C. Spencer Beggs (spencerbeggs) · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026
@@ -0,0 +1,23 @@
+---
+"@savvy-web/silk-runtime-action": patch
+---
+
+## Dependencies
+
+| Dependency                       | Type       | Action  | From   | To     |
+| -------------------------------- | ---------- | ------- | ------ | ------ |
+| @savvy-web/github-action-effects | dependency | removed | ^3.1.0 | —      |
+| @effected/commands               | dependency | added   | —      | ^0.2.0 |
+| @effected/git                    | dependency | added   | —      | ^0.5.1 |
+| @effected/github                 | dependency | added   | —      | ^0.2.1 |
+| @effected/github-actions         | dependency | added   | —      | ^0.3.0 |
+| @effected/glob                   | dependency | added   | —      | ^0.2.1 |
+| @effected/lockfiles              | dependency | added   | —      | ^0.2.3 |
+| @effected/markdown               | dependency | added   | —      | ^0.4.1 |
+| @effected/npm                    | dependency | added   | —      | ^0.7.0 |
+| @effected/package-json           | dependency | added   | —      | ^0.7.0 |
+| @effected/runtimes               | dependency | added   | —      | ^0.2.2 |
+| @effected/sbom                   | dependency | added   | —      | ^0.2.1 |
+| @effected/semver                 | dependency | added   | —      | ^0.3.0 |
+| @effected/workspaces             | dependency | added   | —      | ^0.9.2 |
+| @effected/yaml                   | dependency | added   | —      | ^0.6.0 |
@@ -0,0 +1,31 @@
+---
+"@savvy-web/silk-runtime-action": minor
+---
+
+## Features
+
+Rebuilt the action's internals on the `@effected/*` Effect v4 suite (`github-actions` 0.3.0, `npm` 0.7.0, `package-json` 0.7.0, `semver` 0.3.0), replacing `@savvy-web/github-action-effects`. The public interface is unchanged — same inputs, outputs, and `devEngines` contract, and the same job summary and log output. Consuming repos require no changes.
+
+### Package managers provisioned without Corepack
+
+Package managers are now installed directly into the tool cache. Corepack has been removed from the install path and is no longer required in consuming repos.
+
+### Hardened dependency cache key
+
+The dependency cache key now includes a CPU-architecture segment, and a partial cache hit falls back through a hardened two-rung restore ladder.
+
+### Turbo remote-cache server hardening
+
+The embedded Turbo remote-cache server is more resilient:
+
+* A per-run random auth token fails closed instead of accepting unauthenticated requests
+* `SIGTERM` triggers a graceful teardown so in-flight artifact writes are not lost
+* `EADDRINUSE` on the chosen port is handled instead of crashing the job
+
+### Runtimes visible to lifecycle scripts
+
+Lifecycle scripts such as `postinstall` now see the installed runtimes and package manager on `PATH`. This fixes failures in consuming repos whose `postinstall` invokes `bun` or `deno`.
+
+## Bug Fixes
+
+* Windows package manager shims are now invoked safely, mitigating CVE-2024-27980
@@ -4,44 +4,44 @@
 		{
 			"source": "CLAUDE.md",
 			"target": ".claude/design/silk-runtime-action/architecture.md",
-			"hash": "2d62b33e995d416917e3076ddc6d545436b8f0a2c52eecd183c9457bf6fd30af",
-			"recordedAt": "2026-06-23"
+			"hash": "a833ab8bc0b7858a99e3771b982f26ff23a8ca268039b3ca9fe36292c501f3bd",
+			"recordedAt": "2026-08-02"
 		},
 		{
 			"source": "CLAUDE.md",
 			"target": ".claude/design/silk-runtime-action/build-and-distribution.md",
-			"hash": "5dedaa1916900fbb7aa906ee2772b572466acc02503cb3714fbe75514c9a1e29",
-			"recordedAt": "2026-07-05"
+			"hash": "4ee2742fee0181cc446bf2d21d37552f0213e03a2d3b10cb0994f467e897073f",
+			"recordedAt": "2026-08-02"
 		},
 		{
 			"source": "CLAUDE.md",
 			"target": ".claude/design/silk-runtime-action/caching-strategy.md",
-			"hash": "5460fae42e52fa9746f40eeb174f4d6f22733987522f01a5a4ac3c4eb5604d6b",
-			"recordedAt": "2026-06-23"
+			"hash": "11b4701f2bbb7e410453d92d8d6acdefd05a0ae3bfa1e358f506f281e8429906",
+			"recordedAt": "2026-08-02"
 		},
 		{
 			"source": "CLAUDE.md",
 			"target": ".claude/design/silk-runtime-action/effect-service-model.md",
-			"hash": "7d731f31d70e5d7622202fd9eb2ddc6d2b87ca59b2eadddad30ef552795e603c",
-			"recordedAt": "2026-06-23"
+			"hash": "236cc0d4006fa42e4847cbb6b0dbefc2e9b396b7bd678dcd743ca5a414e146df",
+			"recordedAt": "2026-08-02"
 		},
 		{
 			"source": "CLAUDE.md",
 			"target": ".claude/design/silk-runtime-action/runtime-installation.md",
-			"hash": "50baa7c7eb4e8dbdaec7cf6fadbb7214b26f95ef21c300d1f4684bc401fb7d82",
-			"recordedAt": "2026-06-23"
+			"hash": "2d40d5c6f3ff0d6392cc9d29e59d65d08ad45d06fba93451a3ff3b07a324c488",
+			"recordedAt": "2026-08-02"
 		},
 		{
 			"source": "CLAUDE.md",
 			"target": ".claude/design/silk-runtime-action/testing-strategy.md",
-			"hash": "207a6d625507b467ced4f33114c0792de047f9db75e2eb379b4ffa3104d3f731",
-			"recordedAt": "2026-06-23"
+			"hash": "103d1ea850b6a77fa23bf1591f5d41cb19c7b1cbf191cf8c87bb969e1f8b5b2d",
+			"recordedAt": "2026-08-02"
 		},
 		{
 			"source": "CLAUDE.md",
 			"target": ".claude/design/silk-runtime-action/turbo-remote-cache.md",
-			"hash": "1ed7c93f6da639c1d8b571b546a14ef6f76c78ec18329863b1c98a53f52abcf1",
-			"recordedAt": "2026-07-05"
+			"hash": "1076687751f61ecc71987c705fa9a2cad885e2631d67f348e9c790c2319e2ce4",
+			"recordedAt": "2026-08-02"
 		}
 	]
 }
@@ -3,8 +3,8 @@ status: current
 module: silk-runtime-action
 category: meta
 created: 2026-03-21
-updated: 2026-07-17
-last-synced: 2026-07-17
+updated: 2026-08-02
+last-synced: 2026-08-02
 completeness: 100
 related: []
 dependencies: []
@@ -14,36 +14,52 @@ dependencies: []
 
