SDK 2.0.0-rc.3 tester-beta consolidation

Prepared 2026-10-08. The private root and all eight canonical package manifests are now 2.0.0-rc.3, versioned with the existing Changesets RC workflow and packed locally. No publication, stable promotion, deployment, production reset, or security-epoch activation was performed. Tester-beta is the rollout audience, not a new npm beta tag.

Published baseline and source boundary

Read-only, credential-free queries to https://registry.npmjs.org/@u-net%2fNAME confirmed the following for client, contracts, issuer, react, server, setup, verification, and web-login on October 8:

• next: 2.0.0-rc.2; latest: 1.0.0.
• The only published 2.0.0-* version is rc.2, published September 16.
• Local tag sdk-v2.0.0-rc.2 resolves to 87fdc95112bf262e915ef11485eae8032ff662c8.
• Pre-consolidation source HEAD is 14d9278628ec37f93236085e94375b8e4cb75cc6 on security/browser-bound-login-2rc, 48 commits ahead of its local tracked ref. No fetch or remote-branch comparison was performed.

The eight Changesets have been applied and archived under .changeset/pre/, producing 2.0.0-rc.3 for every canonical package in the fixed release group. .changeset/pre.json remains in pre mode with tag rc; retain it and all archived records. Do not exit prerelease mode. Compatibility forwarders and private examples were not version-bumped and are not in the publication loop. The offline frozen lockfile-only check passed without modifying pnpm-lock.yaml: workspace links and dependency specifiers did not change with this version bump.

Do not repack this source as rc.2 for a new release. npm rc.2 is immutable, and same-version local artifacts do not identify the already-published bytes. Pin matching rc.3 tarballs and their new SHA-256 manifest for tester handoff.

Included local security and interface checkpoints

These are source commits after the published baseline, not claims about rc.2:

Commit	Candidate change
40604242289807f840989fb9b1dab423459a2744	Header-only delivery capabilities; sanitized issuer adapter failures
9f9763008031c6fd7a39c9900cf0de3c662e4e2c	Asymmetric V2 domain-admin authorization and durable nonce consumption required; v1/HMAC rejected
3e3ca90962d02faf68ba7f8e6ca0ef63b19ec3fc	Verified anchor reconciliation contract and recovery transaction composition
daeabb2f0ff6e48ec0d69d8f161d1346699125c4	Atomic authenticated admission using wallet-owned capability hashes
d6cc17073fd9340b27e3c29320a2ea5fb838c09c	Pinned provider transaction hooks and frozen recovery schema
f39ef49d93cf257856fae7fc9d5a49bea9197f96	Explicit staged issuer recovery exports
3626690b0110ca5a4c9562ab5eb5320bbb64e84d	Append-only signed attempts and bounded, fair retry reconciliation
82a5164e5811f76b5c2015776c43a1ddce08c99f	Exact commitment validation on repeated delivery acknowledgements
b336237259ecc6b94765eea44f9eada215f205b5	Shared transactional issuer lane, target/expiry helpers, pinned ethers dependency
14d9278628ec37f93236085e94375b8e4cb75cc6	Private experiment runners excluded from public SDK tests

The security migration, callback requirements, and acceptance ledger describe the required consumer changes and limits of prior evidence. Historical query capability exposure is not repaired by switching transports.

Local delta boundary

At initial inspection the index contained no staged changes. These existing dirty paths were handled explicitly:

• docs/concepts/privacy-design-follow-up.md: unrelated research notes, preserved and excluded from the release commit.
• experiments/: untracked private standards work, outside the public workspace train and explicitly excluded from root Vitest and the release commit.
• packages/server/src/webAdaptersPostgres.test.ts: selected for the release commit. Reviewed for secrets: no embedded private keys or connection values; keys are runtime-generated, the URL is environment-only, the dedicated test database is required, and random-schema fixtures clean up only their schema. Its three real database cases remain unexecuted locally.

Two narrowly required release checks also changed: the issuer-lane test now compares its version with the root and retains the SDK 2 RC-only constraint instead of hard-coding rc.2; the contracts API baseline now records the existing anchor-reconciliation endpoint exposed by the clean build. No contract behavior was changed by regenerating that baseline. The issuer recovery guide uses a root-relative admission link so its TypeDoc media copy also resolves correctly. Unrelated privacy-page edits were not fixed or included merely to make a dirty-checkout docs build pass.

Do not copy experiment secrets or test private keys into a release checkout. The packaged smoke test now asserts the staged issuer recovery/lane exports as well as all eight imports and browser-bound login exchange/replay behavior.

Validation commands and parent handoff

Versioning is already applied. Do not run version-packages again for this candidate. The private root, which Changesets does not bump, was aligned explicitly to rc.3. Reproduce the release checks from the parent-selected commit:

mkdir -p artifacts
pnpm install --frozen-lockfile
pnpm release:check
pnpm contracts:generate
pnpm typecheck
pnpm test
pnpm build
pnpm api:report
pnpm pack:dry
pnpm publint
pnpm attw
pnpm docs:build

Review all generated version/changelog/Changesets changes and generated API/docs drift. Run the tests with an isolated PostgreSQL 17 unet_security_test database using UNET_SECURITY_TEST_POSTGRES_URL, without printing its value; absent database configuration skips the real database cases and is not release acceptance.

