Skip to content

vnext-public-release-checklist.md

Latest commit

 

History

History
92 lines (77 loc) · 5.97 KB

vnext-public-release-checklist.md

File metadata and controls

92 lines (77 loc) · 5.97 KB
Raw

vNext Public Release Checklist

Historical evidence only (frozen 2026-05-11). Do not use this checklist to authorize a current tag or publication. The canonical v0.9.2 gate is RELEASING.md, which must be run on one exact clean release commit and its built artifacts.

This checklist records the earlier vNext preview milestone and its evidence; checked boxes below describe that historical run, not current release status.

Docs

  • README links the vNext preview, quickstart, architecture, security/privacy, demo script, release checklist, release notes, and tag plan.
  • Quickstart includes local install, Docker/local stack, first source capture, and first daily brief.
  • Docs explain Alice Core vs Alice Brain vs Alice Agent Memory.
  • Example ALICE.md is included and uses only synthetic content.
  • Demo video script is current.
  • Contributor guide explains how to work on vNext safely.
  • Security/privacy docs describe connector boundaries and secret handling.

Product Gate

  • New user can install locally and generate a first daily brief in under 20 minutes.
  • /vnext renders the fixture-backed workspace.
  • Connector settings are visible in the UI.
  • Connector settings can be updated from /vnext for Telegram, local folder, and browser clipper defaults.
  • Connector settings and state persist in dedicated tables, with event-log audit entries for changes.
  • Connector secrets use references and local encrypted/env-backed providers without exposing raw values.
  • Connector health and dogfooding capture metrics are visible in the UI.
  • Local doctor checks report missing migrations, missing connector rows, secret reference problems, scheduler posture, and capture failures.
  • /vnext exposes live source review/update/archive, source-backed open-loop creation, doctor/readiness checks, and capture-to-brief traces.
  • Live local capture works for allowlisted Telegram, local folder/Obsidian notes, browser clips, and agent outputs.
  • Connector payload ingestion preserves raw evidence, default domain/sensitivity, and cursor posture.
  • Generated artifacts remain reviewable and are not auto-promoted to trusted memory.
  • Model-backed artifacts remain source-grounded, policy-routed, and reviewable.
  • Human artifact quality ratings can be created and exported.

Verification

  • ./.venv/bin/python -m pytest tests/unit -q
  • pnpm --dir apps/web test
  • pnpm --dir apps/web lint
  • pnpm --dir apps/web build
  • python3 scripts/check_control_doc_truth.py
  • git diff --check
  • ./.venv/bin/python -c 'from alicebot_api.cli import main; raise SystemExit(main(["eval", "run", "--suite", "all"]))'
  • Real Postgres vNext CLI/API/MCP smoke check.
  • Real Postgres scheduled model-backed workflow smoke check.
  • Real Postgres connector-hardening smoke check.
  • Real Postgres secret-redaction smoke check.
  • Real Postgres dogfood-doctor smoke check.
  • Real Postgres operator-console smoke check.

Security and Privacy

  • No secrets, private exports, real personal data, or production credentials are committed.
  • Demo dataset contains only synthetic people, projects, notes, and connector payloads.
  • Prompt-injection evals show zero tool writes.
  • Critical privacy leakage evals show zero critical leaks.
  • New connector/write paths have security review notes.
  • Connector settings/state storage and secret references have security review notes.
  • Post-merge GitHub Security Scans passed on main.

Release Operations

  • Changelog entry prepared.
  • Tag plan prepared: docs/release/v0.5.1-vnext-preview-tag-plan.md.
  • Rollback path documented.
  • Known limitations documented: no managed connector OAuth, no packaged browser extension, no hosted connector polling, no hosted SLA, no automatic memory promotion, no production scheduler.
  • Release owner signs off.

Evidence

Current evidence recorded on 2026-05-11:

  • Real Postgres vNext smoke passed for source capture, connector ingest, scoped and unscoped context packs, daily brief generation, project update review, open-loop close, API context packs, API project dashboard, MCP context pack, and MCP project dashboard.
  • Real Postgres scheduled model-backed smoke passed for local routing, provider metadata, review status, source refs, and grounded output sections.
  • Real Postgres live-capture connector smoke passed for allowlisted Telegram sync, rejected chat isolation, local folder generated-folder ignore behavior, browser clip capture, review-only agent output ingestion, and connector health telemetry.
  • Real Postgres capture-to-brief smoke passed for browser clip capture, context-pack inclusion, Daily Brief generation, source references, quality rating recording, and dogfooding telemetry.
  • Real Postgres connector-hardening smoke passed for settings rows, cursor persistence, rejected-chat logging, generated-folder ignores, restart dedupe, and health counters.
  • Real Postgres secret-redaction smoke passed for Telegram token absence, browser token absence, and redacted capture-token evidence.
  • Real Postgres dogfood-doctor smoke passed with zero blocking failures and zero warnings.
  • Real Postgres operator-console smoke passed for source review, memory review, artifact review/rating, source-backed open loops, scheduler run-now, connector health, doctor readiness, event logging, and capture-to-brief traceability.
  • ./.venv/bin/python -m pytest tests/unit -q: 1125 passed.
  • ./.venv/bin/python -m pytest tests/integration -q: 370 passed.
  • pnpm --dir apps/web test: 207 passed.
  • pnpm --dir apps/web lint: passed.
  • pnpm --dir apps/web build: passed and built /vnext.
  • python3 scripts/check_control_doc_truth.py: passed.
  • alicebot eval run --suite all: 170/170 cases, zero critical privacy leaks, zero prompt-injection tool writes.
  • git diff --check: clean.
  • GitHub Security Scans on merged main passed for CodeQL JavaScript, CodeQL Python, and Gitleaks.