AUSUS v0.2.0-alpha.4 — Release engineering hotfix

Hotfix release. No runtime changes, no architectural changes, no new features. Closes the three QA-reported blockers on the v0.2.0-alpha.3 distribution chain and codifies the release engineering invariants that prevent recurrence.

Filtering + pagination (the original v0.2.0-alpha.4 scope) is renumbered to v0.2.0-alpha.5 and ships separately.

TL;DR

composer create-project ausus/starter myapp works again. End to end. On a fresh machine. Without manual composer config minimum-stability alpha.

Bugs fixed

BUG #1 — Quickstart cassé (release blocker)

The ausus/starter package's scaffold template had "minimum-stability": "stable". When composer create-project scaffolded a user project, that root project inherited the stable minimum-stability, which then rejected the transitive ausus/* ^0.2@alpha resolution chain.

The @alpha per-package flag does not propagate to a required package's own transitive dependencies — this is standard Composer behaviour, not specific to AUSUS.

Fix. packages/starter/composer.json now declares "minimum-stability": "alpha". The scaffolded project inherits this and resolves the v0.2 alpha chain cleanly. Companion fix: the post-root-package-install hook (which ran bin/configure-repo.php before dependency resolution) is removed — it was leaving the user with a half-populated myapp/ on resolution failure.

BUG #2 — npm / PHP version drift

@ausus/renderer-react was at 0.1.1 on npm while PHP packages shipped 0.2.0-alpha.3. ViewSchema was wire-compatible (no actual breakage), but the announced alignment policy was violated.

Fix. Renderer bumped to @ausus/renderer-react@0.2.0-alpha.4. The package now declares a peerSchemaVersion field at top level — see Renderer compatibility contract below.

BUG #3 — Homepage URLs 404

All 10 packages had homepage fields pointing at non-existent or wrong GitHub URLs (ausus-framework/ausus org, or the monorepo URL).

Fix. Each package's homepage now points at its dedicated rel-* repository: https://github.com/adonko3xBitters/<package>. Packagist's "View Repository" link now resolves correctly.

Renderer compatibility contract

@ausus/renderer-react@0.2.0-alpha.4 adds a peerSchemaVersion: "^1.0.0" field to its package.json. This formalises the renderer's ViewSchema compatibility window.

Going forward:

• A backend release that does NOT change schemaVersion does NOT require a renderer release.
• A renderer release that adds new optional widgets/props does NOT require a backend bump.
• A schemaVersion major bump (e.g., 1.x → 2.x) requires a synchronised renderer release expanding peerSchemaVersion.

The contract is enforced by scripts/check-renderer-alignment.sh (CI step in release-gate.yml). See docs/RELEASE-ENGINEERING.md for the full policy.

Release engineering hardening

Beyond the three bug fixes, v0.2.0-alpha.4 lands the release engineering infrastructure that should have prevented these bugs from shipping in the first place.

scripts/release-gate.sh

The single binary gate every tag must pass. Two modes:

• Local mode (PR CI): structural composer.json validation (composer validate --strict), scripts/ci.sh, scripts/clean-room.sh, doc-version coherence, renderer alignment.
• Live mode (post-tag CI): all of the above plus homepage URLs HTTP 200, composer create-project against Packagist live, non-interactive composer boot smoke, npm registry presence.

scripts/check-renderer-alignment.sh

Enforces the peerSchemaVersion contract. Reads the renderer's declared range and the backend's emitted schemaVersion, verifies satisfaction via npx --yes semver@7 (no global dependency).

scripts/check-doc-version.sh

Reads docs-site/CURRENT_VERSION as the single source of truth for documented version. Queries Packagist for the latest ausus/standard-stack tag, fails on drift. Supports (intentional-lag) marker during release prep windows.

scripts/release-publish.sh

Coordinated subtree-split publish to the 10 rel-* repos. Pre-flight enforces HEAD=main, clean tree, synced with origin. Phase A regenerates all 10 splits from main (deterministic), Phase B detects tag collisions, Phase C tags + pushes per topological level (5 levels). Idempotent on re-run.

GitHub Actions

Four new workflows:

• .github/workflows/release-gate.yml — runs on every PR + push to main.
• .github/workflows/docs-version-check.yml — runs on PR + push + daily cron.
• .github/workflows/npm-publish.yml — triggered by tag push. Publishes with npm publish --provenance (sigstore attestation enabled via permissions: id-token: write). Dist-tag policy: pre-release → @next, stable → @latest, with @latest promoted to the pre-release IFF no stable v1+ exists yet.
• .github/workflows/packagist-validation.yml — triggered by tag push. Polls Packagist with a 180-second per-package budget, then invokes scripts/release-gate.sh in live mode against the published artifacts.

Installation

The validated install procedure for v0.2.0-alpha.4:

composer create-project ausus/starter myapp
cd myapp
composer boot

That's it. No manual composer config step. No --stability=alpha CLI flag required (the starter template sets it).

If you set up the project manually instead of using create-project, you must declare alpha stability at your root:

{
    "minimum-stability": "alpha",
    "prefer-stable": true,
    "require": {
        "ausus/standard-stack": "^0.2@alpha"
    }
}

See Alpha installation requirements for the full explanation.

Troubleshooting

If you hit Your requirements could not be resolved to an installable set of packages, see the new troubleshooting entry: Troubleshooting → alpha resolution failure.

Compatibility matrix

Version	Status	Packaging	Quickstart works	Runtime hardening
v0.1.0	legacy	broken (monorepo-in-tarball)	no	none
v0.1.1	legacy	broken (same defect)	no	partial
v0.2.0-alpha.1	obsolete	broken (same defect)	no	Phase A+B (undelivered)
v0.2.0-alpha.2	fixed packaging	partial constraints	no	Phase A+B+C (server-side)
v0.2.0-alpha.3	fixed packaging	aligned constraints	NO (BUG #1)	Phase A+B+C (distributed)
v0.2.0-alpha.4	current alpha	fully fixed + DX hotfix	YES	Phase A+B+C (distributed)

v0.2.0-alpha.5 will ship the filtering + pagination axis. Architecture already designed and frozen — implementation begins after this hotfix.

Released packages

Package	Version
ausus/kernel	v0.2.0-alpha.4
ausus/runtime-default	v0.2.0-alpha.4
ausus/persistence-sql	v0.2.0-alpha.4
ausus/api-http	v0.2.0-alpha.4
ausus/standard-stack	v0.2.0-alpha.4
ausus/starter	v0.2.0-alpha.4
ausus/tenancy-row	v0.2.0-alpha.4 (name-reserved)
ausus/audit-database	v0.2.0-alpha.4 (name-reserved)
ausus/auth-bridge	v0.2.0-alpha.4 (name-reserved)
ausus/presentation-default	v0.2.0-alpha.4 (name-reserved)
@ausus/renderer-react	0.2.0-alpha.4

What's next

• v0.2.0-alpha.5 — Projection filtering + pagination (cursor-based, AND-only). Architecture frozen, implementation in flight.
• v0.2.0-alpha.6 — Graph diff offline tool.
• v0.2.0-beta.1 — Auth recipes + reference app.

See the v0.2 roadmap for the full sequence.