[abruption]

Summary

Closes #135. Refs #133 #118 (closed by merged #134). Prepare session-peer@0.3.4; no staging or publication.

Base main: c210ee963741f77153df10038c28e228ea7a902f, merge of #134. Exact-base main CLI38191285491 and CodeQL38191285293 passed, including Windows Node22/24. Draft #106–#109 and #82 remain excluded; no 0.4 API promotion.

• Align package/lock/runtime banner, successful SSH fixtures, update current0.3.4/future0.3.5 fixtures, four README/guide current installation examples, API and shorthand references.
• Release baseline: previous stable0.3.3 with exact registry integrity, preview0.1.0-preview.1 unchanged. Existing workflow, dependencies, engines, allowlist and publication protections unchanged.
• Preserve exact finite reviewed skill profiles, published skill0.2.0 pin8482cf644507c682915e35c85aa3384c53864906, full0.3.2 metadata and historical public0.3.3 behavior; compiled0.3.4 accepts the same two profiles, unreviewed0.3.5 refuses. Keep Python1.0.2 parity/reference unchanged.
• Correct stale migration summaries that still described the already published successor skill as Draft. Preserve dated evidence and distinguish current package examples from historical release/physical validation.

Validation

Local macOS arm64 / Node24.16.0 / npm11.15.0:

• npm ci --ignore-scripts, npm run build, npm run test:types: PASS.
• npm test: 190 total /185 PASS/0 FAIL/5 Windows-only SKIP, using existing verified Python1.0.2 reference. Initial run183/2/5 failed two old update-notice regex expectations; corrected only their versions and reran the full suite successfully.
• npm run test:package: PASS, reproducible packing, isolated install/removal, bash/zsh shorthand contract+lifecycle.
• node scripts/check-repository.mjs, git diff --check: PASS. npm audit: zero vulnerabilities.
• node scripts/release.mjs pack and node scripts/release.mjs artifact: PASS, double-pack reproducibility and isolated exact-tarball version/list/install/uninstall. All18 packed Markdown documents byte-match exact committed source, including4README+4guide, API/shorthand/design/PARITY/VALIDATION/RELEASING.

Exact local artifact source: f106def875b06404a8a952f18f49a6e32d3df675.
SHA-256: a0026b157ca9444931243cb60416ac24ad773bd118425852650e6671a545d773.
Integrity: sha512-1sKE+hYoN3ECFq/1r2bZ9SGUzqXxyn7G5WXmvFP1Q79Thfz2g0bWNj7/3FC3Uw9mtoiZdiEadhVpsueY2gz2PQ==.
57allowlisted files. This is a local preparation artifact, not an Actions staging artifact; a future merged source requires its own artifact/hash.

Physical Windows24synthetic cases were run for the #134 correction at0.3.3, not newly for0.3.4. No live agent queue/injection/ACK experiment, global/fleet installation, operational change or new platform qualification. Current-head Windows CI and automatic Code/Security review results will be recorded separately; not inferred from macOS skips.

Release boundary

Registry read2026-10-12: latest0.3.3, preview0.1.0-preview.1,0.3.4 absent. Authenticated pending-stage/ownership/Trusted Publisher/packageMFA settings were not audited during preparation. This PR does not approve dispatch, environment, npm2FA, tag, GitHubRelease or publication. After human preparation merge: exact-main CI, fresh publication gates, exactSHA/0.3.4/stable-stage/latest approval and Actions artifact documentation/provenance review remain required. SSH endpoints need identical0.3.4 banners; managers own upgrades. No uncertain-send fallback/resubmit.

Final current-head checks

Head f106def875b06404a8a952f18f49a6e32d3df675: all 12 checks PASS, with no reruns. CLI run 38191640350 includes macOS/Ubuntu Node 22/24, Windows-native Node 22/24, policy and release gate; CodeQL run 38191639244 and GitGuardian passed.

The automatically triggered Code Review and Security Review both completed on that exact head, with no findings. No manual review mentions were sent. This preparation PR is OPEN, has no auto-merge, and awaits the human merge gate. No staging, tag, GitHub release or npm publication has run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T01:24:37.648182Z	f106def	PR opened
🔒 Security Review	✅ Completed 2026-10-12T01:24:59.603751Z	f106def	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Exact merged-main preparation verification — 2026-10-12 KST

Main/source: 1c99b39138c26a5ec08245f78f133d058bc354f0. Its source tree is byte-identical to reviewed preparation head f106def875b06404a8a952f18f49a6e32d3df675.

