diff --git a/docs/roadmap.md b/docs/roadmap.md index 0ed45bb..83cc999 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -77,7 +77,7 @@ The product status is easiest to read by outcome: | Outcome | Current evidence | What is true now | | ---------------------------------- | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Integrated author–critic workspace | Integrated foundation; alpha.4 checkpoint candidate | CLI and packaged Electron use the shared application driver for local file and approved URL intake, provenance, SQLite run history, bounded orchestration, review decisions, restart recovery, and Markdown/DOCX/PDF export. Desktop provider preflight, credential handling, and Anthropic/OpenAI live paths have focused cross-platform checks. | +| Integrated author–critic workspace | Integrated foundation; [Released alpha.4 checkpoint](stage-evidence-v0.7.0-alpha.4.md); v0.7 incomplete/unvalidated | CLI and packaged Electron use the shared application driver for local file and approved URL intake, provenance, SQLite run history, bounded orchestration, review decisions, restart recovery, and Markdown/DOCX/PDF export. Desktop provider preflight, credential handling, and Anthropic/OpenAI live paths have focused cross-platform checks. | | Application-grade quality | v0.6 release; validation failed | The sanitized representative run exported, but omitted major CV sections and chronology, changed seniority, and introduced unsupported quantification. v0.6.0 is an explicitly non-validated alpha baseline; this failure is the defining input to v0.7. | | Workspace retrieval and policy | Partial integration | Workspace-scoped SQLite FTS/BM25 supplies selected chunks to live requests. The initial workspace writing-policy slice is integrated behind explicit local selection. Neither establishes reusable CKB selection or application-grade drafting. | | Portable CKB | [Released Sprint 2 checkpoint](stage-evidence-v0.7.0-alpha.2.md); [Released alpha.3 checkpoint](stage-evidence-v0.7.0-alpha.3.md); v0.7 incomplete/unvalidated | The separate local store has coordinated writers, recoverable owned writes, explicit six-class retention planning, portable backup/restore, and exact-plan deletion for archived non-default CKBs. Shared CLI/desktop application contracts keep sensitive origins private, and deletion preserves unknown or unowned data. | @@ -91,8 +91,8 @@ provider-independent readiness/adjudication/stopping/layout foundations, the first dormant runtime carrier, and Windows user-session environment hardening. The v0.7 stage remains incomplete and unvalidated; profile, opportunity, retrieval, planning, complete CV, writing-policy, runtime/UI integration, and -representative validation remain. The explicitly approved v0.7.0-alpha.4 -checkpoint candidate carries forward Windows user-session environment hardening +representative validation remain. The [Released v0.7.0-alpha.4 checkpoint](stage-evidence-v0.7.0-alpha.4.md) +carries forward Windows user-session environment hardening and adds packaged-desktop OpenAI authentication selection (API key or authenticated Codex/ChatGPT session), independent per-provider persisted preferences, strict environment precedence, restart-required/no-silent-fallback @@ -153,7 +153,7 @@ contact employers, or submit applications. | Horizon | Stage | Evidence status | Outcome | Remaining gate | | -------- | ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | Previous | Integration hardening and outcome validation ([v0.6.0](https://github.com/akoita/draft-loop/releases/tag/v0.6.0)) | Released; validation failed | Preserve a reproducible integrated baseline without overstating application readiness | Failed representative result carried into v0.7; see [stage evidence](stage-evidence-v0.6.0.md) | -| Now | Evidence-backed CV drafting (v0.7 program) | [Released alpha.3 checkpoint](stage-evidence-v0.7.0-alpha.3.md); alpha.4 checkpoint candidate; v0.7 incomplete/unvalidated | Produce a complete factual, source-traceable application draft | Reviewed profile and opportunity, lexical retrieval, planning, complete CV, writing policy, runtime/UI integration, and representative validation remain | +| Now | Evidence-backed CV drafting (v0.7 program) | [Released alpha.3 checkpoint](stage-evidence-v0.7.0-alpha.3.md); [Released alpha.4 checkpoint](stage-evidence-v0.7.0-alpha.4.md); v0.7 incomplete/unvalidated | Produce a complete factual, source-traceable application