Skip to content

0.1.0 release record

Status: TestPyPI-only; superseded by 0.1.1 before production publication

The signed release reached TestPyPI, but the promotion verifier attempted to resolve the source distribution's build dependency exclusively from TestPyPI. That index does not carry Hatchling, so the verifier failed and the protected workflow correctly skipped production PyPI. The uploaded 0.1.0 files remain immutable on TestPyPI; 0.1.1 repairs only this release-pipeline defect.

Boundary

Version 0.1.0 freezes the documented Python API and CLI for the 0.1.x line. Receipt serialization, canonicalization, physical database schemas, and the example cross-service envelope remain experimental as described in Versioning.

Availability check — 30 August 2026

  • PyPI's project JSON endpoint for threvo-actions returned HTTP 404.
  • TestPyPI's project JSON endpoint for threvo-actions returned HTTP 404.
  • Authenticated GitHub repository-name search returned only BlackPigIndustries/threvo-actions; the repository is currently private.
  • An exact-string engineering collision screen found no public package or repository using the name. This is not a legal trademark opinion. The brand owner must resolve any legal objection before making the repository public.

Publication stops if the namespace is claimed before the workflow runs. The workflow never substitutes a different distribution or import name.

Release gates

  • [x] Package, bundled skill, changelog, and frozen contract identify 0.1.0.
  • [x] CI builds one wheel and one source distribution and inspects their contents.
  • [x] Release qualification installs both artifacts on Python 3.11, 3.12, and 3.13 with core, PostgreSQL, Pydantic AI, and all-extras profiles.
  • [x] Golden vectors, typing marker, license, migrations, documentation, and coding-agent skill are included; repository caches and tests are excluded.
  • [x] The release workflow requires an authenticated, verified annotated tag.
  • [x] TestPyPI and PyPI use separate protected GitHub environments and OIDC Trusted Publishing without a package upload token.
  • [x] PyPI promotion is gated on TestPyPI files matching the CI-built SHA-256 manifest.
  • [x] Repository visibility is changed from private to public.
  • [x] testpypi and pypi protected environments and Trusted Publishers are configured for this repository and .github/workflows/release.yml.
  • [x] Signed v0.1.0 tag and protected workflow publish the artifacts to TestPyPI.
  • [x] Failed TestPyPI verification blocks production PyPI publication.
  • [ ] Production publication is intentionally superseded by v0.1.1.
  • [ ] The GitHub release contains artifact digests and provenance links.

The remaining items are completed by the superseding 0.1.1 release rather than by changing the immutable 0.1.0 artifacts.