chore(release): prepare 0.4.0 scoped delivery observation

[abruption]

Summary

Closes #150. Refs #69 #70 #71 #72.

Prepare session-peer@0.4.0 after the authorized sequential merges. This is a reviewable preparation PR, not staging/publication approval. No automatic merge is configured.

• Version/package/banner/current examples: 0.4.0. Stable baseline: public 0.3.6, exact integrity pinned; preview 0.1.0-preview.1 unchanged.
• Preserve ordinary opt-out status/fields/exits, frozen handoff document/fixture and hash-checked Python 1.1.0 ordinary comparison source.
• Explicit finite 0.4.0 skill row: published 0.1.0/0.2.0/0.2.1 plus the exact proposed 0.3.0/typescript/min0.1.0/full0.4.0/probe-help tuple. Complete 20,162-byte companion Draft test: complete 0.1.1 verification and parity documentation #37 fixture b8ff909 /SHA-256 1ae3690cb5d03777bf448cf06496fed27e4a9329deb03741d6d956a3b13c5ed4 is test-only design/content evidence. It is not a published skill or installation pin. Published 0.2.1 pin 0f494cab remains unchanged; final skill bytes/publication/adoption need separate review/approval.
• Align four README/guide locales, API/shorthand, PARITY, release procedure and dated validation. Current usage wording avoids undated publication-status claims; historical evidence and anchors are preserved.

Exact source and dependencies

Preparation head: bfbadfa42513791899fc8d2b5441238bbe5b2c4e.
Base/final integrated main: be6adb26f844e7158362a8fcd6d379fbe8d46864.

PR	Reviewed head	Squash merge
#106	4f34f08	81d1aec
#107	5b878fc	1e788be
#108	564adb3	d645a69
#109	9e123cf	be6adb2

Every merge used normal protection and exact-head squash binding, after current-head CI and automatic Code/Security Review. Each merge tree matched its reviewed head. Preparation was rebased onto actual final main; its runtime/test tree matched the locally tested projection. No admin/protection bypass or manual review mention.

Release-note draft / included scope

• Opt-in Handoff v1 correlation, private POSIX prepare/status/wait records and durable at-most-once sender fencing. Private journal message-binding digests are encrypted under a separate mode-0600 ledger.key; missing/corrupt/changed key/history never authorizes resubmission.
• Exact client-ID injection observation is qualified only for recorded macOS arm64 Codex 0.160.1/0.162.1 topology, original saved home/generation and warm metadata store. Bounded app-server queue mechanics validate the actual process build and opened SQLite device/inode after the durable guard/final owner check.
• Explicit POSIX operator confirmation uses operator_confirmed; it means receipt attestation, not model authentication, task completion or permission. Queueing/turn completion/queue deletion never manufactures ACK.
• Immutable per-operation deadlines, concurrent-wait/SIGINT handling, one native attempt and positive submission-evidence preservation. Waiting observes native state read-only while persisting private wait/terminal records.
• Explicit same-version SSH destination preparation/binding, strict request-aware response validation and nonrenewed remaining budgets. Experiments feat(codex): prototype native Side Session input in an isolated experiment #82/feat(experiment): add isolated Codex turn steering prototype #142 are excluded.

Linux/Windows native observation, Windows private handoff storage and automatic voluntary receipt producer/authenticated collector remain #130–#132. Required unsupported goals refuse before effect; no post-attempt fallback/resend. No general exactly-once/consumption/automatic ACK guarantee.

Validation actually performed

macOS arm64, Node 24.16.0, hash-checked exported Python 1.1.0 oracle 8ca77cf31254c8287a2593fe484bb30a7dba2727:

• npm ci --ignore-scripts; npm test including build/types: 389 total /384 pass /0 fail /5 Windows-only skips. Initial two stale update-notice regex expectations were fixed before the final passing run.
• npm run test:package: reproducible archive, isolated installation/removal, bash/zsh contract/lifecycle pass.
• node scripts/check-repository.mjs, git diff --check, npm audit (0 vulnerabilities), node scripts/release.mjs pack and artifact pass.
• Exact committed-source local archive: SHA256 84adc8b50ef8f03a2c2170e3c36a97b573f28a6bcbeb7dbc965e16c3b37a57c9; integrity sha512-mMNJ118atoflhpFTkf2+DtO7MRf7FQnPK3lKWbq/vd8Xvb5DsjUtAgydIBOcd3Xj9BCYGqM50aFhzUr4dDGHSw==. All 71 allowlisted files checked; all 18 packaged Markdown files equal source bytes. This is a local review artifact, not a future Actions/staged/public archive.
• Finite profile default/undefined/explicit/outer inspector and full-candidate hash/UTF-8 fixtures pass. Historical/future/malformed cases preserved.

