release: prepare 1.0.0-beta.10 - #63
Merged
Merged
Conversation
Dates the Unreleased section and moves both package versions to the
target. Install surfaces already document causescope@beta, and the
StackBlitz lab deliberately stays on beta.9: the runbook forbids
pointing it at an unpublished version, and verify:stackblitz now says so
explicitly ("trailing unpublished repository release 1.0.0-beta.10")
instead of printing two version numbers side by side.
The release closes the three provenance gaps found by auditing the
evidence chain a reader singled out: destructured primitives, computed
keys resolved at render time, and values whose container exceeded the
per-object recording budget. It also fixes non-identifier keys being
joined with a dot, which made a reported path something other than the
accessor it claimed to be.
Verified: verify:release, the full pnpm check gate, and the Firefox
end-to-end suite.
Co-Authored-By: Claude Opus 5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release PR per
RELEASING.md. Preparation only — publishing happens on the tag, which is a separate, explicitly approved step.Contents
Three provenance gaps, all found by auditing the one capability a reader singled out from the launch post ("tracing a value back to the API response"), plus one real bug found while testing them.
Added
const { status } = ordernow resolves to the same confirmed network origin a directorder.statusread already produced; chains fold back to the response root. (feat: keep provenance across destructured primitives #60)row[columnId]anditems[index].namereach the same confirmed origin as a literal read, with each key hoisted and evaluated once. (feat: keep provenance across computed keys resolved at render time #61)Fixed
rows.row-7.statusreads as a subtraction; the accessor isrows["row-7"].status, and these paths are meant to be copy-pasteable. (feat: keep provenance across computed keys resolved at render time #61)Changed
verify:stackblitzfails on live-lab drift once a release is published. (docs: lead with the evidence chain and shrink the demo GIF #57, ci: fail verify:stackblitz once the release is published #59)Runbook conformance
packages/causescopeon the same target1.0.0-beta.10## [1.0.0-beta.10] - 2026-07-28causescope@beta, 6 surfaces, unchanged1.0.0-beta.9On that last row,
verify:stackblitznow states which rule it applied rather than printing two version numbers and leaving the reader to compare:Once beta.10 is on npm that gap closes and this gate fails until the post-release sync PR lands — which is the point of #59.
Verification
pnpm verify:release— 15 policy tests, 10 changelog releases, 6 install surfaces, provenance and allowlist enabled.pnpm check— the full gate, exit 0. Includes production-absence and privacy scans, performance budgets, public API snapshot, packed-package Vite 5–8 consumers, and e2e: React 19 12/12, React 18 1/1, SWC 1/1.pnpm test:e2e:firefox— 3/3.Pre-release checks
1.0 stablemilestone: 0 open, 8 closed.Not done here
Tag creation and push are the publish boundary and need explicit maintainer approval. After this merges and main-branch CI is green,
v1.0.0-beta.10on that exact commit triggers npm trusted publishing with provenance, then the post-release PR bumps the lab to beta.10.🤖 Generated with Claude Code