chore: release 0.4.0

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mstack",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Portable engineering skills for Codex, Claude Code, OpenCode, and pi.",
   "author": {
     "name": "3metaJun"

CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## 0.4.0 - 2026-09-12
+
+This release adds a shared project workflow for teams using pstack and mstack
+in the same business repository.
+
+### Upgrade notes
+
+- Use `npx --package @3metajun/mstack@0.4.0 mstack-policy --help` to run the new
+  CLI. Reinstall mstack skills to get the shared contract instructions.
+- Adoption is explicit. Initialize the project policy, reconcile existing
+  verification definitions into `.harness/verify/<app>/`, prove the contract
+  against the running app, and generate its wrappers. See the
+  [adoption guide](docs/guide/11-mixed-harness.md).
+- Initialization exports a standalone checker for business CI. Review its
+  updates with the project policy. Configure GitHub branch protection separately.
+
+### Changes
+
+- Add `mstack-policy init`, `wrappers`, `check`, `preflight`, and `record` for
+  project setup, structural checks, isolated Git work, and verification receipts.
+- Keep app contracts, feature maps, and helpers in one canonical directory.
+  Neutral wrappers support Cursor, Grok Bot, Codex, Claude Code, OpenCode, and pi.
+  Cursor and Codex share an `.agents/skills` wrapper to avoid duplicate discovery.
+- Route verification creation, maintenance, setup, and Benny to the shared map.
+  Project entry instructions also direct native pstack to the repository workflow.
+- Check the linked worktree, branch, and base before verification. Record command
+  results and evidence digests, and reject stale or modified receipts.
+- Track reviewed upstream adaptations with source and target digests.
+- Handle Windows path aliases and CRLF receipts, and run the CLI correctly
+  through npm launchers and linked package paths.
+
+### Verification
+
+The implementation passed the Node 18 and 22 CI matrix on Linux, macOS, and
+Windows, package checks, both pinned-source integrity checks, and the meta-mode
+Bun tests and typecheck. Installed tarballs passed CLI checks through npm
+launchers and Windows junctions.
+
+In the inkScroll pilot, Codex with mstack and Grok loading the pinned native
+pstack source completed book creation, reload, IndexedDB readback, and editor
+navigation. Both produced verification receipts and cleaned up their own
+browser and server. This pilot did not test marketplace discovery or audit
+every feature. Receipts check command results and evidence integrity; app
+behavior still needs review.
+
 ## 0.3.0 - 2026-09-11
 
 This release includes the workflow, installation, and model execution fixes

README.md

@@ -323,20 +323,19 @@ uses the current harness's adapter instead of naming one vendor's commands.
 Run `node scripts/validate.mjs` to print the validated skill count.
 
 For a business repository that mixes pstack and mstack, initialize its shared
-project workflow from this checkout:
+project workflow with the CLI available in mstack 0.4.0 and later:
 
 ```bash
-node <mstack-checkout>/scripts/check-harness-policy.mjs init --root <project> --app web --check 'node --test' --pstack <exact-pstack-commit>
+npx --package @3metajun/mstack@0.4.0 mstack-policy init --root <project> --app web --check 'node --test' --pstack <exact-pstack-commit>
 ```
 
 Replace the app, check command, and pstack revision with the project's values.
 Initialization exports `.harness/check.mjs` and its library for committed CI
-checks, without requiring an unpublished npm version. It leaves the application
+checks that run without downloading mstack. It leaves the application
 contract for `/create-verification-skill` to create or migrate and prove. See
 [mixed-Harness adoption](./docs/guide/11-mixed-harness.md) for wrapper generation,
-receipts, repository protection, and reviewed checker upgrades. After a release
-includes this CLI, use its exact package version for initialization and run
-recording.
+receipts, repository protection, and reviewed checker upgrades. Pin the team's
+exact package version for initialization and run recording.
 
 To validate and print a user's model configuration, run:
 

docs/guide/11-mixed-harness.md

@@ -5,20 +5,21 @@ mstack in Codex, Claude Code, OpenCode, or pi. Cursor and Grok Bot can also use
 mstack when installed. Keep each person's workflow installation separate while
 the repository owns one verification contract per app.
 
-The commands below use `mstack-policy`. This checkout adds the command; older
-npm releases do not contain it. During development, replace `mstack-policy` with
-`node <mstack-checkout>/scripts/check-harness-policy.mjs`. After a release that
-contains this command, invoke the team's exact package version with:
+The commands below use `mstack-policy`, available in mstack 0.4.0 and later.
+Invoke the team's exact package version with:
 
 ```bash
-npx --package @3metajun/mstack@<version> mstack-policy --help
+npx --package @3metajun/mstack@0.4.0 mstack-policy --help
 ```
 
+For the remaining examples, replace `mstack-policy` with
+`npx --package @3metajun/mstack@0.4.0 mstack-policy`. During development, use
+`node <mstack-checkout>/scripts/check-harness-policy.mjs` instead.
+
 Initialization exports a structural checker that CI runs from the business
-repository. CI does not need to download this unreleased package. The full CLI
-still comes from the reviewed development checkout or, after release, an exact
-package version. Replace every example version, commit, command, app ID, and
-repository path with the team's actual value.
+repository without downloading mstack. The full CLI comes from the team's
+exact package version or reviewed development checkout. Replace every example
+version, commit, command, app ID, and repository path with the team's actual value.
 
 ## Initialize the shared project workflow
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@3metajun/mstack",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Portable engineering skills for Codex, Claude Code, OpenCode, and pi.",
   "repository": {
     "type": "git",