Dependency #109 first CI 39045571298 had one macOS Node 22 pre-queue app_server_owner_changed failure. Local Node 24 isolated/parallel diagnostics and official Node 22.23.3 arm64 focused/full 387/382/0/5 checks passed. The local space-containing Node path required a private test-only POSIX/JS shebang adapter preserving binary/filename/argv; it was not an unmodified CI reproduction or runtime guard change. Original cause remains unconfirmed. Only failed macOS 22/release-gate jobs were rerun once; attempt 2 passed. Both exact-head automatic reviews had no findings. The initial failure is recorded, not relabeled as an all-green first run.

Exact preparation-head CI: 12/12 SUCCESS, including Windows native Node22/24, CLI39046692080 and CodeQL39046690008, without reruns. Both automatic Code/Security reviews completed on bfbadfa with no findings. Final main be6adb2 passed CLI39046557287 and CodeQL39046557167, also without reruns. PR is ready for review, CLEAN and has no automatic merge configured. No new actual Codex/model/user-session/remote-host delivery or automatic ACK qualification was performed; dated historical evidence is separate.

Publication boundary

Read-only registry: latest 0.3.6, preview 0.1.0-preview.1, target 0.4.0 absent. No new authenticated stage/Trusted Publisher/MFA audit, dispatch, environment/final npm approval, tag, GitHub Release, fleet/global installation or publication. Historical settings-read exceptions do not carry forward.

After human merge, require exact merged-main checks and a separate exact-SHA/0.4.0/stable-stage/latest promotion approval, retained Actions/staged artifact review, protected environment approval and final npm 2FA. The future skill release is independently approved and does not follow automatically from runtime publication.

Supplemental exact skill-candidate review — 2026-10-18 KST

The initial b8 fixture remains the committed historical checkpoint. Subsequent38cc review passed metadata/content checks but identified stale source provenance. Companion Draft37 corrected that in exact head a969260cd511b7b81631884ff856edaf0d0d457b:

• Complete candidate:22,973 raw UTF-8 bytes, SHA256 7571c79fb7ac164002daf0bf3aa7c5ba40ca8d99f5610a04d7860eee7b27df68.
• Guide:15,465 bytes, SHA256 370f2dc9e73875e13e7829196f5061248ac139cb34c1027cb68fa8174ba9b867.
• Profile proposal JSON SHA256 92c04acb967abaa7c268cabdbe321fd5ba536573c193923e8ad89ef9e65d2fa4.

Exact content/provenance was checked against final mainbe6adb2 and this headbfbadfa; the former finding is resolved and no new normative content blocker was found. A separate read-only source/document review agreed. This built0.4.0 pure validator accepted the NEW full bytes with default/undefined/explicit/outer inspection; old0.3.2–0.3.6 and unreviewed0.3.7/0.4.1 rejected them, while malformed identities returned unknown/missing without verification. No instructions/native/model/installation/ACK operation was performed.

Accepted for design and these exact candidate contents/profile, not future bytes, runtime/skill publication, installation-pin adoption or merge permission. Acceptance was queued once to the user-confirmed skill session under STS-040-SKILL-CANDIDATE-20261017-A; queued is not consumption/agreement. Recording acceptance externally does not require regenerating unchanged candidate bytes. Actual runtime publication, separate human skill finalization/publication and subsequent published-pin adoption remain distinct. This body-only review record changes no source/artifact/CI head.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T15:50:25.125176Z	bfbadfa	PR opened
🔒 Security Review	✅ Completed 2026-10-17T15:52:07.721039Z	bfbadfa	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Exact merged-source prepublication gate — 2026-10-18 KST

Source dde3923efe116f87f38b1639b29b889d2b832e44 is #151's merge and has the same tree as reviewed bfbadfa. Exact-main CLI/release gate39076708873, including macOS/Ubuntu and Windows native Node22/24, and CodeQL39076708830 completed successfully.

