-
coreci-bot released this
2026-09-13 00:05:37 +00:00 | 0 commits to main since this releaseNextcraft v0.3.5 — Fresh-Box Experience Hotfix
Fixes the three failures a fresh box hit with v0.3.4, and makes the stack reachable from other machines.
Fixes
1. CLI was silent when invoked as a bare PATH command
Node SEA sets
argv[1]to the typed word (nextcraft) rather than the exec path when invoked via PATH, so the direct-run guard never fired — every command exited 0 with zero output. Fixed with the canonicalrequire("node:sea").isSea()probe. If v0.3.4 is installed, re-run the installer to upgrade.2. Bootstrap now survives (and explains) missing python3-venv
bootstrap.shdetects and removes a poisoned partial.venvleft by a failed earlier attempt (previously re-runs skipped creation forever)- Impossible venv creation dies with the distro-specific fix instead of a raw ensurepip traceback:
apt install python3.12-venv(or your python version) doctorgains a venv-capability probe — the failure surfaces before bootstrap runs, with the apt hintbootstrappreflights doctor's checks and aborts early with fix hints before touching anything
3. Installer honesty gate
A binary that produces no
--versionoutput is now rejected at install time ("do not use") — v0.3.4 printed a false "verified" for exactly that case.Network mode (new)
nextcraft devbinds 0.0.0.0:8420 — the stack is reachable from other machines (AI_HOST=127.0.0.1reverts)- The web app derives the API host from the browser hostname at runtime — browse
http://<your-host>:3000from anywhere, zero config (NEXT_PUBLIC_AI_SERVICE_URLoverrides) - CORS + WebSocket origin gates admit any origin by default (
AI_CORS_ORIGINS=*— safe only because credentials are never enabled; set an explicit list to restrict) - Security note: this is an unauthenticated dev API — expose only on trusted networks until identity/KYC lands (v0.5). Abuse caps (per-learner sandbox limits, rate caps, learner allowlist) and telemetry flood control still apply.
Upgrade
curl -fsSL https://git.coreci.dev/coreci/nextcraft/raw/main/scripts/install.sh | sh nextcraft doctor # now includes the venv-capability probe apt install python3.12-venv # once, if doctor flags it (sudo needed) nextcraft bootstrap && nextcraft verify && nextcraft devTest coverage
38 CLI tests (incl. PATH bare-word regression + installer honesty), 3 web tests, 409 ai-service tests — build, typecheck, lint clean.
Downloads
-
2026-09-12 23:17:43 +00:00 | 3 commits to main since this releaseNextcraft v0.3.4 — Milestone v0.4: Distribution & Bootstrap CLI
Founder directive D-016 delivered: streamlined install, a
nextcraftbootstrap CLI with a one-liner install script, and binaries on every ongoing release.Install (linux x64)
curl -fsSL https://git.coreci.dev/coreci/nextcraft/raw/main/scripts/install.sh | sh nextcraft doctorThe installer resolves this release from the Gitea API, verifies the sha256 checksum before install, checks the installed binary reports this release's version, and installs to
~/.local/bin.Milestone summary (all phases, all requirements)
Phase Delivered Tag P0 Specification: REQ-4-001..005 locked, D-033..037 research (Node SEA toolchain probe-verified), G-101..104 grill decisions v0.3.0 P1 Bootstrap CLI core — doctor / bootstrap / verify / dev (REQ-4-001, 002) v0.3.1 P2 Binary build + release pipeline — SEA linux x64 binary + sha256, one-liner install, ongoing release-assets contract (REQ-4-003, 004) v0.3.2 P3 Install docs + fresh-clone E2E — README quickstart matching the tested flow (REQ-4-005) v0.3.3 P4 Final review (install-time version integrity gate P0 fix) + audit — this milestone release v0.3.4 Requirements: 5/5 complete (REQ-4-001..005).
The
nextcraftCLIdoctor— prerequisite checks (node >= 18, pnpm >= 8, python3 >= 3.11, git, unshare) with actionable fix hintsbootstrap— idempotent monorepo setup: pnpm install + ai-service venv +.envfrom template (secrets never generated)verify— stack health check (venv imports, uvicorn, ports, env)dev— ai-service dev server passthrough- Self-contained binary (node runtime embedded, ~117 MB) — runs without node installed
- Zero runtime npm dependencies; exit codes 0/1/2; 34 unit tests + live E2E proven
Ongoing binaries
Every release from v0.3.2 onward carries
nextcraft-linux-x64+nextcraft-linux-x64.sha256assets — enforced at ship time byscripts/release-assets.shand audited at milestone close (G-104).Deferred to v0.5 (per D-016)
Real server STT/TTS, KYC/identity verification + age-gating backend, design/simulation sandbox environments, exec-telemetry seq-lease.
