release(phase-1-cleanup): v0.1.1 — pre-Phase-2 batch (D35-D42)

Phase 1 cleanup release per CLAUDE.md release_kit.phase_rolling_mode policy. Closes 16 of 17 pre-Phase-2 GitHub issues; #16 stays OPEN as v1.x tracker with design ratified in ADR 0005 Amendment 8. Bumps package.json from 0.1.0 → 0.1.1. Promotes CHANGELOG "Unreleased" section to "## v0.1.1 — 2026-05-25" with full D35-D42 entries (backfilled D35/D36/D37 entries per cold-audit round 7 Finding 1) and final cleanup batch summary covering all 8 D-day commits that landed on `main` between 2026-05-24 and 2026-05-25. Tag v0.1.1 will be pushed after this commit lands and CI is green. release.yml auto-creates the GitHub Release from the CHANGELOG v0.1.1 section (extracted via awk pattern match on `## v0.1.1` heading). D37's phase_rolling_mode gate now passes because Unreleased is sentinel-only after this commit. **What v0.1.1 delivers (D35-D42):** - D35 — streaming empty-stream headers (#9) + truncation marker (#10) + irVersion strict check (#11) + alignment.yml scripts/** removal (#12) + X-OLP-Latency-Ms uniform audit (#4) - D36 — cache_control partial-noop log (#2) + ADR 0002 filename correction (#5) + mistral A5 flip (#6) + /v1/models alias governance (#13) + cache_control determinism test (#14) + anthropic v2.1.89 transcript artifact (#15) - D37 — release.yml phase_rolling_mode CI gate (#17) - D38 — maxConcurrent runtime enforcement + new CONCURRENCY_LIMIT hard trigger (#1) - D39 — CacheStore.delete + cache_evicted_truncated log + sticky- cache regression test + SPAWN_TIMEOUT asymmetry ADR (#3) - D40 — X-OLP-Fallback-Detail debug header + per-hop tuple collection + 4KB cap + RFC 7230 non-ASCII escape (#7) - D41 — X-OLP-Provider-Used chain-origin semantics documented (#8) - D42 — streaming singleflight v1.x design ADR + multi-layer safeguards (issue #16; STAYS OPEN as v1.x tracker) **Test growth:** 416 (v0.1.0) → 468 (v0.1.1). +52 tests across the 8 D-day batch. All 468 pass at the release-commit head. **Cold-audit cycle:** 1 final round (round 7) over D35-D42 + v0.1.0 state. Result: PASS_WITH_MINOR with 4 findings (1×P3 + 3×P4). - Finding 1 (P3 CHANGELOG missing D35/D36/D37) — FIXED in this commit via backfill. - Finding 2 (P4 ADR 0005 Amendment 8 "Amendment 1/3/5" notation ambiguity) — FIXED in this commit (replaced with explicit § Decision body item-1 + Amendment 3 + Amendment 5 wording). - Finding 3 (P4 ADR 0005 Amendment 8 Context paragraph cites line 811 but actual branch is at lines 817-823) — FIXED in this commit (Context paragraph now points at lines 817-823 with the TODO anchor at ~810 as the navigable landmark). - Finding 4 (P4 ADR 0002 missing Amendment 2 — pre-existing gap) — FIXED in this commit (added explanatory note under the Amendments heading explaining the gap is intentional and load- bearing). No P1 or P2 findings. **Phase 1 cleanup release_kit checklist** (per CLAUDE.md): - [x] All 8 D-day deliverables landed on main (D35-D42) - [x] CI green on every D-day commit + on this release commit's head - [x] Cold-audit round 7 PASS_WITH_MINOR (0 P1/P2; 4 findings all fixed in this commit) - [x] 16 of 17 pre-Phase-2 GitHub issues closed (#1-#15 and #17); #16 stays OPEN as v1.x tracker with design ratified - [x] Issue #16 status comment posted (D42 commit b0c080d) referencing ADR 0005 Amendment 8 design ratification - [x] CHANGELOG "Unreleased" promoted to "## v0.1.1 — 2026-05-25" with D35-D42 entries (including backfilled D35/D36/D37) - [x] package.json bumped from 0.1.0 → 0.1.1 - [x] docs/v1x-roadmap.md created at D42 — 7 deferred items with code anchors + GitHub-issue cross-refs + concrete start triggers - [x] Editorial findings 2/3/4 from round 7 folded into this commit - [ ] Tag pushed (next step in this PR's lifecycle) - [ ] release.yml triggered + GitHub Release created (auto on tag push; D37 phase_rolling_mode gate will pass because Unreleased is now sentinel-only — gate dry-run verified locally) **Known limitations carried to v1.x:** full list with code anchors + start triggers in docs/v1x-roadmap.md. The 7 items are: 1. Streaming-path singleflight (issue #16, ADR 0005 Amendment 8) 2. Multi-key auth (lib/keys.mjs) 3. Soft-trigger reactivation (ADR 0004 Amendment 2) 4. /health activeSpawns integration (ADR 0002 Amendment 6) 5. Provider-level cacheKeyFields mask (ADR 0005 Amendment 7) 6. Streaming-path SPAWN_FAILED salvage 7. D40 AUTH_MISSING tuple test coverage Authority: - All 8 D-day commit messages (D35-D42 on main) - ADR 0002 Amendments 5+6 + Amendment-2-gap note (D36, D38, this commit's editorial fix) - ADR 0004 Amendments 3+4+5+6 (D34, D38, D40, D41) - ADR 0005 Amendments 6+7+8 (D34, D42) + this commit's Amendment 8 editorial fixes - ALIGNMENT.md controlled-deviations subsection (D36 #13) - docs/v1x-roadmap.md (D42 — new file, this commit's checklist references it) - docs/provider-audits/anthropic.md (D36 #15 — new file) - CC 开发铁律 v1.6 § 10.x — every D-day had an independent fresh-context opus reviewer per Iron Rule 10; round 7 cold audit was a separate fresh-context full-pass auditor - CLAUDE.md release_kit_overlay phase_rolling_mode — this is the Phase 1 cleanup release that the policy was written for Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-07-19 09:45:07 +00:00 · 2026-05-25 07:13:14 +10:00
parent b0c080db13
commit 8fd8f86942
4 changed files with 67 additions and 3 deletions
@@ -7,6 +7,8 @@

