Skip to content

v0.3.0-source-build-consumer-packaging.md

Latest commit

 

History

History
114 lines (76 loc) · 3.7 KB

v0.3.0-source-build-consumer-packaging.md

File metadata and controls

114 lines (76 loc) · 3.7 KB

Traverse v0.3.0 Source-Build Consumer Packaging

This page documents how downstream consumers, including youaskm3, should consume Traverse v0.3.0 for the first release when no polished cross-platform binary package is attached.

Packaging Decision

Traverse v0.3.0 is source-build supported.

That means the supported consumer path is:

  1. pin the released v0.3.0 tag
  2. build from source with the documented Rust toolchain
  3. start the HTTP/JSON app server or MCP stdio server from that checkout
  4. validate the path with the documented commands

No package-manager distribution, native installer, or polished cross-platform binary package is required for the first youaskm3 release.

Requirements

  • Rust 1.94+
  • Git
  • a local shell capable of running Cargo commands
  • jq for the HTTP walkthroughs and release evidence inspection
  • optional: curl for HTTP/JSON app API checks

Checkout And Build

git clone https://github.com/enricopiovesan/Traverse.git
cd Traverse
git checkout v0.3.0
cargo build

The source checkout is the package boundary for v0.3.0. Downstream consumers should not copy private build artifacts out of target/ and treat them as a stable distribution format.

Start The HTTP/JSON App Surface

For downstream app integration:

cargo run -p traverse-cli -- serve

This starts the app-consumable HTTP/JSON API and writes local discovery information to:

.traverse/server.json

Use docs/youaskm3-canonical-app-http-path.md for the full app-facing flow.

Start The MCP Surface

For MCP client integration:

cargo run -p traverse-mcp -- stdio

Use docs/youaskm3-canonical-mcp-client-path.md for the full MCP-facing flow.

Use docs/v0.3.0-downstream-validation-path.md for the combined MCP and HTTP/JSON downstream evidence path that youaskm3 can cite.

Release Artifacts

The GitHub Release for v0.3.0 publishes source plus supply-chain evidence artifacts.

The attached evidence files are:

  • traverse-sbom.cdx.json: CycloneDX SBOM for dependency visibility.
  • supply-chain-summary.json: summary of the release supply-chain checks.
  • artifact-verify-report.json: artifact verification report produced by the Traverse verification path.
  • traverse-cli.provenance.json: provenance evidence for the built CLI artifact used during supply-chain validation.

These files prove release evidence and build integrity checks. They are not a replacement for a platform-specific binary package.

What Is Not Packaged Yet

Traverse v0.3.0 does not promise:

  • Homebrew, npm, pip, apt, or container distribution
  • native installers
  • signed platform-specific CLI binaries
  • hosted Traverse services
  • a final 1.0 compatibility contract

Those can be added in later releases without changing the first youaskm3 release requirement.

Validation

From the pinned checkout:

cargo build
cargo run -p traverse-cli -- --help
cargo run -p traverse-mcp -- stdio --simulate-startup-failure
bash scripts/ci/repository_checks.sh

Expected result:

  • the workspace builds successfully
  • the CLI help prints the supported command surface
  • the MCP failure simulation exits through the documented deterministic error path
  • repository checks pass

Related Docs