release(v4.0.0): final GA release-prep (no publish, no tag, no Zenodo)#48
Merged
Conversation
…e-prep, not published) - bump package versions to 4.0.0 (root package.json, @klickd/core, klickd PyPI) - pyproject.toml: bump Development Status to Production/Stable - CITATION.cff: bump to 4.0.0, point at concept DOI (version-specific DOI minted later) - .zenodo.json: 4.0.0 metadata, plain-text description (no HTML), isNewVersionOf to v3.5.1 DOI - README: badge, JSON example, install/cite/badge snippets, Looking ahead -> Current GA - CHANGELOG: new v4.0.0 (GA, release-prep) section listing what ships and what remains gated - docs/releases/v4.0.0.md: final GA release notes - scripts/release_bundle_inventory.sh + release-artifacts/ in .gitignore: local SHA256SUMS helper No git tag, no GitHub Release, no npm publish, no PyPI publish, no Zenodo deposit.
Replace 'Klickd / Luxlearn, Luxembourg' with 'Klickd.app, Luxembourg' and update creator name to full form 'Cirilli, Vincenzo' (matching the existing BibTeX form in README and paper.md) in the v4.0.0 release metadata files that directly feed the Zenodo deposit and CITATION. Affected files: - .zenodo.json: creators[0].name + creators[0].affiliation - CITATION.cff: authors[0].family-names + given-names + affiliation No changes to DOI fields. Concept DOI 10.5281/zenodo.20262530 and v3.5.1 version DOI 10.5281/zenodo.20320480 retained. No v4.0.0 version-specific DOI is fabricated; it remains to be minted by Zenodo upon deposit (final gated action). Zenodo description remains plain text (no HTML tags). Checks run: - python3 scripts/validate_v4_schemas.py -> all green - python3 verify_vectors.py -> 77/77 passed - JSON / YAML parse round-trip -> ok - secret scan on diff -> no hits Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Public release-facing surfaces (npm, PyPI, Zenodo, GitHub release, SECURITY/CONTRIBUTING/PITCH/SPEC/SKILL, paper.md) now show the maintainer as ".klickd / klickd.app, Luxembourg" with .klickd visible next to the creator identity. Creator / affiliation (clean review proposal): - Name (Zenodo): "Cirilli, Vincenzo (.klickd)" - Affiliation (Zenodo): ".klickd / klickd.app, Luxembourg" - Author (CITATION.cff): family="Cirilli", given="Vincenzo", name-suffix=".klickd", affiliation=".klickd / klickd.app, Luxembourg" - Author (npm @klickd/core): "Vincenzo Cirilli (.klickd) <hello@klickd.app> (https://klickd.app)" - Author (PyPI klickd): name="Vincenzo Cirilli (.klickd)", email="hello@klickd.app" - Author (root package.json): "Vincenzo Cirilli (.klickd / klickd.app, Luxembourg)" Public contact emails on release-facing surfaces: - SECURITY.md : Luxlearn@pm.me -> security@klickd.app - CONTRIBUTING : Luxlearn@pm.me -> hello@klickd.app - PITCH.md : Luxlearn@pm.me -> hello@klickd.app - npm @klickd/core author email -> hello@klickd.app - PyPI klickd author email -> hello@klickd.app NOTE: hello@klickd.app and security@klickd.app are proposed public Klickd-domain alternatives, replacing the personal Luxlearn@pm.me address. Vince to confirm/adjust before publish. Historical / internal documents NOT rewritten (preserved as archival context, per spec governance): - benchmarks/v32/* (historical benchmark runs that pre-date the rename - rewriting would alter archival record) - benchmarks/RAPPORT_CONSOLIDÉ.md, benchmarks/README.md, benchmarks/context_cost/RFC.md (historical) - docs/rfcs/RFC-00{1,2,4,6,7,8}-*.md, docs/rfcs/v4-media-test-pack.md, docs/rfcs/examples/agent_core-v1.example.json - docs/use-cases/{DOMAIN_PROFILE_CATALOG,CORE_KLICKD_B2B}.md - docs/audits/V4_PRE_RELEASE_AUDIT.md (audit record of prior state - left intact so the audit trail remains coherent) - SKILL_v25.md, SKILL_v30.md (frozen prior SKILL versions) Checks run: - JSON / YAML / TOML parse round-trip -> OK - python3 scripts/validate_v4_schemas.py -> all green - python3 verify_vectors.py -> 77/77 passed - Secret scan on git diff main -> clean No tag, no GitHub release, no npm/PyPI/Zenodo publish, no public announcement. Release-prep only; PR #48. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Owner