draft | Reviewed profile and opportunity, lexical retrieval, planning, complete CV, writing policy, runtime/UI integration, and representative validation remain | | Next | Independent review and readiness ([milestone v0.8.0](https://github.com/akoita/draft-loop/milestone/3)) | Dependency-closed sprint; #71 report, #72 adjudication/trace plus its first runtime-carrier slice, and #73 stopping-decision contract component implemented | Turn the factual draft into a reviewed, revised, human-approvable artifact | Finish the in-sprint CKB, profile, opportunity, retrieval, planning, artifact, and policy prerequisites before the remaining review, readiness, and rendering integration | | Next | Workflow parity and release ([milestone v0.9.0](https://github.com/akoita/draft-loop/milestone/4)) | Designed; parity validation not started | Demonstrate the complete application-grade workflow and publish evidence | Consented comparison, zero factual regression, bounded editing, and cross-platform release evidence | | Later | Retrieval and provider quality | Integrated lexical baseline; partial components | Improve evidence selection and dependable live runs | Vector/hybrid comparison, cancellation, and provider recovery in the packaged path | @@ -372,7 +372,7 @@ issues retain implementation chronology. | Date | Decision | Product implication | | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 2026-08-26 | Published [v0.7.0-alpha.3](https://github.com/akoita/draft-loop/releases/tag/v0.7.0-alpha.3) with [checkpoint evidence](stage-evidence-v0.7.0-alpha.3.md) after release prep PR [#197](https://github.com/akoita/draft-loop/pull/197). | The released checkpoint freezes the post-alpha.2 confirmed-deletion slice, provider-independent readiness/adjudication/stopping/layout foundations, the first dormant runtime carrier, and Windows user-session environment hardening. It does not validate or complete v0.7; profile, opportunity, retrieval, planning, complete-CV, writing-policy, runtime/UI integration, and representative validation remain. | -| 2026-08-26 | Explicitly approved `v0.7.0-alpha.4` as a checkpoint candidate for publication after PR [#199](https://github.com/akoita/draft-loop/pull/199). | The candidate carries forward Windows user-session environment hardening and adds packaged-desktop OpenAI authentication selection (API key or authenticated Codex/ChatGPT session), independent per-provider persisted preferences, strict environment precedence, restart-required/no-silent-fallback behavior, and Codex reasoning lifecycle compatibility while continuing to reject tool events and ignore reasoning content. It does not claim publication, v0.7 completion, or validation; profile, opportunity, CKB retrieval/reactivation, planning, complete CV, writing policy, runtime review/readiness/rendering integration, and representative validation remain, with signing, updates, and CLI packaging incomplete. | +| 2026-08-26 | Published [v0.7.0-alpha.4](https://github.com/akoita/draft-loop/releases/tag/v0.7.0-alpha.4) with [checkpoint evidence](stage-evidence-v0.7.0-alpha.4.md) after feature PR [#199](https://github.com/akoita/draft-loop/pull/199) and release prep PR [#200](https://github.com/akoita/draft-loop/pull/200). | The released checkpoint carries forward Windows user-session environment hardening and adds packaged-desktop OpenAI authentication selection (API key or authenticated Codex/ChatGPT session), independent per-provider persisted preferences, strict environment precedence, restart-required/no-silent-fallback behavior, and Codex reasoning lifecycle compatibility while continuing to reject tool events and ignore reasoning content. It does not validate or complete v0.7; profile, opportunity, CKB retrieval/reactivation, planning, complete CV, writing policy, runtime review/readiness/rendering integration, and representative validation remain, with signing, updates, and CLI packaging incomplete. | | 2026-08-26 | Added packaged-desktop provider authentication mode selection for OpenAI API keys or an authenticated Codex/ChatGPT session. | Windows subscription-backed provider authentication is now represented in the desktop preference and UI; focused checks cover the boundary, while representative Windows validation and release support remain open. | | 2026-08-26 | Made milestone 3 dependency-closed and ordered its open prerequisites before the review/readiness outcomes. | #66–#70, #78, #80, #111, and #113 joined the sprint. Work now proceeds #111 → #113 → #78; #67/#70; #66 → #80 → #68; #69; then #72 → #73 → #74, without leaving the sprint for an open blocker. | | 2026-08-26 | Implemented confirmed deletion #166 as an independently closable prerequisite on the #69 dependency chain. | An archived non-default CKB can be deleted only with an exact fresh-plan token under the store-wide lease. Verified managed data is staged and recoverable, blockers fail closed, unknown or unowned entries are preserved, and CLI/desktop results stay path-free. | diff --git a/docs/stage-evidence-v0.7.0-alpha.4.md b/docs/stage-evidence-v0.7.0-alpha.4.md new file mode 100644 index 0000000..064ec16 --- /dev/null +++ b/docs/stage-evidence-v0.7.0-alpha.4.md @@ -0,0 +1,67 @@ +# v0.7.0-alpha.4 OpenAI session authentication checkpoint + +**Status:** Released checkpoint — v0.7 remains incomplete and unvalidated +**Recorded:** 2026-08-26 +**Scope:** This approved alpha checkpoint adds packaged-desktop OpenAI +authentication selection between an API key and an authenticated Codex/ChatGPT +session, independent per-provider persisted preferences, strict environment +precedence, restart-required/no-silent-fallback behavior, inherited Windows +user-session environment hardening, and Codex reasoning lifecycle compatibility +while continuing to reject tool events and ignore reasoning content. It is not a +v0.7 stage exit. + +## Release record + +| Item | Verified reference | +| ----------------- | ---------------------------------------------------------------------------------- | +| Release | [v0.7.0-alpha.4](https://github.com/akoita/draft-loop/releases/tag/v0.7.0-alpha.4) | +| Feature PR | [#199](https://github.com/akoita/draft-loop/pull/199) | +| Release prep | [#200](https://github.com/akoita/draft-loop/pull/200) | +| Source/tag commit | `d4b7840e7c763877ba3c2e53635a2a0936be1533` | +| Dry run | [32993669592](https://github.com/akoita/draft-loop/actions/runs/32993669592) | +| Publication | [32994139494](https://github.com/akoita/draft-loop/actions/runs/32994139494) | +| Stage issue | [#69](https://github.com/akoita/draft-loop/issues/69) | + +## Evidence and boundary + +- Packaged desktop OpenAI authentication supports explicit API-key or + authenticated Codex/ChatGPT session selection, independent persisted + preferences for each provider, strict environment precedence, and + restart-required behavior without silent fallback. +- Codex reasoning lifecycle compatibility is preserved while tool events remain + rejected and reasoning content remains ignored. Windows user-session + environment hardening from alpha.3 is retained. +- Release packaging supplied macOS arm64, Linux x64, and Windows x64 artifacts. + Packaged checks are implementation and integration evidence, not + representative validation of the v0.7 drafting outcome. + +## Sanitized local preflight + +The required local preflight passed on the exact release commit. Deterministic +validation passed with 970 application tests plus 52 release/security tests. +The mixed live synthetic route used Anthropic API-key authentication with +`claude-haiku-4-5` as author and OpenAI user-session authentication with +`gpt-5.3-codex-spark` as critic. All lifecycle checks were true. Review +completed with 1 evidence source, 11 claims (10 linked), 2 findings (1 +accepted), 7 events, artifact version 1, reported cost of USD 0, and elapsed +time of 18,279 ms. + +## Published targets + +| Target | Bytes | SHA-256 | +| ----------- | --------: | ------------------------------------------------------------------ | +| macOS arm64 | 131525158 | `cd7517bbecac55813a61ab5282072d37325141062a923938366a30a975487b76` | +| Linux x64 | 137318202 | `44c00f08b33b804210232a60e51bf47a3f527a31582bfe4ce69a60d3b5426f1a` | +| Windows x64 | 155950443 | `b996a30e378c4e1f50d8de2e8c7b74c08e091ad291bca131e738453aca09a14f` | + +The release manifest, `SHA256SUMS`, and GitHub asset digests agree. A +CycloneDX 1.7 SBOM is attached with 772 components; provenance attestation was +not requested. + +## Remaining limitations + +Profile, opportunity, CKB retrieval/reactivation, planning, complete-CV +composition, writing policy, runtime review/readiness/rendering integration, +and representative validation remain incomplete. Signing, automatic updates, +and CLI packaging remain incomplete; the CLI remains source-distributed. The +v0.7 stage remains incomplete and unvalidated.