 ## Amendments

+> **Note on numbering.** Sequence is 1, 3, 4, 5, 6 — Amendment 2 was never written. The reserved slot was originally planned for a separate `maxConcurrent` ratification, but that content was folded into Amendment 1 (the retroactive contract-sync amendment) at filing time and the gap was not backfilled. The gap is intentional and load-bearing — no missing content; do not renumber Amendments 3+ to close it (cross-references to Amendment N from other docs would silently break).
+
 ### Amendment 6 — 2026-05-24: `maxConcurrent` runtime enforcement landed (D38, issue #1)

 - **Finding:** Amendment 1 (2026-05-23) ratified `maxSpawnTimeMs` into the Provider contract but explicitly noted that `hints.maxConcurrent` remained **declarative-only at v0.1** — type-validated at startup in `lib/providers/base.mjs` (`validateProvider` requires it to be a non-negative integer) but unenforced at runtime (no semaphore / in-flight counter / spawn queue in `server.mjs`). Cold-audit catch from D11 (commit `f659e29`): the diff-review reviewer grep-verified that the original ADR draft's claim "Enforced by the spawn-concurrency guard in `server.mjs`" was false. GitHub issue #1 was filed to track the gap. D38 closes that gap.
@@ -11,7 +11,7 @@

 **Status:** Design ratified. Implementation deferred to v1.x.

-**Context.** Amendment 6 (D34) formally deferred streaming-path D4 singleflight participation with the note "the design alone warrants a dedicated ADR." Round-6 cold-audit F13 (filed as issue #16) raised the sibling TOCTOU window: `server.mjs:782 preCheckHit = await cacheStore.peek(...)` followed by streaming-branch entry at line 811 (gated on `!preCheckHit`) creates a race where, between peek and spawn, a concurrent populator can write the cache OR a TTL can expire. The streaming branch is path-locked at the moment of the peek result.
+**Context.** Amendment 6 (D34) formally deferred streaming-path D4 singleflight participation with the note "the design alone warrants a dedicated ADR." Round-6 cold-audit F13 (filed as issue #16) raised the sibling TOCTOU window: `server.mjs:782 preCheckHit = await cacheStore.peek(...)` followed by the streaming-branch entry conditionals at lines 817–823 (the TODO anchor sits just above at line ~810 and is the navigable landmark; line numbers may drift across commits) creates a race where, between peek and spawn, a concurrent populator can write the cache OR a TTL can expire. The streaming branch is path-locked at the moment of the peek result.

 This amendment ratifies the v1.x design so the implementation work has a single specification to follow.

@@ -59,7 +59,7 @@ This amendment ratifies the v1.x design so the implementation work has a single
   - For each `client ∈ attachedClients`: if `client.queueByteSize + chunkSize > PER_CLIENT_QUEUE_CAP` (default 1 MB), the client is disconnected with `STREAM_BACKPRESSURE` (see §8). Otherwise push the chunk into `client.queue`, update `queueByteSize`, fire `resolveNext` if pending.

   When the source iterator returns/throws/aborts, the tee task:
-   - On normal completion: writes `accumulatedChunks` to cache via the standard cache-write conditions (cacheable opt-out, truncated-not-cached, size cap — all from Amendment 1/3/5). Resolves all clients' `resolveNext` with their remaining queue then sentinel-marks `done`. Releases the D38 spawn slot once. Removes the entry from `_streamingInflight`.
+   - On normal completion: writes `accumulatedChunks` to cache via the standard cache-write conditions — `truncated-not-cached` from § Decision § "Cache write conditions" item 1; `cacheable=false` opt-out from Amendment 3; `claude -p --output-format text` wire-shape limitation from Amendment 5; size cap from Amendment 3. (Note: ADR 0005 has no Amendment 1 heading — the section §-Decision body item-1 is the source for `truncated-not-cached`, NOT a numbered amendment.) Resolves all clients' `resolveNext` with their remaining queue then sentinel-marks `done`. Releases the D38 spawn slot once. Removes the entry from `_streamingInflight`.
   - On source error: rejects all clients with the error. Does NOT write cache. Releases the D38 spawn slot. Removes entry.
   - On source abort (all clients disconnected): cancels the iterator via AbortController, releases the slot, removes entry. No cache write (partial response not persisted, matches D16 buffered-path SPAWN_FAILED salvage NOT applying to abort).