Joseph Magly
c352f34843
Make the contributor, CI, package, and tagged-release contracts agree with the shared BT6 baseline while preserving T3MP3ST's project-specific integrity checks. Exclude workspace-only material from published packages and keep local-agent detection tests host-independent.\n\nCloses #159
90 lines
3.8 KiB
Markdown
90 lines
3.8 KiB
Markdown
---
|
||
title: "Release Checklist"
|
||
summary: "Release gates and verification steps."
|
||
description: "Release gates and verification steps."
|
||
audience: ["maintainer"]
|
||
category: "release"
|
||
status: "current"
|
||
source: "T3MP3ST repository"
|
||
sourcePath: "docs/RELEASE_CHECKLIST.md"
|
||
updated: "2026-07-20"
|
||
---
|
||
# Release Checklist
|
||
|
||
A repeatable, artifact-first checklist for cutting a T3MP3ST release. The guiding rule is the
|
||
same as the project itself: **every headline number re-derives from committed artifacts** — so a
|
||
release isn't cut until the deterministic gates and the local smoke path are green.
|
||
|
||
## 1. Deterministic gates (must all pass)
|
||
|
||
```bash
|
||
npm ci
|
||
npm run typecheck # tsc — 0 errors
|
||
npm run build # tsc build
|
||
npm run lint # 0 errors (warnings OK)
|
||
npm test # unit + integration suite
|
||
npm run verify-claims # re-derives every headline number from committed artifacts
|
||
npm audit # expect 0 vulnerabilities
|
||
npm run test:no-fitting # anti-benchmark-fitting guard
|
||
npm run test:no-self-fitting
|
||
npm run test:no-phantom-tools
|
||
npm run test:gate
|
||
npm run prompt:audit
|
||
npm run pack:dry-run # inspect the allowlisted package manifest; no workspace/private files
|
||
```
|
||
|
||
## 2. Local API smoke (loopback only)
|
||
|
||
```bash
|
||
T3MP3ST_PORT=<free-port> npm run server & # start on an isolated port
|
||
T3MP3ST_PORT=<free-port> npm run smoke # health + endpoint smoke
|
||
T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run exploit:smoke
|
||
T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run field:drill
|
||
npm run arsenal:smoke # self-contained, 125 checks
|
||
```
|
||
|
||
Stop any listeners you started when done.
|
||
|
||
## 3. Optional — live checks (network + keys)
|
||
|
||
```bash
|
||
npm run smoke -- --live # exercises a live LLM (needs a provider key or a local agent)
|
||
npm run arsenal:doctor # reports which optional external tools are installed
|
||
```
|
||
|
||
## 4. Arsenal prerequisites (optional external tools)
|
||
|
||
The bash-only path needs **no** external tools. Specialist operators can use standard offensive
|
||
tooling if present on `PATH`; `npm run arsenal:doctor` reports what's installed. Missing tools
|
||
degrade gracefully — they never fail the core run.
|
||
|
||
## 5. ⚠️ Scope & safety
|
||
|
||
- **Never run live scans or exploitation against a target without an explicit authorization /
|
||
scope receipt.** The default posture is owned / local / synthetic targets only.
|
||
- The server binds `127.0.0.1` by default. If you set `T3MP3ST_HOST` to a non-loopback address,
|
||
it prints an **EXPOSURE WARNING** — the API executes commands and has **no built-in auth**. Put
|
||
a Bearer-token reverse proxy in front of it before any LAN / internet exposure.
|
||
|
||
## 6. Publish
|
||
|
||
- Confirm the release commit is already on `main`, CI is green at that exact
|
||
SHA, the version and changelog agree, and the tag is signed and points to that
|
||
commit. Never move or reuse a failed release tag; correct the release and use
|
||
a new version/tag.
|
||
- Verify `repository.url` in `package.json` points at this repo. To retarget it:
|
||
```bash
|
||
npm pkg set repository.url="git+https://github.com/<owner>/<repo>.git"
|
||
```
|
||
- Tag the release only after Sections 1–2 are green.
|
||
- Push the `v*` tag and wait for the tag workflow. It reruns
|
||
`npm run test:release`, the high-severity dependency audit, and the package
|
||
dry run against the exact tag, then retains the tested `.tgz`, its manifest,
|
||
and `SHA256SUMS` as workflow artifacts.
|
||
- Inspect `pack-result.json`: only the allowlisted runtime, scripts, tools,
|
||
documentation, examples, and package metadata may ship. Workspace notes,
|
||
tests, AIWG/provider deployment internals, secrets, and local artifacts are
|
||
release blockers.
|
||
- Publish the retained, checksum-matched package artifact. Do not rebuild a
|
||
different archive from another checkout after certification.
|