +++ b/product/products/smart-cli/product-inventory.md @@ -7,7 +7,7 @@ Generated inventory of the installable Evolith CLI and MCP surface. Do not edit | Field | Value | |---|---| -| Package | `@beyondnet/evolith-cli@1.1.0` | +| Package | `@beyondnet/evolith-cli@1.2.0` | | Binary | `evolith`, `evolith-cli` | | CLI commands | 35 | | MCP tools | 50 |