Downloads
-
2026-09-12 23:11:30 +00:00 | -1 commits to main since this releaseNextcraft v0.3.3 — Phase 3: Install Docs + Fresh-Clone E2E
What landed
- Fresh-clone E2E test — real clone → SEA binary
doctor→bootstrap→verify, all green;.envasserted byte-equal to the template; transcript printed. The README documents exactly this flow - Root README quickstart — the one-liner + doctor/bootstrap/verify/dev sequence with expected outcomes; source-bootstrap alternative for pre-binary platforms
- CLI reference — full command table, exit-code contract, troubleshooting table keyed to observed failure modes
Requirements covered
- REQ-4-005 (install docs + E2E) — complete — all 5 v0.4 requirements now complete
Binary
This release carries
nextcraft-linux-x64+ sha256 (the ongoing-binaries contract):curl -fsSL https://git.coreci.dev/coreci/nextcraft/raw/main/scripts/install.sh | shDownloads
- Fresh-clone E2E test — real clone → SEA binary
-
2026-09-12 23:07:34 +00:00 | 1 commits to main since this releaseNextcraft v0.3.2 — Phase 2: Binary Build + Release Pipeline
The first release carrying binaries — every release from v0.3.2 onward ships
nextcraft-linux-x64+ sha256 checksum assets (the ongoing-binaries contract).What landed
- Node SEA binary build (
build-binary) — the CLI compiled to a self-contained linux x64 executable (node runtime embedded; runs without node installed). Build-time version stamping: the binary reports the release it ships in - One-liner install —
curl -fsSL https://git.coreci.dev/coreci/nextcraft/raw/main/scripts/install.sh | sh— resolves the latest release from the Gitea API, downloads the binary + checksum, verifies sha256 before install, installs to~/.local/bin, degrades to printed source-bootstrap instructions on any failure. Checksum mismatch = hard stop - Release-asset pipeline —
scripts/release-assets.sh <tag>attaches binary + checksum to any release; token resolved from.env*files only (never shell env) - 30 unit tests green including install tamper-rejection E2E and poisoned-env token isolation
Requirements covered
- REQ-4-003 (one-liner install) — complete
- REQ-4-004 (binary release pipeline) — complete
Install
curl -fsSL https://git.coreci.dev/coreci/nextcraft/raw/main/scripts/install.sh | sh nextcraft doctorDownloads
- Node SEA binary build (
-
v0.3.1 — Bootstrap CLI Core Stable
2026-09-12 22:40:48 +00:00 | 2 commits to main since this releaseNextcraft v0.3.1 — Phase 1: Bootstrap CLI Core
Milestone v0.4 (Distribution & Bootstrap CLI): the
nextcraftCLI is live — doctor, bootstrap, verify, dev.What landed
nextcraft doctor— prerequisite checks (node >= 18, pnpm >= 8, python3 >= 3.11, git, unshare) with actionable fix hints and honest exit codesnextcraft bootstrap— one command sets up a fresh clone: pnpm install, ai-service venv (via the battle-tested scripts/bootstrap.sh),.envcreated from.env.example(never overwritten, secrets never generated), optional-key warningsnextcraft verify— stack health check: venv imports, uvicorn,.env, AI_PORT free, workspace depsnextcraft dev— signal-forwarding passthrough to the ai-service dev server- Zero runtime npm dependencies (node stdlib only); exit-code contract 0/1/2;
--help/--versioneverywhere - 26 unit tests green; full monorepo build/typecheck/ai-test green; live happy path proven on the reference box
Requirements covered
- REQ-4-001 (doctor) — complete
- REQ-4-002 (bootstrap/verify/dev) — complete
Next
Phase 2 ships the linux x64 binary (Node SEA) + the one-liner install script + the ongoing release-assets pipeline — every release from v0.3.2 onward will carry
nextcraft-linux-x64+ sha256 checksum.Downloads
-
2026-09-12 22:16:30 +00:00 | 3 commits to main since this releaseNextcraft v0.3.0 — Phase 0: Pre-Execution (Milestone v0.4 Distribution & Bootstrap CLI)
Milestone v0.4 scope (founder directive D-016): streamlined install, a
nextcraftbootstrap CLI with a one-liner install script, and binaries on every ongoing release. Previously-named v0.4 seams (real server STT/TTS, KYC/identity, design/simulation sandbox environments, exec-telemetry seq-lease) move to v0.5.What landed in Phase 0
- SPECIFY — REQ-4-001..005 locked: bootstrap CLI (doctor/bootstrap/verify/dev), one-liner install, linux x64 binary release pipeline, install docs