Fresh git-archive export/build/reproducible pack/isolated install-removal/artifact validation passed. Archive is byte-identical to the reviewed preparation: SHA256 84adc8b50ef8f03a2c2170e3c36a97b573f28a6bcbeb7dbc965e16c3b37a57c9, integrity sha512-mMNJ118atoflhpFTkf2+DtO7MRf7FQnPK3lKWbq/vd8Xvb5DsjUtAgydIBOcd3Xj9BCYGqM50aFhzUr4dDGHSw==. All71allowlisted files and18packaged Markdown/source byte comparisons pass. This is local merged-source evidence, not retained Actions/staged/public bytes yet.

Authenticated read-only checks: sole maintainerabruption, no pending stages; TrustedPublisher exact repositoryabruption/session-peer-ts /publish.yml /environmentnpm has only createStagedPackage permission. GitHub npm environment requires abruption review, denies admin bypass, allows main only, with zero environment/repository Actions secrets. Public registry remains latest0.3.6/preview0.1.0-preview.1;0.4.0absent, previous stable integrity matches. Public previous attestation payload/source/subject connection was compared, not newly cryptographically audited.

The user explicitly skipped the fresh WEB package publish-2FA POLICY lookup for this0.4.0 release because npm web requested a separate security key. That policy is not freshly confirmed. TrustedPublisher was freshly verified and is not skipped. No settings/protections were changed. Actual protected environment and final npm stage2FA approval remain separate mandatory gates.

Exact-source0.4.0/stable-stage/latest promotion approval is now requested under RELEASING step4. Dispatch, protected environment approval, final npm approval, tags/releases and publication have NOT occurred. Historical approvals/exceptions were not reused.

[abruption]

Approved-source staging checkpoint — 2026-10-18 KST

The user approved exact source dde3923efe116f87f38b1639b29b889d2b832e44, session-peer@0.4.0, stable-stage and eventual latest promotion. Workflow dispatch occurred once: 39077096491, attempt1, completed SUCCESS. GitHub approval history records environment npm approved by abruption; no agent approval/protection bypass was used.

Prepare on Ubuntu:383 tests/355 pass/0 fail/28 skips; package smoke/reproducibility/isolated install-removal and audit0 passed. These platform-specific skips do not qualify macOS-only native observation on Ubuntu. Retained artifact12117507059 ZIP digest sha256:b4eb62a6c68be0319d5d7013f11d11e9b438866f3a63359cc1808c91cbe61494 was verified. Its tarball matches reviewed and fresh merged-source bytes: SHA256 84adc8b50ef8f03a2c2170e3c36a97b573f28a6bcbeb7dbc965e16c3b37a57c9. Exact-source helper,71-file allowlist and18Markdown byte comparisons passed.

npm stage 414547b1-1b55-45dc-a0a4-9ca40407beec: session-peer0.4.0/latest/public, actorType trusted automation. Downloaded staged tarball is byte-identical to Actions/local review and matches the stage's registry SHA1 metadata. Current server status remains validating; no final npm approval or public release is claimed.

Staging log references public Rekor entry index3301959947. Exact pinned npm11.15 provenance structure reconstructed from the public GitHub metadata has SHA256 1dc7ed9bf799dcd1891e9b04bc9af5374ab66f61f19dde53ee38feb12b2bc50c, matching the logged DSSE payloadHash. It binds tarball SHA512, source dde3923, repository/main/publish.yml, workflow_dispatch and run39077096491/attempt1. DSSE signature was verified against the logged certificate; its workflow SAN matches and integration time falls within certificate validity. This is not independent certificate-chain/transparency-proof verification; full published registry signature/provenance audit follows final approval. The unpublished attestation endpoint currently returns404.

Waiting only for npm server validation before asking the user to approve the exact stage with final2FA. No upload retry, npm approval, Git tag, GitHub Release or public publication has been performed by this checkpoint. Web publish-MFA policy read was explicitly skipped for this release as recorded above; actual final2FA remains required.