Repository navigation
Publish the conventions release record and SHA256SUMS for blueprint, component and core #166
Description
Context
ADR 0037 made every new kind-family archive carry the engineering-conventions release record as release.json, plus a
SHA256SUMS asset. listing 1.0.1 has both. blueprint 1.7.1 (cut before the adoption PR #164) and component 1.6.0 do
not: their release.json is the older record, and no SHA256SUMS is published.
platform-api (https://github.com/musher-dev/platform-api/pull/373) vendors both releases unchanged under
platform-api/contracts/vendor/specifications/{blueprint,component}-release/. Because the record is missing, it waives
DEPS-05 and DEPS-06 for those copies (.repo/conventions.toml, expiring 2026-12-30) and verifies their archives
against GitHub's recorded asset digest instead of SHA256SUMS.
Core delivers no interface, so under ADR 0037 its archive carries no conventions record. Its release has no
SHA256SUMS either, so consumers that run the core conformance corpus from core-vX.Y.Z.tar.gz can only check it
against GitHub's asset digest.
What to change
- Kind families (S1). Cut the next patch of
blueprintandcomponentthrough therelease.ymlthat
followed ADR 0037. Each then publishes the conventions record, withspecification.jsonbeside it, and
SHA256SUMS. A prose-only patch is enough. - Core (S2). Have the core release path write
SHA256SUMSovercore-vX.Y.Z.tar.gzand attach it, the same
way the kind families do. Say so indocs/publication.md§ Release assets.
Acceptance criteria
blueprint/v1.7.2andcomponent/v1.6.1(or later) each carry arelease.jsonthat validates against
engineering-conventions'checks/schemas/release-record.schema.json, and aSHA256SUMSasset that lists the
archive and the bundle.- The next core release has
SHA256SUMS. platform-api'sscripts/deps/specifications.pythen verifies the core
archive through it automatically. - platform-api's
task deps:syncmoves both kind-family pins, and its DEPS-05 and DEPS-06 waivers are removed.
Order and dependencies
- The two halves are independent of each other.
- The kind-family half should land before 2026-12-30, when platform-api's waivers expire.
- https://github.com/musher-dev/platform/issues/3340 takes the specifications families directly once this lands.
Filed from platform-api#373 by Claude Code on the maintainer's behalf.
Activity
docs(core): name ERR_INVALID_NUMBER and fix two stale citations (#170)
docs(component): correct three statements made stale by later rules
docs(component): correct three statements made stale by later rules (#…
docs(blueprint): correct four statements made stale by later rules
docs(blueprint): correct four statements made stale by later rules (#172
justinmerrell commentedon Oct 4, 2026
Done. All three releases went through the post-ADR 0037
release.yml, and each is published and immutable.requirescore-v1.1.1.tar.gz,SHA256SUMScomponent.schema.json,component-v1.6.1.tar.gz,SHA256SUMSblueprint.schema.json,blueprint-v1.7.2.tar.gz,SHA256SUMSVerified on the downloaded assets:
sha256sum --check SHA256SUMSpasses for all three releases. Each kind family'sSHA256SUMSlists both its archive and its bundle.gh attestation verifypasses for every listed asset.release.jsonandspecification.json. Bothrelease.jsonfiles validate against engineering-conventions v0.7.0'schecks/schemas/release-record.schema.json.S2 (core): no code change was needed.
release.ymlalready wroteSHA256SUMSfor core after #164, and Publication → Release assets already listed it. core 1.1.0 simply predated #164.Prose patches: #170, #171 and #172 are genuine corrections to statements that later rules had made stale. None changes what validates.
Left for platform-api: run
task deps:syncto move both kind-family pins, then drop the DEPS-05 and DEPS-06 waivers (they expire 2026-12-30).