[abruption]

Summary

Prepare runtime v1.3.3 from integrated main ec2f7fc808f1e22519348091d51c28a2fd522caf, after merged #352/#353/#354. This is a reviewable maintenance preparation, not publication authorization.

• Bump the package/generated standalone version to 1.3.3 and align current README, documentation maps, four-language preparation notes and runbooks.
• Record contributor-template/read-only reference warnings, standard CPython 3.14 CI/classifier coverage and post-publication documentation maintenance. The original 1.3.2 records and published assets remain unchanged.
• Adopt the exact independently published Python skill v0.4.1 compatibility copy, from abruption/session-peer-skill commit 263b0c333d539dc4e885b16ae3369a26f33097d8, annotated tag object ba08d19af33cad0f7d032b7fe18c82d6ddd6793f. Canonical size 27,126 bytes, SHA-256 fdf5697c04f4a37194986622afb3a7966bb02631c128cf18a323e3fbe5ae90ed. Skill min 0.9.1/full 1.3.2 and receiver codexBin floor 1.0.1 remain independent of runtime 1.3.3.
• Pin that snapshot's checkout to LF and add a real published-file/metadata-reader regression, preserving exact bytes even with autocrlf enabled. Skill instructions are not executed; the reader's existing two-field API is unchanged.

Refs #349, #350, #351

Validation

• Integrated main CI 40982760413 and CodeQL 40982759604 succeeded at the exact base. This PR and final protected main require their own current-head checks.
• Local Python 3.9.6 documentation/i18n/release-boundary suite: 87 pass. Published-snapshot/frontmatter suite: 15 pass. Generator and diff checks pass. Locale tests retain unpublished-observation/authorization/human-approval/final-main boundaries; historical v1.3.2 bodies are preserved.
• Two local wheel/sdist builds are reproducible; exact archive/payload/manifest checks and separate fresh installed purelib/version 1.3.3/help/pip-check checks pass. Distribution suite: 41 pass, three PowerShell skips on macOS. These are rehearsal artifacts, not publisher inputs.
• Independent read-only packaging audit confirmed Python >=3.9, the 3.14 classifier, MCP >=1.30,<2 with its Python 3.10 extra marker, runtime/source equality and exclusions. The exact skill is a separate support asset, outside wheel/sdist. Frozen handoff document and fixture hashes are unchanged.
• A separate temporary Git checkout with autocrlf=true preserves all 27,126 published skill bytes under the added LF rule; current-head Windows CI remains required.

Independent review

Before PR creation, Claude Code 2.1.312 (requested and response-confirmed claude-opus-5-5) and Codex CLI 0.165.0 (isolated default, actual model ID not exposed) reviewed the same frozen input SHA-256 a780cb354dc12a973c9d12a03d915586b8bc081a68dccf10ea15cbdba49bd2ac, non-interactively in parallel without tools/writes/tests/network. Both completed successfully. Claude's conditional Windows raw-byte concern was confirmed and fixed with the LF rule. Its possible duplicate consumer/archive concern was checked against source manifests and real archives: no hidden skill copy exists, and plugin 0.1.0 is a separate component. Source/metadata consumer checks, dated preparation wording, clearer source/CI order, localized boundary tests and current-version assertions address the remaining review suggestions. Follow-up edits were validated by Codex; they are not claimed as a second CLI review of identical final bytes.

Separate translation QA used Antigravity CLI 1.4.10 / explicit gemini-3.8-flash-medium, fresh plan+sandbox read-only calls: full changed four-language content (113.785 seconds) and the narrow post-review wording follow-up (77.390 seconds), both structured successes with no material source findings. Codex checked actual facts, markup and wording; model conclusions do not authorize actions or replace source verification.

Remaining gates and limits

Preparation performs no merge, tag/draft creation, publication, service rollout, global skill installation or new companion release. Later authorized publication requires successful preparation/final-main CI, all seven exact-source authenticated release assets and checksums/provenance, fresh installs and actual human PyPI environment approval. The user's skipped private PyPI login/binding recheck is not that approval.

