ArtPlayer/refactor/changes/2026-09-14-REL-08-release-ledger.md

REL-08: candidate-bound package release ledger

The previous plan described batch release gates but had no executable per-package binding between current source, candidate archives and reviewed evidence. Added release-ledger.json for22 packages, a pure decision model, a filesystem/CLI adapter and a maintained procedure in release-ledger.md. This completes the ledger task, not package verification, version preparation, remote workflow activation or release.

Scope and ownership

The JSON registry owns target versions, explicit historical distribution mappings, capability requirements, rollback basis and future candidate/evidence bindings. It does not duplicate task/risk status: the adapter reads tasks.json, risks.json, third-party.json and the existing dependency/impact model. Open package-specific risks propagate through dependencies; a generic review owner alone does not widen a concrete HLS finding to unrelated packages. Truly global risks stay global.

Source fingerprints include own/dependent packages and shared scripts, tests, toolchain, contracts and frozen release/SDK inputs. Text CRLF is normalized with explicit algorithm labels and separate raw-byte hashes; binary fonts/WASM/media, candidate SRI and evidence attachments use exact bytes. A per-report input table avoids duplicating hashes across22 package rows. Unrelated package source changes can leave another batch unchanged; shared engineering/test/provenance changes are conservatively revalidated. Unknown dynamic imports widen the dependency scope.

Actual tarball name/version, source commit existence, SRI and archive members are checked. Site manifests additionally require an exact build tree inventory and matching bytes. Evidence envelopes bind package/version/gate, candidate integrity, input fingerprint, actual environment, command, reviewer, successful check IDs and hashed underlying reports. Device requirements reject missing device identity, mock/emulation and skipped results. Remote CI requires a remote run reference; license coverage includes relevant vendor/SDK and direct runtime dependency IDs.

This is mechanical bookkeeping, not a verifier of the truth of prose. Candidate build origin, complete scenario coverage, report interpretation and device/vendor evidence still require the three independent reviews. A source fingerprint must be captured in the actual build/validation snapshot, not copied onto an old package. No historical done task or old report is automatically accepted for a new candidate.

Distribution and compatibility

All22 independent next-major targets are recorded without changing manifests. The iframe row explicitly maps its frozen artplayer-plugin-iframe predecessor; the recovered Thumbnail tool remains blocked for missing complete historical archive. VitePress stays a site/URL/build gate, without inferred new npm publication. Rollback links the historical basis and requires an actual rehearsal report.

No core/plugin public API, runtime, declaration, dependency or lockfile changed. Four Yarn scripts expose structural check, immutable report output, strict preflight and tests. ci:check includes the structural check; test:baseline already discovers the new test. Strict preflight runs the existing pinned toolchain check. Normal check exit0 explicitly permits incomplete package evidence; only strict mode is a release gate. publicationAuthorized stays false even in the synthetic evidence-complete test. CI-03 already depends on REL-08 and will integrate strict preflight into the later publication workflow.

Validation

See recorded validation.

• 30 regression cases pass. They reject stale source/test/SDK/lock inputs, wrong version/package/gate, old tarball reports, tampered reports/attachments, missing license/capability/review evidence, simulated devices and local-as-remote CI. Real temporary archives/site files exercise SRI, manifest, complete output inventory and byte checks; these are synthetic tooling fixtures, not product package/browser/device acceptance.
• Package source isolation, dependency propagation, unknown import fallback, 22-package coverage and text/binary hashing are tested. Site cannot silently be changed to npm scope or lose mandatory review gates.
• CI script suite50 passes; targeted lint passes after ordinary formatting fixes. Strict Node24.21.0/Yarn1.22.22 toolchain check passes with unchanged dependencies.
• Current all-package report has22 blocked packages and zero candidate bindings. The explicit HLS strict preflight exits1 for the expected missing gates; this is correct rejection, not a failed tooling implementation. Generated reports use separate cache directories and previous evidence remains intact.

Rollback and next work

Revert this task commit to remove the new scripts, registry, tests and ci:check step. No package rebuild is necessary. Continue outstanding runtime/device/source tasks; REL-01/09 prepare final versions, REL-02 generates real candidates, REL-04 executes rollback and CI-03/04 plus the reviews supply candidate-bound evidence. Do not fill pass envelopes from plans or rename existing historical report fields to manufacture a ready state.