- CLARIFY — A-201..A-210 auto-resolved at full autonomy (toolchain probe-driven, thin-wrapper pattern, Gitea latest-release resolution, ~/.local/bin target, ongoing-binaries contract, graceful degradation, sha256 sidecar trust, doctor prereq set, dev passthrough, secrets policy)
- RESEARCH — probes verified: Go/Rust absent, Node SEA is the toolchain (D-033); Gitea API live (latest release v0.2.8, zero assets — the gap this milestone closes); thin-wrapper architecture (D-034); install path (D-035); ongoing binaries (D-036); package layout (D-037). Persona roster rewritten: cli-engineer added; security-auditor re-activated (phase-specific) for the install pipeline; sandbox/voice/frontend personas deactivated for this milestone
- PLAN — vertical slices: P1 Bootstrap CLI core, P2 Binary build + release pipeline, P3 Install docs + fresh-clone E2E, P4 final review + ship
- GRILL — GO verdict (confidence 0.83); binding decisions G-101 (SEA live-build probe first), G-102 (build-time version stamping), G-103 (install integrity hard-degrade), G-104 (ongoing-binaries enforcement)
- MVP/UX gate — User-Facing Surface / Happy Path / UX Acceptance Criteria sections verified in PLAN.md
Notes
- No code changes in this release — .ciagent/ specification artifacts only
- Binaries begin shipping with the v0.3.2 release (Phase 2) and continue on every release thereafter
Downloads
-
2026-09-12 21:44:58 +00:00 | 6 commits to main since this releaseNextcraft v0.3 — Credential Engines
The six AI tutor agents now operate on REAL credential engines. v0.2's mock-input caveat is retired: Lab/Assessor/Proctor consume live telemetry, stored grades, and defense integrity signals — verified with zero corpus fixtures in the learner path.
Shipped
- Sandbox fabric (REQ-3-001/002): per-learner Linux-namespace sandboxes (unshare user/mount/pid/net — probe-verified isolation), lifecycle API, orphan reaper, G-5 abuse control (allowlist + per-learner/global caps) in place of auth
- Live build telemetry (REQ-3-003): stdlib-only in-sandbox capture agent, WebSocket ingest with (learner,task,seq) dedup, gap detection, 1008 flood close + INCOMPLETE_FLOODED (G-3); at-least-once delivery / exactly-once storage proven end-to-end; SQLite (WAL) first real persistence
- Process-trace grading (REQ-3-004): deterministic digests (D-028 — LLM sees digest only), rubric via the D-020 defense, BINDING G-4 gate (gapped/flooded traces are UNGRADABLE — no credential from an incomplete trace), calibration contract over D-021-aligned archetypes
- Per-learner variants (REQ-3-005): sha256(template|learner|milestone) seeds, typed slot sampling, cache-first (regenerate = zero LLM calls), deterministic fallback; difficulty anchors ship to the grader prompt (a-5 same bar, testable)
- Oral defense (REQ-3-006): seventh Examiner agent grounded in digest + variant statement (learner-anonymous prompts), mock-first VoiceProvider + browser-native fallback (CUT-1: real server STT/TTS is a v0.4 seam), DefenseStore transcript + A-109 long-pause integrity signals, per-turn latency instrumentation
- Learner surface integration (REQ-3-007/008): /build is a real environment (variant + starter files in a live sandbox, file CRUD, Run/Test with read-only output per CUT-2, live telemetry pulse, Lab on the live trace); /defend is a live defense + Grade My Work renders real rubric bars. E2E credential flow proven over real uvicorn + real namespaces
Honest limitations (G-6)
(a) Lab/Assessor/Proctor run on real engine inputs — the v0.2 mock caveat is retired. (b) Sandbox scope = coding IDE only; design tool + simulation are v0.4 (D-025). (c) Identity/age-gating (KYC) deferred per founder directive — age-gating remains the v0.1 visual flow; abuse control ships instead (G-5). (d) Voice is mock-first with browser-native fallback; real server STT/TTS deferred to v0.4 (CUT-1). (e) Sandbox resource limits are PARTIALLY enforced: memory/CPU/single-file/wall-clock kernel-enforced via rlimits; per-sandbox pids + hard disk quota are NOT (no cgroup delegation on this box) — mitigated by the 512MB workdir sweep + per-learner caps. (f) Exec results reach the trace as capture-agent-observed file_diff/activity; command/run/test events fire only in agent REPL mode (grading digests under-represent process on the exec path) — a seq-lease protocol lands in v0.4. (g) Starter tests cannot pass on this box (no pytest in the exec namespace's Python — environmental). (h) Userns is not a DAC write barrier — a per-sandbox runtime uid is the v0.4 hardening.
