diff --git a/docs/adopting.md b/docs/adopting.md index cc0e1b5..253595b 100644 --- a/docs/adopting.md +++ b/docs/adopting.md @@ -42,7 +42,7 @@ Merge authority stays with you. Agents only ever propose. In the repo root (new or existing project — `init` never overwrites): ```sh -npx --yes github:norabble/continuous-research#v0.1.6 init +npx --yes github:norabble/continuous-research#v0.1.7 init ``` This scaffolds `.research/config.json` plus six workflows @@ -184,7 +184,7 @@ for qualifying a sensor before the App is wired: ```sh GITHUB_TOKEN=$(gh auth token) GITHUB_REPOSITORY=/ \ - npx --yes github:norabble/continuous-research#v0.1.6 sense + npx --yes github:norabble/continuous-research#v0.1.7 sense ``` Know what changes in this mode: @@ -327,7 +327,7 @@ Instances pin the engine by tag, so nothing changes until you move the pin: runs end-to-end. **Hardened mode — pin the engine to a commit, not a tag.** The scaffold pins -the engine by tag (`#v0.1.6`), and a tag is mutable: whoever can move it runs +the engine by tag (`#v0.1.7`), and a tag is mutable: whoever can move it runs on your next cron with your App token. Pinning to a full commit SHA instead — `github:norabble/continuous-research#` — removes that trust in the tag entirely. The trade-off is that upgrades become manual SHA bumps with no diff --git a/docs/backlog.md b/docs/backlog.md index 5041ff7..a83bea5 100644 --- a/docs/backlog.md +++ b/docs/backlog.md @@ -62,10 +62,13 @@ the order they were staged. Each is independently useful — none blocks another `btc-short-term-trend` → `btcusd-2026-06-27, btcusd-2026-07-01`; `engine-model-token-limits` and `google-free-flash-lite-sessions` → `limits-google-d1992c4c`; `copilot-free-incompatible` → - `limits-github-74e042c7`; `session-budget` and - `consumer-subscriptions-incompatible` judged by the maintainer and left - empty if no edition established them (an absent citation is a true - statement; a supplied one would not be). + `limits-github-74e042c7`; and `session-budget` + + `consumer-subscriptions-incompatible` left **empty** — settled 2026-07-27: + both derive from the maintainer's deployment experience rather than from any + source edition (`session-budget` cites framework telemetry in its own + prose), so no edition established them and an absent citation is the true + statement. They are the case the design is built for, not an oversight: + attribution tops out at 4 of 6 and that is the honest number. - **Verification record + freshness (`verified`, `stale_after`)** — human merge is already the review spine (Q-D) and is exactly what OKF means by diff --git a/docs/cli.md b/docs/cli.md index ffc365d..a97efaf 100644 --- a/docs/cli.md +++ b/docs/cli.md @@ -11,11 +11,11 @@ edition, data-PR, provenance stub, decline record) is defined in | Context | Command | | --- | --- | -| An instance's CI (the normal path) | `npx --yes github:norabble/continuous-research#v0.1.6 ` | +| An instance's CI (the normal path) | `npx --yes github:norabble/continuous-research#v0.1.7 ` | | Framework development | `npm run cli -- ` | | No-npx fallback | vendor the bundle (`npm run build:bundle` → `bundle/continuous-research.mjs`) into the instance repo and `node engine/continuous-research.mjs ` | -Pin a tag (`#v0.1.6`), never a branch — the scaffold does this for you. +Pin a tag (`#v0.1.7`), never a branch — the scaffold does this for you. `--version` prints the resolved version; `--help` summarizes this page. ## Commands diff --git a/package-lock.json b/package-lock.json index 93ba4e3..2c5b4a4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@norabble/continuous-research", - "version": "0.1.6", + "version": "0.1.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@norabble/continuous-research", - "version": "0.1.6", + "version": "0.1.7", "license": "MIT", "dependencies": { "marked": "^18.0.5", diff --git a/package.json b/package.json index 8555891..c2fa22f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@norabble/continuous-research", - "version": "0.1.6", + "version": "0.1.7", "private": true, "description": "Framework for Continuous Research — config CLI + runtime engine. See CONCEPT.md and docs/phase-1-plan.md.", "type": "module", diff --git a/src/scaffold.test.ts b/src/scaffold.test.ts index f7c0f23..5ec24ec 100644 --- a/src/scaffold.test.ts +++ b/src/scaffold.test.ts @@ -22,7 +22,7 @@ describe("scaffoldFiles", () => { it("scaffolds the site workflow", () => { const site = byPath(".github/workflows/site.yml"); expect(site).toContain("actions/deploy-pages"); - expect(site).toContain("npx --yes github:norabble/continuous-research#v0.1.6 site"); + expect(site).toContain("npx --yes github:norabble/continuous-research#v0.1.7 site"); expect(site).toContain("pages: write"); // A fresh scaffold ships site.enabled=false, so the engine writes no // _site/ — the package/upload/deploy steps must all be gated on the @@ -79,7 +79,7 @@ describe("scaffoldFiles", () => { expect(sense).toContain("concurrency:"); expect(sense).toContain("timeout-minutes:"); // The engine ref is pinned — instances upgrade deliberately, not on HEAD. - expect(sense).toContain("npx --yes github:norabble/continuous-research#v0.1.6 sense"); + expect(sense).toContain("npx --yes github:norabble/continuous-research#v0.1.7 sense"); // The workflow's own token stays read-only; the App does the writes. expect(sense).toContain("contents: read"); }); diff --git a/src/scaffold.ts b/src/scaffold.ts index edec1f5..279e377 100644 --- a/src/scaffold.ts +++ b/src/scaffold.ts @@ -73,14 +73,14 @@ jobs: # If the framework is not reachable via npx in your setup, vendor the # engine bundle into the repo and use: # run: node engine/continuous-research.mjs sense - run: npx --yes github:norabble/continuous-research#v0.1.6 sense + run: npx --yes github:norabble/continuous-research#v0.1.7 sense - name: Escalate drift # If the sensor wrote .research/drift/report.json (working-tree # only), file/refresh the single LOCKED sensor-drift issue the # repair workflow consumes. No report -> no-op. env: GITHUB_TOKEN: \${{ steps.app-token.outputs.token }} - run: npx --yes github:norabble/continuous-research#v0.1.6 escalate-drift + run: npx --yes github:norabble/continuous-research#v0.1.7 escalate-drift `; const DECLINE_WORKFLOW = `name: decline @@ -122,7 +122,7 @@ jobs: - name: record-decline env: GITHUB_TOKEN: \${{ steps.app-token.outputs.token }} - run: npx --yes github:norabble/continuous-research#v0.1.6 record-decline + run: npx --yes github:norabble/continuous-research#v0.1.7 record-decline `; const SITE_WORKFLOW = `name: site @@ -180,13 +180,13 @@ jobs: - name: build env: GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }} - run: npx --yes github:norabble/continuous-research#v0.1.6 site + run: npx --yes github:norabble/continuous-research#v0.1.7 site # The OKF bundle rides the site's Pages deploy — a repo has one Pages # site, and this workflow owns it. Deliberately a SEPARATE step with no # env: okf-export reads the checkout only, so it needs no token. It is a # no-op (exit 0, no _okf/) unless okf.enabled is set. - name: build OKF bundle - run: npx --yes github:norabble/continuous-research#v0.1.6 okf-export + run: npx --yes github:norabble/continuous-research#v0.1.7 okf-export - name: stage OKF bundle under _site/okf if: hashFiles('_okf/**') != '' run: mkdir -p _site/okf && cp -R _okf/. _site/okf/