Author
Update — v4.0.0 final rebrand to
|
| Field | Value |
|---|---|
Zenodo creators[0].name |
Cirilli, Vincenzo (.klickd) |
Zenodo creators[0].affiliation |
.klickd / klickd.app, Luxembourg |
CITATION.cff family-names |
Cirilli |
CITATION.cff given-names |
Vincenzo |
CITATION.cff name-suffix |
.klickd |
CITATION.cff affiliation |
.klickd / klickd.app, Luxembourg |
npm @klickd/core author |
Vincenzo Cirilli (.klickd) <hello@klickd.app> (https://klickd.app) |
PyPI klickd author |
name Vincenzo Cirilli (.klickd), email hello@klickd.app |
Root package.json author |
Vincenzo Cirilli (.klickd / klickd.app, Luxembourg) |
| paper.md affiliation | .klickd / klickd.app, Luxembourg |
| SPEC.md maintainer | .klickd / klickd.app (Luxembourg) |
| SKILL.md maintainer line | .klickd / klickd.app |
Files changed in 43d1039
.zenodo.json, CITATION.cff, CONTRIBUTING.md, PITCH.md, SECURITY.md, SKILL.md, SPEC.md, package.json, packages/@klickd/core/README.md, packages/@klickd/core/package.json, packages/PACKAGE_SUMMARY.md, packages/pypi/klickd/README.md, packages/pypi/klickd/pyproject.toml, paper.md.
Public email addresses (need Vince's confirmation before publish)
SECURITY.md→security@klickd.appCONTRIBUTING.md→hello@klickd.appPITCH.md→hello@klickd.app- npm/PyPI author email →
hello@klickd.app
These are proposed Klickd-domain alternatives. If Vince prefers different addresses (e.g., a dedicated vince@klickd.app, or keeping Luxlearn@pm.me for legal/historical security disclosures), the relevant lines should be adjusted before any package or Zenodo publish step.
Luxlearn mentions intentionally retained
23 files still contain Luxlearn. All are historical/internal and were left unchanged on purpose (rewriting would alter the archival record or has no public-release surface):
- Frozen prior spec snapshots:
SKILL_v25.md,SKILL_v30.md - Historical benchmark reports:
benchmarks/v32/RAPPORT_LOT{2,4,5,9}.md,benchmarks/v32/REFERENTIELS_COMPETENCES_V33.md,benchmarks/v32/RAPPORT_CONSOLIDÉ_V32.md,benchmarks/v32/ANALYSE_AMELIORATIONS_V33_PRELIM.md,benchmarks/RAPPORT_CONSOLIDÉ.md,benchmarks/README.md,benchmarks/context_cost/RFC.md(the entity was namedLuxlearn.appat the time of these runs — they are archival) - RFC document headers (drafts/accepted, dated):
docs/rfcs/RFC-001-media-profile-v1.md,docs/rfcs/RFC-002-verification-gates.md,docs/rfcs/RFC-004-migration-backward-compatibility.md,docs/rfcs/RFC-006-agent-core.md,docs/rfcs/RFC-007-usage-profile-skill-routing.md,docs/rfcs/RFC-008-core-update-watch.md,docs/rfcs/v4-media-test-pack.md - RFC example payload:
docs/rfcs/examples/agent_core-v1.example.json(illustrativepublished_byprovenance string) - Internal use-case docs:
docs/use-cases/DOMAIN_PROFILE_CATALOG.md,docs/use-cases/CORE_KLICKD_B2B.md - Audit record (intentionally frozen):
docs/audits/V4_PRE_RELEASE_AUDIT.mddocumentsLuxlearn@pm.meas the prior state — rewriting would falsify the audit trail.
If Vince later wants to scrub these too, a follow-up docs(brand): retire Luxlearn from historical docs PR is the safer path so the rebrand is reviewed in isolation.