Quality gates
407 tests green ·
pnpm build4/4 · typecheck 7/7 · ruff clean · P7 review fixed 8 defects (CORS PUT preflight, WS origin gate, symlink escape, ingest session leak, O(n²) flood count, retry sandbox leak, flake de-rat) with 10 regression tests · audit re-pointed two orphaned tags and cleared doc drift across 7 filesPhases: v0.2.1 pre-execution · v0.2.2 sandbox fabric · v0.2.3 telemetry · v0.2.4 grading · v0.2.5 variants · v0.2.6 voice defense · v0.2.7 integration · v0.2.8 milestone release
Downloads
-
v0.2.7 — v0.3 Phase 6 (integration) Pre-Release
2026-09-12 18:31:06 +00:00 | 12 commits to main since this releaseMilestone v0.3 Credential Engines — Phase 6 Agent Re-grounding + Learner Surface Integration shipped.
- Lab/Assessor/Proctor run on REAL engine inputs (live digests, stored grades, defense signals + variant cross-check); v0.2 corpus mocks DORMANT (AST-verified zero production importers)
/build/[competencyId]is a real build surface: per-learner variant + starter files in a live namespace sandbox, file CRUD, Run/Test exec with read-only output (CUT-2), live telemetry pulse, Lab feedback on the live trace, honest 503/403/429 states/defend/[competencyId]is a live defense: examiner questioning grounded in the digest, typed answers first-class (mic capture + browser-SR fallback), verdict + integrity signals, Grade My Work renders real rubric bars from the process trace- E2E credential flow over REAL uvicorn + REAL namespaces: variant → sandbox → exec → trace → grade (seed stamped) → coaching → defense → proctor; zero corpus fixtures in the learner path. E2E caught + fixed a real bug (API dropped task_id → sandboxes were capture-less) and the verifier caught + fixed another (defense keyed on a fabricated task id)
397 tests green;
pnpm build4/4; typecheck FULL TURBO. Known P1 for P7 review: exec results don't yet reach the trace as command/test events (v0.4 fidelity patch).Downloads
-
v0.2.6 — v0.3 Phase 5 (oral/voice defense) Pre-Release
2026-09-12 04:51:51 +00:00 | 20 commits to main since this releaseMilestone v0.3 Credential Engines — Phase 5 Oral/Voice Defense shipped.
VoiceProviderprotocol (D-030, mirrors LLMProvider): deterministic mock (scripted STT, tone-WAV TTS) + browser-native fallback descriptor; factory rejectsopenai-audio— real server STT/TTS honestly deferred to v0.4 (GRILL CUT-1/G-7; the protocol is the drop-in seam)- Examiner — seventh registered agent: Socratic defense questions grounded in the trace digest + variant statement (D-028 anonymity; no learner ids in prompts); final verdict via the D-020 defense
- DefenseStore (4th D-027 store, first with FK): ordered transcript turns + A-109 integrity signals (long pauses computed from turn metadata)
- Endpoints: start / answer (typed or multipart-audio via STT) / streaming TTS / finish (verdict + signals) / transcript GET; per-turn latency instrumentation (stt_ms/llm_ms/tts_ms), 4s conversational budget named for the v0.4 real-voice probe
386 tests green; ruff clean. Verifier caught + fixed 4 P0s with regression tests (dead browser descriptor, sealed-transcript appends, zero-byte-audio 500, verdict persistence).
Downloads
-
v0.2.5 — v0.3 Phase 4 (variant task generation) Pre-Release
2026-09-12 03:51:35 +00:00 | 28 commits to main since this releaseMilestone v0.3 Credential Engines — Phase 4 Variant Task Generation shipped.
- 3 task templates (LLM-judge, schema guardrail, RAG chunker) bound to D-021 corpus competencies; typed parameter slots; seeded pure-code sampler (D-029)
- Seed = sha256(template|learner|milestone): reproducible, auditable, cache-first (regenerate = zero LLM calls)
- Two learners on one template → provably distinct statements/seeds/task_ids (API-level test); deterministic skeleton-render fallback when the LLM render fails
- Difficulty anchors (a-5 fairness envelope) — variants' expected effort bounded to the same bar; anchors + variant seed now ship into the grading engine (prompt envelope + GradeRecord stamp)
- VariantStore (SQLite, insert-only first-wins, unique task_id) — the proctoring audit path
- POST/GET /v1/variants + TS mirror types (TaskVariant, RubricScore, GradeRecord)
327 tests green; typecheck 7/7; ruff clean. Verifier caught two false docstring claims (fixed) and the unwired anchors shipment (fixed in-phase).
Downloads