Files
alkstore/tasks/release-publish-prep.md
T

93 lines
4.0 KiB
Markdown

---
id: release-publish-prep
name: Publish prep — package verification, exclusion check, publish records
status: pending
depends_on: [release-readme, release-flake-investigation]
scope: moderate
risk: medium
impact: project
level: implementation
tags: [wave-8, publish]
---
## Description
The plan's wave-8 "publish prep": everything short of the manual
`cargo publish` itself (CI and publishing are manual per the plan's
decided points — self-hosted Gitea, supply-chain posture; the actual
publish is the user's action, post-gate).
1. **Package metadata audit**: the four published crates currently
carry only version/edition/license/repository — `description` is
missing on all four (crates.io requires it). Land honest
descriptions per crate; decide the remaining optional fields
(`keywords`, `categories`, `homepage`/`docs` — the family's
published crates are the precedent to check) and record the
decisions.
2. **`cargo package` verification per published crate** (`alkstore`,
`alkstore-sqlite`, `alkstore-postgres`, `alkstore-mem`): each
packages clean (no warnings that block, `.crate` contents
inspected), builds + tests from the packaged source
(`cargo package --no-verify` off — let it verify, or verify
manually per crate and record which).
3. **The publish-exclusion verification** (parked from wave 7 —
`tasks/review-wave-7.md` item 4(iii)): the mechanism
(`exclude = ["fuzz"]` on the root workspace) landed; this is the
verification that **no published package leaks the sidecar** —
inspect each `.crate`'s file list: no `fuzz/` paths, no
`alkstore-fuzz-shared` references, no grown corpora/artifacts.
Also verify `alkstore-contract-suite` (`publish = false`) and the
fuzz sidecar are absent from any package.
4. **Path-dep + version records**: the engines' `alkstore = { version
= "0.1", path = … }` shape is publish-legal (version bound present)
— verify each path dep carries its version bound; record the
publish order (core first, then engines — ADR-017 §4.1's pairing)
and the version decision (0.1.0 as contract v1's initial release,
per ADR-017's semver-is-the-contract discipline) in the task Notes
as the publish checklist of record.
5. **Substrate packaging check** (ADR-013/018): `alkstore-sqlite`'s
package includes the in-tree substrate — verify `PROVENANCE.md` and
the dual-license notice ride in the `.crate`, and the package is
honest about carrying them.
6. **The publish checklist of record**: a Notes section listing the
exact manual commands in order (per crate: package → publish),
including the dry-run evidence, so the user's publish session is
mechanical.
## Acceptance Criteria
- [ ] `description` landed on all four published crates; optional
metadata decisions recorded
- [ ] `cargo package` clean per published crate (verification posture
recorded); `.crate` contents inspected
- [ ] Publish-exclusion verification recorded: no fuzz/sidecar/
contract-suite paths in any package's file list
- [ ] Path-dep version bounds verified; publish order + version
decision recorded
- [ ] Substrate PROVENANCE + license notice confirmed in the
`alkstore-sqlite` package
- [ ] The manual publish checklist of record written (commands in
order, evidence attached)
- [ ] Workspace gates + the fuzz corpus-replay gate green at session
end
## References
- docs/plans/implementation.md §Wave 8, §Decided points (CI/publishing
manual)
- tasks/review-wave-7.md (the parked exclusion verification, item 4)
- docs/architecture/decisions/017-contract-versioning.md §4.1 (the
version pin + pairing)
- docs/architecture/decisions/013-fold-substrate-into-sqlite.md +
docs/architecture/decisions/018-provenance-register-and-cherry-picks.md
(the in-tree substrate's packaging posture)
- docs/architecture/decisions/022-contract-suite-layout.md (the suite
is not published)
## Notes
> To be filled by implementation agent
## Summary
> To be filled on completion