Checks
| Check | Result |
|---|---|
python3 -c json.load(.zenodo.json) + package.json + npm @klickd/core/package.json |
✅ parse |
python3 -c yaml.safe_load(CITATION.cff) |
✅ parse |
python3 -c tomllib.load(pyproject.toml) |
✅ parse |
python3 scripts/validate_v4_schemas.py |
✅ all green |
python3 verify_vectors.py |
✅ 77/77 passed |
Secret scan on git diff main (AKIA, sk_live_, ghp_, xoxb-, AIza, BEGIN PRIVATE KEY, api_key=, password=, token=, secret=) |
✅ clean |
Strict governance reminders
- ❌ No git tag
- ❌ No GitHub release
- ❌ No
npm publish/ nodist-tag latestflip - ❌ No
twine uploadto PyPI - ❌ No Zenodo deposit
- ❌ No public announcement
Branch ready for maintainer review. Do not merge until Vince confirms the public email choices (hello@klickd.app, security@klickd.app) and the .klickd placement in name/affiliation.
— Generated by agent (Claude Code)
Adds the central v4 positioning — ".klickd is an open-source security and continuity layer for every actor in AI" + tagline "One soul. Any model. Any agent." — to README, v4.0.0 release notes, Zenodo description, and CHANGELOG. Updates the npm and PyPI package READMEs slogan from "Any body" to "Any agent" to align with v4 GA wording. The positioning is framed for users (privacy / ownership / memory portability), agents (structured context / verified constraints), developers (schemas / SDKs / migration) and industry (controlled, opt-in interoperability). Each surface includes an explicit non-claim line: no adoption-as-standard, no universal compatibility, no guaranteed security beyond SPEC.md and the v4 schemas. No code, schemas, vectors, or SDK behaviour change. No tag, no publish, no Zenodo deposit — those remain final gated maintainer actions per the PR #48 governance contract. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release-prep for
.klickdv4.0.0 (final, GA). This PR aligns versions, metadata, release notes, and a local bundle-inventory helper for the v4.0.0 final release.Strict governance — what is NOT in this PR:
git tag v4.0.0npm publishand no@klickd/corelatestdist-tag flipklickd==4.0.0Those remain final gated public actions for the maintainer after review.
What changes
4.0.0package.json(root):4.0.0-preview.1→4.0.0packages/@klickd/core/package.json:4.0.0-preview.1→4.0.0packages/pypi/klickd/pyproject.toml:4.0.0a1→4.0.0; classifier bumped toDevelopment Status :: 5 - Production/StableCITATION.cff—version: \"4.0.0\",date-released: \"2026-05-25\", top-level DOI removed pending Zenodo deposit; identifiers retain concept DOI10.5281/zenodo.20262530and prior version DOI for v3.5.1..zenodo.json— title/version updated to4.0.0, plain-text description (no HTML),isNewVersionOfrelation added pointing to v3.5.1 DOI.README.md— badge points to v4.0.0 + concept DOI; JSON example now showsklickd_version: \"3.0\"+payload_schema_version: \"4.0.0\"(matches normative wire envelope); install/cite/badge snippets updated; "Looking ahead" preview section replaced with "Current GA —.klickd v4.0.0" pointing at strict schemas, SDKs, migrator, vectors, and v4 release notes.CHANGELOG.md— new## v4.0.0 (GA) — 2026-05-25section: what ships, distribution version mapping, backward compatibility, what is explicitly NOT in this PR.docs/releases/v4.0.0.md— final GA release notes: TL;DR, what ships, install, migration snippet, validation matrix, compatibility tables, known limitations, final gated actions list.scripts/release_bundle_inventory.sh+.gitignore— local helper that builds the npm/PyPI artefacts, snapshots normative files, and emits a deterministicSHA256SUMStorelease-artifacts/v4.0.0/. The output dir is gitignored.Test plan
All suites green on this branch:
python verify_vectors.py→ 77/77 passed (0 failed)node verify_vectors.mjs→ 60/60 passed (0 failed, 0 skipped)python scripts/validate_v4_schemas.py→ All passespytest packages/pypi/klickd/tests/→ 98 passed, 1 skippednpm testinpackages/@klickd/core/→ 96/96 passed (4 suites)npm run build→ ESM + CJS + DTS greengit diff main— no matches against AWS keys / genericpassword=/token=/BEGIN PRIVATE KEYpatternsRemaining final gated public actions (after maintainer review)
v4.0.0on merge commit.v4.0.0(marked Latest), pointing atdocs/releases/v4.0.0.md.npm publish@klickd/core@4.0.0and flipdist-tag latestto4.0.0.twine uploadklickd==4.0.0to PyPI.10.5281/zenodo.20262530(a new version-specific DOI for v4.0.0 will be minted at deposit time).Generated by Computer