This repository is the canonical source for the standalone adapter. Release only after independent review and the approved real-contract matrix; do not publish artifacts or update Lody's manifest from an unreviewed branch.
- Confirm canonical repository ownership and maintainer permissions.
- Keep the adapter independent from Lody's workspace and use a released,
pinned
acp-extension-coredependency. - Pass synthetic tests and the approved OMP version matrix.
- Review every advertised ACP capability against real-contract evidence.
- Run the build in a clean environment with a locked dependency graph.
- Inspect the npm archive file list for generated caches, sessions and
node_modules; independently install and smoke it. - Have an independent reviewer inspect source, tests, and release bytes.
- Build the adapter reproducibly from a tagged source revision, and record the Node and npm versions used: the archive's gzip bytes differ between toolchains even when its contents are identical.
- Record the generated archive's exact byte size and SHA-256.
- Publish only through the maintainer-approved immutable artifact channel.
- Fetch the public artifact again and read back its actual bytes, size, and SHA-256.
- Compare the public read-back with the generated values.
- Only then update Lody's pinned runtime manifest.
OMP itself remains user-installed and is never included in the adapter artifact. No credential, cookie, token, or provider configuration belongs in release outputs or logs.