Repository navigation
npm go-live: publish 1.5.3 as latest; neutralize legacy 1.0.0 #4
Description
Bring the modern client live on npm.
- Configure npm auth: OIDC Trusted Publishing (no stored token, recommended) OR an
NPM_TOKENautomation-token repo secret. [decision pending] - Release
v1.5.3(version bump + tag) -> CI publishes OCI and npm with provenance;latestmoves to 1.5.3. - Neutralize legacy
1.0.0(deprecate; and/or unpublish if npm policy allows). - Verify:
npm view @conceptkernel/cklib version-> 1.5.3; npm page renders corrected README;npm audit signaturespasses.
Blocked on: npm auth decision + tag authorization.
Activity
ci(v1.5.3): defer npm publish behind repo var NPM_PUBLISH (default off)
styk-tv commentedon Jun 30, 2026
Deferred per request — gated on npm auth (NPM_TOKEN or OIDC trusted publishing). When ready: configure auth + set repo var
NPM_PUBLISH=true, then a tag release publishes OCI + npm with provenance, and legacy 1.0.0 gets neutralized.styk-tv commentedon Jul 2, 2026
Status 2026-07-02. Blocked on npm auth (the single remaining input — see #3 for the completed wiring). The tracked tree is release-ready: v1.5.3 is shipped and attested on the OCI side, so the first npm publish will carry whatever tag is current at activation (1.5.3 today; a later tag if one ships first).
Go-live sequence (no code change):
NPM_TOKENsecret or OIDC Trusted Publishing for@conceptkernel/cklib.NPM_PUBLISH=true.--provenance, then hard-gates ondist-tags.latestresolving to the released version.1.0.0(npm deprecate— it predates the current architecture and must not be installed).Navigation boundaries. npm is a convenience distribution of the same byte-set as the attested OCI bundle — the OCI artifact remains the canonical, attestation-verified surface consumed downstream by oci-germination / sporaxis compositions. Nothing here changes the substrate contract (pgCK) or touches RDF concerns (pgRDF).