Exact-main CLI38192137923 and CodeQL38192137805 completed successfully, including macOS/Ubuntu Node22/24, Windows-native22/24, policy and release gate.

Built from exact merged source; release.mjs pack/artifact passed double-pack reproducibility and isolated version/list/install/removal. All18 packed Markdown documents byte-match the exact commit. Local tarball SHA256: a0026b157ca9444931243cb60416ac24ad773bd118425852650e6671a545d773; integrity: sha512-1sKE+hYoN3ECFq/1r2bZ9SGUzqXxyn7G5WXmvFP1Q79Thfz2g0bWNj7/3FC3Uw9mtoiZdiEadhVpsueY2gz2PQ==.

Public registry remains latest0.3.3/preview0.1.0-preview.1;0.3.4 absent. Previous0.3.3 provenance metadata identifies c0ed302 and .github/workflows/publish.yml; this content read is not fresh cryptographic verification. GitHub npm environment remains reviewer abruption, bypassfalse, mainonly, repo/environment secrets0.

Authenticated npm whoami/stage/trust reads returned E401 and remain blocked pending operator login. Ownership/MFA/Trusted Publisher/pending stages are not freshly established. No workflow dispatch, stage upload/approval, tag, release, publication or fleet operation has occurred. Exact-source stable-stage/latest approval and separate environment/npm2FA gates remain required by RELEASING.md.

[abruption]

Operator-directed settings-read exception — 0.3.4, 2026-10-12 KST

The operator explicitly instructed skipping fresh Trusted Publisher and package publish-MFA policy reads for this 0.3.4 release. npm trust returned EOTP; the settings page requested a separate security-key reauthentication. Those two current settings remain unverified, not passed. No setting, permission or authentication method has been changed. This exception does not waive protected GitHub environment review or final npm2FA stage approval, and does not carry forward to a later release.

Remaining reads rechecked: authenticated npm login, single maintainer abruption, public access, no pending stages, latest0.3.3, preview0.1.0-preview.1,0.3.4 absent and unchanged previous stable integrity. GitHub npm environment: required reviewer abruption, admins bypassfalse, mainonly, repo/environment Actions secrets0.

Exact main remains 1c99b39138c26a5ec08245f78f133d058bc354f0; exact-main CLI38192137923 and CodeQL38192137805 are successful. Exact-source local artifact validation passes with SHA256 a0026b157ca9444931243cb60416ac24ad773bd118425852650e6671a545d773.

Separate exact-main/0.3.4/stable-stage/latest-promotion approval required by RELEASING.md step4 is pending. No dispatch, upload, stage approval, tag, GitHub release, publication or fleet operation has occurred. The reviewed source/artifact is unchanged; this exception is an external approval record, not a source or package rewrite.

[abruption]

Exact-source stable-stage approval and dispatch — 2026-10-12 KST

The operator approved exact main 1c99b39138c26a5ec08245f78f133d058bc354f0 / session-peer@0.3.4 / stable-stage, with eventual latest promotion after separate npm stage approval. The current-settings read exception recorded above remains limited to this version. GitHub environment and finalnpm2FA approval remain separate.

Dispatched publish.yml once on main with those exact inputs and confirmation session-peer@0.3.4 stable-stage: run38193012263. Its headSHA matches the approved main. No retry/permission change/token fallback. Prepare artifact review is pending; no protected environment approval or public publication is claimed.

[abruption]

Prepare artifact rejected before upload

Run38193012263 prepare succeeded, but manual packaged-document review found stale current compiledVERSION0.3.3 descriptions in the0.3.4 design/PARITY. Actions/local artifact bytes match, so automated success does not override this prose failure.

The workflow was cancelled while waiting for protected npm environment approval: prepare success / publish cancelled. No npm upload or public publication. No stage-approval retry or publisher permission change.

Correction issue#137 and PR#138 change only3Markdown files. Independent local artifact prose review passed for source5771b70c4da6125ab57f1f66c7b890f8b7d60e05 / SHA2566c8cb114485e067ac3e7f5792de7febf3680cb14dcda6e2c67df6cab773ca03c. Current-head CI/review and humanmerge/newexactsourceapproval remain. The prior approvedSHA is not replayed against changed bytes.