 Navigation index for all design documentation in the silk-runtime-action project.
 
+All seven documents were reconciled against the completed `@effected/*` Effect v4 rebuild on
+2026-08-02. They describe the code as it stands on `dev`, not the legacy v1 implementation
+(whose source is retained read-only at `docs/superpowers/reference/legacy-v1/`).
+
 ## Architecture
 
 | Document | Status | Completeness | Description |
 | --- | --- | --- | --- |
-| [architecture.md](./architecture.md) | current | 92% | Entry topology, module map, `MainLive`/`PostLive` composition |
-| [effect-service-model.md](./effect-service-model.md) | current | 92% | `Context.Service` classes, `Schema.TaggedErrorClass`, `Step.*` namespace, Config API |
-| [runtime-installation.md](./runtime-installation.md) | current | 92% | `RuntimeInstaller` `Context.Service` class, descriptors, PM setup, Biome |
+| [architecture.md](./architecture.md) | current | 95% | Entry topology, module map, pipeline order, `MainLive`/`PostLive`, error model, the two PATH joins |
+| [effect-service-model.md](./effect-service-model.md) | current | 95% | The step-contract rule, `Data.TaggedError` taxonomy, `ActionInput` decoding, defaulted-parameter seams, log groups |
+| [runtime-installation.md](./runtime-installation.md) | current | 95% | Pure descriptors, tool-cache layout, `PackageManagerInstaller`, Biome, and the `PATH` problem |
 
 ## Performance
 
 | Document | Status | Completeness | Description |
 | --- | --- | --- | --- |
-| [caching-strategy.md](./caching-strategy.md) | current | 92% | Cache keys, `Glob`-based lockfile detection/hashing, cross-phase state |
+| [caching-strategy.md](./caching-strategy.md) | current | 95% | Typed `CacheKey`, restore ladder, lockfile discovery, archived paths, the cross-phase state protocol |
 
 ## Integration
 
 | Document | Status | Completeness | Description |
 | --- | --- | --- | --- |
-| [build-and-distribution.md](./build-and-distribution.md) | current | 88% | `github-action-builder` config, cyclonedx `ignore` list, three-entry dist |
-| [turbo-remote-cache.md](./turbo-remote-cache.md) | current | 90% | Embedded turbo remote cache: activation tree, detached server, codec, teardown |
+| [turbo-remote-cache.md](./turbo-remote-cache.md) | current | 95% | Activation table, detached worker, `BlobEnvelope` metadata, secrets, teardown, token-lifetime limitation |
+| [build-and-distribution.md](./build-and-distribution.md) | current | 92% | Three-entry bundle, committed `dist/`, dependency topology, the dogfood link hazard |
 
 ## Testing
 
 | Document | Status | Completeness | Description |
 | --- | --- | --- | --- |
-| [testing-strategy.md](./testing-strategy.md) | current | 90% | Library Test layers, hand-rolled mocks for failure injection, fixture tests |
+| [testing-strategy.md](./testing-strategy.md) | current | 95% | Kit test layers, the real-`ActionState` harness, `action.yml` parity guards, fixture and e2e matrices |
+
+## Where a topic lives
+
+| Looking for | Document |
+| --- | --- |
+| Pipeline step order, what is fatal | [architecture](./architecture.md) |
+| Adding a step, or a new error type | [effect service model](./effect-service-model.md) |
+| `addPath` semantics, Windows `.cmd`, lifecycle-script `PATH` | [runtime installation](./runtime-installation.md) |
+| Cache key segments, restore rungs, `CacheState` encoding | [caching strategy](./caching-strategy.md) |
+| Backend selection, `TURBOGHA_*`, `ACTIONS_RUNTIME_TOKEN` expiry | [turbo remote cache](./turbo-remote-cache.md) |
+| Linking a first-party dependency, or why `dist/` is committed | [build and distribution](./build-and-distribution.md) |
+| Which double to trust, `action.yml` guards, e2e matrices | [testing strategy](./testing-strategy.md) |
 
 ## Statistics
 
 - **Total documents:** 7
 - **Current:** 7
-- **Average completeness:** 91%
-- **Last updated:** 2026-07-17
+- **Average completeness:** 95%
+- **Last synced:** 2026-08-02 (post-rebuild reconciliation)