In a disposable consumer install only required packages and their matching canonical transitive dependencies from the exact eight rc.3 tarballs in one package-manager transaction, or use consumer-local overrides. Place only scripts/packed-release-smoke.mjs in that consumer and run node packed-release-smoke.mjs there so package resolution uses its installation, not the SDK checkout's dependencies. Never install issuer/setup into a browser app. Record the manifest hashes and test receipt; old rc.2 receipts do not cover rc.3.

Before any separately authorized tag operation, validate the expected CI tag:

$env:GITHUB_REF_NAME = 'sdk-v2.0.0-rc.3'
pnpm release:check
Remove-Item Env:GITHUB_REF_NAME

Tagged-release checks reject version mismatch, unsupported prerelease suffixes, unapplied Changesets, missing/wrong RC mode, and stable versions while prerelease mode is active. Untagged checks permit preparation with pending Changesets. This guard is not a substitute for comparing candidate artifacts with npm.

October 8 local validation

Node 24.18.0, cached pnpm 10.33.0, existing installed external dependencies, all canonical packages and root at rc.3:

• Full root Vitest: 23 files / 919 tests passed; two PostgreSQL files / eight cases skipped. This includes the selected three-case adapter file.
• Focused server/web-login/react/issuer run: 901 passed, eight skipped.
• New tagged-release regression suite: ten passed, including positive RC and historical stable paths and fail-closed pending/mode/tag cases.
• TypeScript workspace graph checking and a forced rebuild passed across all canonical packages, compatibility forwarders and typed examples. The actual clean pnpm build also passed, including generation and normalization.
• The newly selected SQL test and release-check test pass explicit no-emit TypeScript checking; database execution remains unavailable.
• Strict API Extractor passed for all eight packages after refreshing the contracts baseline.
• TypeDoc generation and a bounded VitePress candidate build passed. The latter used tracked docs with only the selected release edits overlaid, excluding dirty privacy notes. The initial dirty-checkout docs run failed on that page's experiment link and the now-fixed issuer media link; it remains a failed run. A local generated Vue junction resolved the earlier Windows symlink error. Documentation bundle-size warnings remain non-fatal.
• Untagged and simulated sdk-v2.0.0-rc.3 release metadata checks passed with applied Changesets and active RC mode.
• All eight rc.3 tarballs were freshly packed. Publint packing checks and attw passed with the repository's esm-only profile; CommonJS remains unsupported.
• An extracted consumer passed all eight imports, staged issuer/lane exports, and browser-bound exchange/missing-cookie/replay checks. Its inventory, embedded versions, internal ^2.0.0-rc.3 ranges and SHA-256 hashes were checked. External libraries were reused from the SDK's installed dependency tree, not obtained through a fresh consumer installation.
• Offline frozen lockfile-only validation passed across all 20 workspace projects using an SDK-local store. No lockfile churn was needed.

The global pnpm launcher could not fetch its runtime; local checks instead used the already-cached .tooling/package/bin/pnpm.cjs 10.33.0 runtime. A generated, ignored SDK-local shim supplied that runtime to nested build/publint commands. The frozen lockfile-only command was node .tooling/package/bin/pnpm.cjs install --lockfile-only --frozen-lockfile --offline --ignore-scripts --store-dir .pnpm-store. This is not a complete fresh dependency installation. No real PostgreSQL or Node 20/22 rerun is claimed.

Local artifact block (generated, ignored, not committed):

• artifacts/2.0.0-rc.3-manifest.json: exact eight paths and SHA-256 hashes.
• artifacts/u-net-{client,contracts,issuer,react,server,setup,verification,web-login}-2.0.0-rc.3.tgz.
• artifacts/2.0.0-rc.3-consumer-receipt.json: exact-artifact smoke result and the installed-external-dependency limitation.
• artifacts/2.0.0-rc.3-docs-receipt.json: bounded candidate docs-build result.
• artifacts/2.0.0-rc.3-candidate-receipt.json: generated after committing, records the exact candidate HEAD, changed paths, validation and artifact block.

Repacking must refresh the manifest and consumer receipt. The parent should produce clean CI artifacts and compare their hashes with its own test receipts.

CI and remaining gates

The existing release workflow runs on sdk-v* tags. RC tags select the protected npm-prerelease environment and npm next, not latest. It uses Node 22, pnpm 10.33.0, npm 11.16.0, PostgreSQL 17, frozen installation, release checks, tests/build/docs, strict API reports, generated-file drift detection, tarball checksums, publint and attw before publishing the exact tarballs with provenance. Ordinary CI checks Node 20 and 22. Environment authorization and git operations belong to the parent; this preparation does not perform them.

Release blockers:

• Parent selects the consolidated commit for PR/OIDC. The selected SQL test, versioned metadata and archived Changesets are part of this candidate.
• Pass the committed-source Node 20/22 matrix, real PostgreSQL tests, clean frozen installation and fresh consumer installation. Local Node 24 artifacts and component smoke do not substitute for that matrix.
• Verify maintained providers' installed/bundled candidate, browser-bound login, header-only delivery, V2 callbacks with durable nonce stores, authenticated hash-only admission, recovery/publication transaction hooks and issuer-wide coordination. Component receipts do not certify the completed rollout.
• Parent-owned full wallet/device and deployed-service acceptance, legacy session/capability cutover, and production/security activation remain separate gates. This SDK work does not close them or approve stable promotion.
• Publication and tagging remain separately controlled. Do not publish rc.2 again, use a stable tag, rewrite old tags, or treat @next as the new candidate.