FAI Orchard v1 — Aggregate Changelog
Single source of truth for what shipped at v1.0 GA across all 5 packages, the Docker image, and the supply-chain attestations.
Every claim on this page has a verifiable artifact at a stable URL or a CLI invocation that confirms it.
§1 — Package versions at GA
| Package | Version | Distribution |
|---|---|---|
| `@frootai/mcp-orchard` | 1.0.0 | npm (Sigstore + publish attestations) |
| `@frootai/sdk-orchard` | 1.0.0 | npm (TypeScript SDK) |
| `frootai-mcp-orchard` | 1.0.0 | PyPI (PEP 740 attestations on wheel + sdist) |
| `frootai-sdk-orchard` | 1.0.0 | PyPI (Python SDK) |
| `ghcr.io/frootai/mcp-orchard` | 1.0.0 | GitHub Container Registry (cosign keyless OIDC signed) |
All 5 packages locked at `1.0.0` by `check-cross-package-versions.js` operator CLI. Breaking changes ship at `v2.0` only, with a 6-month minimum deprecation window enforced by the warn-once-per-process deprecation framework (currently quiescent — no symbols deprecated at v1.0).
§2 — semver discipline
- Repo-root `STABILITY.md` defines the public-surface contract.
- Per-package `STABILITY.md` in all 5 packages enumerates every export.
- Deprecation framework: warn-once-per-process, opt-out via `FROOTAI_SUPPRESS_DEPRECATIONS=1`.
- LTS backports for current minor + previous minor.
§3 — Cross-runtime byte-equal conformance
The same 27 MCP contract assertions run against:
- `@frootai/mcp-orchard` (npm)
- `frootai-mcp-orchard` (PyPI)
- VSCode-embedded MCP server (uses the same `createServer` code path)
Cross-runtime conformance certificate (SHA-256-fingerprinted) is uploaded as a workflow artifact on every release. The JSON schema for the certificate is at /schema/conformance-certificate-v1.json.
§4 — Supply-chain hardening (5 attestation kinds)
| Layer | Attestation | Verifier |
|---|---|---|
| npm | Sigstore provenance + publish attestations | `npm audit signatures` |
| PyPI | PEP 740 (every file: wheel + sdist) | https://pypi.org/project/frootai-mcp-orchard/1.0.0/ |
| Docker | cosign keyless OIDC on `image@digest` | `cosign verify ghcr.io/frootai/mcp-orchard:1.0.0` |
| Docker | CycloneDX 1.5 SBOM | `cosign verify-attestation --type cyclonedx` |
| All artifacts | SLSA v1.0 Build L3 provenance | `gh attestation verify` |
End-to-end runbook CLI: `node frootai-core/scripts/orchard/verify-supply-chain.js --tag orchard-v1.0.0-mcp --json`
Full tracker: `planning/listings/supply-chain-attestations.md`.
§5 — Multi-region tenancy
| Region | Status |
|---|---|
| `us-east` | ✅ live |
| `eu-west` | ✅ live |
| `ap-south` | ✅ live |
Cross-region READ requires `cross-region:read` entitlement (auto-granted to enterprise tier). Cross-region WRITE is locked to DENY — even with maximal entitlements — as a tested invariant.
§6 — Self-host edition
```bash docker pull ghcr.io/frootai/mcp-orchard:1.0.0 ```
- Multi-stage Alpine base
- Non-root user (UID 1001)
- HEALTHCHECK via Node built-in fetch
- EXPOSE 3000
- Zero `npm install` inside the image (air-gap friendly)
- Multi-arch: `linux/amd64` + `linux/arm64`
See Self-host guide for the full deploy runbook + Redis rate-limiter backend setup + graceful-shutdown contract.
§7 — By the numbers at GA
| Metric | Value |
|---|---|
| Packages locked | 5 at 1.0.0 |
| Regression cases | 5,969+ |
| Test suites | 109 (0 failed) |
| Cross-runtime byte-equal contracts | 27/27 |
| Phase-close verification gates | 34/34 |
| Per-package tarball size budget | ≤ 128 KiB |
| Regression wall-clock budget | < 120 s |
| MCP tools / prompts / resources | 5 / 6 / 1 |
§8 — What's NOT in v1.0 (deferred to Phase A11+)
- Public case studies (logos under NDA until case-study waivers land)
- Recorded GIF demos per major MCP client
- Smithery + Glama verified-publisher badges (submitted; awaiting verification — see tracker)
- Per-Variety regional accelerator hubs (azure/oss live; gcp/aws/hybrid deferred to multi-cloud expansion)
- Enterprise SSO MFA + agent skill marketplace
- Phase B0 edge-runtime migration of the API surface (in-progress; see masterplan §11.5 — 50% as of 2026-05-29)