Release Checklist

A repeatable, artifact-first checklist for cutting a T3MP3ST release. The guiding rule is the same as the project itself: every headline number re-derives from committed artifacts — so a release isn't cut until the deterministic gates and the local smoke path are green.

1. Deterministic gates (must all pass)

npm ci
npm run typecheck            # tsc — 0 errors
npm run build                # tsc build
npm run lint                 # 0 errors (warnings OK)
npm test                     # unit + integration suite
npm run verify-claims        # re-derives every headline number from committed artifacts
npm audit                    # expect 0 vulnerabilities
npm run test:no-fitting      # anti-benchmark-fitting guard
npm run test:no-self-fitting
npm run test:no-phantom-tools
npm run test:gate
npm run prompt:audit

2. Local API smoke (loopback only)

T3MP3ST_PORT=<free-port> npm run server &                 # start on an isolated port
T3MP3ST_PORT=<free-port> npm run smoke                    # health + endpoint smoke
T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run exploit:smoke
T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run field:drill
npm run arsenal:smoke                                     # self-contained, 125 checks

Stop any listeners you started when done.

3. Optional — live checks (network + keys)

npm run smoke -- --live       # exercises a live LLM (needs a provider key or a local agent)
npm run arsenal:doctor        # reports which optional external tools are installed

4. Arsenal prerequisites (optional external tools)

The bash-only path needs no external tools. Specialist operators can use standard offensive tooling if present on PATH; npm run arsenal:doctor reports what's installed. Missing tools degrade gracefully — they never fail the core run.

5. ⚠️ Scope & safety

• Never run live scans or exploitation against a target without an explicit authorization / scope receipt. The default posture is owned / local / synthetic targets only.
• The server binds 127.0.0.1 by default. If you set T3MP3ST_HOST to a non-loopback address, it prints an EXPOSURE WARNING — the API executes commands and has no built-in auth. Put a Bearer-token reverse proxy in front of it before any LAN / internet exposure.

6. Publish

• Verify repository.url in package.json points at this repo. To retarget it:

  npm pkg set repository.url="git+https://github.com/<owner>/<repo>.git"
  

• Tag the release only after Sections 1–2 are green.