There are no delivery/authentication/retry/ACK implementation changes. Standard POSIX CPython 3.14 fixture/package coverage is not new live-native, Windows 3.14 or free-threaded acceptance. No unfiltered full-local-green claim is made for the known ownership-ignoring external-volume environment; protected CI on owned runner storage supplies the platform gate.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T01:31:01.771804Z	b14cd1e	PR opened
🔒 Security Review	✅ Completed 2026-10-30T01:31:31.538412Z	b14cd1e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Current-head preparation verification

Exact head: b14cd1e30c46f117cdd9baef4c6e3a579dc26003. CI run 40986165514 and all 43 checks succeeded, including Windows 3.13 core coverage of the exact published skill bytes and the active trusted-main PR-reference warning. The PR is Ready; normal protections remain unchanged.

Automatic code and security review statuses are completed at this head. Code findings flags are false; security finding flags are null/unavailable, so this records completion rather than interpreting null as affirmative false. No review threads or scheduled closingIssuesReferences are posted.

Local final checks: documentation/i18n 87 PASS; published-snapshot/frontmatter 15 PASS; distribution 41 PASS (3 PowerShell skips on macOS); generator/diff, two reproducible builds and separate fresh wheel/sdist installed-origin/version/help/pip-check PASS. Final archives were byte-compared to current source; separate SKILL asset matches published v0.4.1 SHA fdf5697c04f4a37194986622afb3a7966bb02631c128cf18a323e3fbe5ae90ed. The source-only consumer audit, LF attribute and autocrlf fixture close the conditional independent-review concerns.

This completes the requested preparation only. Preparation-PR merge, final-main checks, tag/draft/workflow dispatch/publication and the actual required human PyPI environment approval remain separate future steps. No existing release, service or global skill installation was changed.

[abruption]

v1.3.3 publication evidence

• Source/lightweight tag: fee7fb8ef8ce8d879bc44a460aea6f9fe25e0f48 (PR chore(release): prepare v1.3.3 maintenance release #355 merged; tree matches reviewed head b14cd1e30c46f117cdd9baef4c6e3a579dc26003).
• Final main CI: https://github.com/abruption/session-peer/actions/runs/40986909954 — success.
• Final main CodeQL: https://github.com/abruption/session-peer/actions/runs/40986909716 — success.
• Preparation: https://github.com/abruption/session-peer/actions/runs/40987441383 — attempt 1, all five jobs success.
• Seven assets authenticated against preparation signer, source ref/digest, GitHub OIDC issuer and hosted runners. Manifest/provenance/digests match exact source and preparation attempt. Independent archive audit confirmed all wheel/sdist source payload bytes, metadata, exclusions and supporting SKILL bytes.
• GitHub: https://github.com/abruption/session-peer/releases/tag/v1.3.3 — published 2026-10-30T01:45:30Z, stable/Latest, immutable=true.
• Publish workflow: https://github.com/abruption/session-peer/actions/runs/40987727864 — all six jobs success, including locked-asset verification, wheel/sdist installation, current dependency audits, upload and published-file verification.
• Required human environment approval: GitHub review history records abruption approving pypi; deployment 7428620514 entered waiting at 2026-10-30T01:46:37Z, queued after approval at 01:47:17Z and succeeded at 01:47:47Z. No programmatic approval or protection bypass was used. The monitor independently observed the waiting state. Private PyPI login/binding recheck was skipped as instructed.
• PyPI: https://pypi.org/project/session-peer/1.3.3/ — exact wheel and sdist only, both non-yanked. Upload timestamps: wheel 2026-10-30T01:47:39.541961Z, sdist 2026-10-30T01:47:41.512384Z; both hashes match locked GitHub candidates below.
• Independently downloaded all seven locked GitHub assets and authenticated their provenance again; independently downloaded both PyPI distributions and compared hashes. Fresh separate wheel/sdist installations passed isolated installed imports, version 1.3.3, help, pip check and initialized private empty-home JSON discovery. No native session was contacted.

Payload SHA-256:

fdf5697c04f4a37194986622afb3a7966bb02631c128cf18a323e3fbe5ae90ed  SKILL.md
dbd2300c633ee5ba6c09bcfdd9dff908e0bc87820654a9aaf4135d11b6062d13  install.sh
ba28201913f49203738398e1bd7de27650358d122fd52d55dc84711f7c752043  session_peer-1.3.3-py3-none-any.whl
5bc04dba21c8882e0de1681076637bc8958932ed4b547e0d2940b1753251932c  session_peer-1.3.3.tar.gz
09573b82dc6142d47bbe16fc4cd1e5069f467b2234069a76641196a8eb39f66e  session_peer.py

No operations rollout, global installation, native message/ACK experiment, Windows 3.14/free-threaded acceptance or independent companion skill release is implied.