AUSUS v0.2.0-alpha.5 — Documentation and CI hotfix

Documentation, packaging-metadata, and CI release. No runtime changes, no architectural changes, no new features, no public API changes. A correctness pass on top of v0.2.0-alpha.4 that closes two issues observed during real-world install attempts.

Overview

Two issues surfaced after v0.2.0-alpha.4 reached Packagist:

• @ausus/renderer-react@0.2.0-alpha.4 failed to publish to npm because the package's repository.url did not match the GitHub Actions repository that carries the release workflow, breaking the sigstore provenance attestation. The renderer remained at 0.1.1 on the public npm registry while the PHP packages advertised 0.2.0-alpha.4.
• The documented quickstart command composer create-project ausus/starter myapp (without an explicit --stability=alpha flag) defaulted to Composer's minimum-stability=stable, which resolves to the legacy v0.1.x line on Packagist instead of the v0.2 alpha chain. The starter's own minimum-stability: alpha declaration is read after the resolver has already picked a version, so it could not influence the selection.

v0.2.0-alpha.5 corrects both — exclusively through package metadata, documentation, and CI changes. The PHP runtime, React renderer runtime, public API surface, and ViewSchema wire format are bit-identical to v0.2.0-alpha.4.

Fixed

• Renderer npm provenance. renderer/react/package.json repository.url and homepage now point at https://github.com/adonko3xBitters/ausus-framework, matching the GitHub Actions repository that runs npm publish --provenance. The sigstore bundle now validates and the renderer can land on the public npm registry.

• Documented quickstart updated. The canonical install command in docs-site/docs/getting-started/installation.md and README.md now requests the alpha channel explicitly:

  composer create-project "ausus/starter:^0.2@alpha" myapp --stability=alpha

  This is the install command for every v0.2.x alpha until the first stable AUSUS release.

• Troubleshooting coverage extended. Two new entries in docs-site/docs/tutorial/troubleshooting.md:

  • create-project installs the monorepo instead of the starter — symptoms, cause (Composer's default minimum-stability=stable resolving to legacy 0.1.x), and the corrected install command.
  • composer boot returns Command "boot" is not defined — same root cause, same resolution (re-run with the explicit alpha selector).

v0.2.0-alpha.4 retrospective

The earlier release notes implied that composer create-project handled the alpha stability automatically through the scaffolded composer.json. The documented procedure has been clarified to match Composer's actual resolution behaviour: the stability flag must currently be requested explicitly.

CI / Release Engineering

• Clean-room install gate added. scripts/release-gate.sh Step 9 (live mode only) invokes the new scripts/clean-room-install-test.sh, which runs the exact documented quickstart in a throwaway temp directory against the live Packagist registry and verifies five gates:

  Gate	Check
  A	None of packages/, apps/, docs-site/, renderer/, .github/, scripts/ is present in the scaffold.
  B	The scaffold's composer.json has name == ausus/starter.
  C	The scaffold's composer.json has no non-empty repositories[] entry.
  D	composer boot --no-interaction succeeds.
  E	Every required ausus/* package installs at the expected version.

  Each gate emits ::error:: markers on failure. The gate is the publication invariant that should have caught the v0.2.0-alpha.4 quickstart regression before tag push.

• Exit-code surface extended. scripts/release-gate.sh now documents exit code 8 = clean-room starter install failure (live mode).

• Local-mode skip notice. When release-gate.sh runs in local mode (RELEASE_GATE_LIVE != 1), it now emits an explicit clean-room starter install skipped notice so the skip is visible in PR CI logs.

Installation

Canonical install command for v0.2.x alphas:

composer create-project "ausus/starter:^0.2@alpha" myapp --stability=alpha
cd myapp
composer boot

If you set up the project manually instead of using create-project, declare alpha stability at your root:

{
    "minimum-stability": "alpha",
    "prefer-stable": true,
    "require": {
        "ausus/standard-stack": "^0.2@alpha"
    }
}

See Alpha installation requirements for the full explanation, and Troubleshooting if the install does not behave as expected.

Renderer React

@ausus/renderer-react@0.2.0-alpha.5 ships the corrected repository.url and homepage package metadata.

• No TypeScript, JavaScript, or React runtime change.
• peerSchemaVersion stays at ^1.0.0.
• Backend schemaVersion stays at 1.0.0.
• peerDependencies, exports, build scripts, and bundle shape are unchanged.

The published artifact reflects the metadata fix; the renderer is otherwise bit-identical to 0.2.0-alpha.4.

Known limitations

• No runtime change since v0.2.0-alpha.4. The kernel, runtime, persistence, HTTP API surface, error taxonomy, and ViewSchema wire format are bit-identical to v0.2.0-alpha.4. No public PHP API has been added, removed, or renamed.
• Composer --stability=alpha is still required. Composer defaults to minimum-stability=stable and cannot resolve the v0.2 alpha chain without the explicit flag. This is documented standard Composer behaviour and will only be removed when AUSUS ships a stable v1.0.0.
• Filtering and pagination remain deferred. The original v0.2.0-alpha.5 scope (cursor-based AND-only projection filtering) is not part of this release. The architecture is frozen; implementation continues separately on a future alpha.

Released packages

Package	Version
ausus/kernel	v0.2.0-alpha.5
ausus/runtime-default	v0.2.0-alpha.5
ausus/persistence-sql	v0.2.0-alpha.5
ausus/api-http	v0.2.0-alpha.5
ausus/standard-stack	v0.2.0-alpha.5
ausus/starter	v0.2.0-alpha.5
ausus/tenancy-row	v0.2.0-alpha.5 (name-reserved)
ausus/audit-database	v0.2.0-alpha.5 (name-reserved)
ausus/auth-bridge	v0.2.0-alpha.5 (name-reserved)
ausus/presentation-default	v0.2.0-alpha.5 (name-reserved)
@ausus/renderer-react	0.2.0-alpha.5