Commit the first accepted SDK #38 aggregate for the 0.0.1 candidate

[BunsDev]

Part of #40. Lifts the structural BLOCK: conformanceEvidence.aggregateRecord was null.

Evidence

• Run. Protected Chat run 36113801474 (attempt 1) is green in every job.
  • It was dispatched from Chat main at f4fbb423, which Bind the Chat main dispatch revision by its descent to the producer #318 binds by descent to producer b1091054.
  • Validator 185d6264 validated and attested the darwin-arm64, linux-x64 and win32-x64 records.
• Aggregate. scripts/aggregate-client-v1-conformance.mjs ran from a clean clone of the validator. It used fresh clones at the frozen candidate 96804bc4, Cave ecdcdcf8, Coven 8c3735f3, Chat ef8c747f and harness b1091054, and produced 96804bc4….json (132,286 bytes).
• Index. 96804bc4….index.json names each protected job, deployment, artifact digest and attestation bundle digest. It was built with the contract's canonical serializer and passes parseReviewedEvidenceIndex.
• Live check. verify-committed-conformance-evidence.mjs passed live at the evidence commit. It re-queried GitHub for the run, jobs, deployments, artifacts and attestations, and regenerated the aggregate byte-identically.
• Readiness. Strict readiness (requireConformanceEvidence) passes at this branch when given the frozen Cave checkout and a GitHub token.

Changes

• The aggregate and index are added under docs/client-v1-cross-repository-results/.
• release.config.json now names the aggregate. publishingEnabled stays false.
• No validator runtime file changes, so readiness's runtime-file comparison against 185d6264 still holds.
• Tests that pinned the "must name a passing aggregate" message now expect the fail-closed "not a complete canonical aggregate". Without a live Cave authority, that is where readiness now stops.
• Those tests get 30 s, matching release-artifacts.spec.ts, because the path now reads the committed validator files.
• The results README and RELEASING are updated.

Artifact expiry. The platform artifacts expire on 2026-10-25 (UTC). After that date, live re-verification needs a fresh protected run.

Validation: full pnpm verify passes (2976 passed, 2 skipped).

This does not issue the #40 ship/block disposition. The candidate re-review follows separately.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Several readiness tests are environment-dependent, and release documentation contains contradictory aggregate-status statements.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Update contradictory release documentation for aggregateRecord state · New

What changed in this PR

Adds the first accepted SDK #38 cross-repository conformance aggregate and evidence index for candidate 0.0.1, while keeping publishing disabled.

Changes:

• Adds aggregate evidence and protected-evidence metadata.
• References the aggregate in release.config.json.
• Updates readiness tests and release documentation.

File	Summary
tests/​release-readiness.spec.ts	Updates readiness expectations and timeouts.
tests/​release-environment-policy.spec.ts	Updates live-gate expectations.
tests/​release-artifacts.spec.ts	Updates verified-evidence expectations.
tests/​conformance-contract.spec.ts	Verifies the committed results reference.
RELEASING.md	Updates conformance-release guidance.
release.config.json	References the accepted aggregate.
docs/​client-v1-cross-repository-results/​README.md	Documents the accepted evidence record.
docs/​client-v1-cross-repository-results/​96804bc483a063e41e9a9738a4ace61970f6c0a4.json	Adds platform conformance aggregate evidence.
docs/​client-v1-cross-repository-results/​96804bc483a063e41e9a9738a4ace61970f6c0a4.index.json	Adds protected-job and attestation metadata.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.