publish a release set that matches the engine pair (0.2.23, closes #141)

[moonweave]

Closes #141.

The drift, and which half actually mattered

The published product line sat at v0.2.22 while main carried an engine lock for witnessd 2.34.0 and witnessd had gone on to release 2.35.0, 2.36.0 and 2.37.0. Half of that is mine: I advanced the lock repeatedly without cutting a release, then stopped advancing it at all.

The half that mattered more was the dependency floor. witnessd>=2.4.0,<3.0.0 was merely loose until the session skill surface began being delivered by witnessd — orro skill install in 2.35.0, the separate read-only orro-inspect skill in 2.36.0. From that point a pip install orro could resolve an engine with none of the commands our documentation teaches. That is a user-facing break rather than metadata untidiness, and it is why the floor moves rather than just the lock.

What this publishes

The 0.2.23 release set pins witnessd 2.37.0 (8ab96fc, tag v2.37.0) and Depone 0.2.11 (b471b47, tag v0.2.11), with the compatibility matrix, pinned-engine fallback doc, packaging plan and release-state expectations moved together, and release notes naming the exact commits. The declared requirement becomes witnessd>=2.37.0,<3.0.0, so the floor guarantees the surface the docs describe.

What stops it happening again

A new checker asserts two things: the locked witnessd version must satisfy the declared dependency range, and the declared floor must be at least the locked version. The second is the one with teeth — it makes advancing the engine pair without publishing a matching release a red build, which is exactly what the issue asked for. It ships with a --self-test like its neighbours and both run in CI. Verified in both directions: lowering the floor below the lock fails with "declared witnessd floor must be greater than or equal to the locked version", and raising the lock past the upper bound fails with "locked witnessd version must satisfy the declared dependency range".

The wrapper's delegation behaviour, command surface and skill artifacts are untouched — this is packaging and release metadata only.

Checker inventory: three pre-existing environment failures remain, one fewer than before, since a stale version string in the repository-contract checker was corrected along the way.

🤖 Generated with Claude Code