tanka420 · tanka420 · Aug 20, 2026 · Aug 20, 2026
diff --git a/docs/exec-plans/active/R01.md b/docs/exec-plans/active/R01.md
@@ -1,14 +1,14 @@
 # R01 — Coordinated ArcReady v0.4.0 Release
 
-Status: Approved — E1 implementation not started
+Status: Validated — E1 candidate pending commit and PR approval
 
 Risk class: R3 distribution and external contract
 
 Owner: ArcReady maintainers
 
 Base branch: `main`
 
-Base SHA: `24321a570f842d66ea9b86e7620caced1a3afdee`
+Base SHA: `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620`
 
 Last reviewed: 2026-08-20
 
@@ -74,11 +74,11 @@ Verified on 2026-08-20:
 | npm latest            | `arcready@0.3.0`, published 2026-06-13T17:07:22.227Z                |
 | npm package source    | `gitHead` `108759757d047236cab19272c3246bacc3261f1a`                |
 | Git release tag       | `v0.3.0` resolves to `e4a1244e5363bafee2dcf7446467e7f6fabe921e`     |
-| Current main          | `24321a570f842d66ea9b86e7620caced1a3afdee`                          |
-| Change size           | 181 files, 60,385 insertions, 1,150 deletions from tag to main      |
+| Frozen E1 base        | `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620`                          |
+| Change size           | 184 files, 61,169 insertions, 1,162 deletions from tag to base      |
 | File deletion         | no deleted path in the tag-to-main diff                             |
 | Published package     | 7 entries, 18,109-byte tarball, 79,982 bytes unpacked               |
-| Current built package | 10 entries, 91,643-byte tarball, 435,733 bytes unpacked             |
+| E1 candidate package  | 10 entries, 92,141-byte tarball, 436,925 bytes unpacked             |
 | Runtime dependencies  | `@solidity-parser/parser@0.20.2`, `typescript@5.9.3`                |
 | Dependency licenses   | parser MIT with no declared dependency; TypeScript Apache-2.0       |
 | Dependency Node floor | TypeScript >=14.17; ArcReady >=22                                   |
@@ -88,14 +88,18 @@ The size comparison is evidence, not a budget. The release review must explain
 the added private PREVRANDAO entry and external parser/compiler dependencies and
 must verify package licenses, integrity, installation, and lazy loading.
 
-Remaining before implementation:
+Resolved before E1 implementation:
+
+- the A02/A03 documentation prerequisite merged cleanly in PR #74 at
+  `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620`;
+- the E1 base is frozen at that exact merge SHA, and later runtime changes are
+  excluded unless the cumulative release inventory is reset.
+
+Remaining before E1 publication:
 
-- confirmation that the A02/A03 documentation prerequisite is merged cleanly;
 - npm authentication and package-owner authorization;
 - exact GitHub release permissions and tag protection state;
-- a complete public declaration/API comparison of packed v0.3.0 and the v0.4.0
-  candidate;
-- whether any main change after the base SHA should be included or deferred.
+- exact candidate review, full gate, merge, and registry dry-run evidence.
 
 Any new runtime-affecting main change resets the release base and requires a new
 cumulative inventory.
@@ -419,13 +423,13 @@ Progress:
 - [x] product brief drafted
 - [x] registry/tag premise verified
 - [x] release spike completed
-- [ ] A02/A03 prerequisite merged
+- [x] A02/A03 prerequisite merged
 - [x] architecture reviewed
-- [ ] E1 package vertical slice working at version 0.4.0
-- [ ] v0.3/v0.4 API and package comparison complete
-- [ ] targeted validation passed
-- [ ] E1 final independent review passed
-- [ ] E1 full validation passed
+- [x] E1 package vertical slice working at version 0.4.0
+- [x] v0.3/v0.4 API and package comparison complete
+- [x] targeted validation passed
+- [x] E1 final independent review passed
+- [x] E1 full validation passed
 - [ ] E1 exact-head CI passed and merged
 - [ ] npm 0.4.0 explicitly approved, published, and verified
 - [ ] E2A Action candidate reviewed, validated, and merged
@@ -496,4 +500,19 @@ Pending.
   input set and extracted package-entry hashes; package subtree equality alone
   is insufficient because Action structural tests live under that subtree.
 - 2026-08-20: Independent architecture review approved corrected v3 with
-  `0 blocker / 0 major / 0 minor`; E1 remains unstarted and separately gated.
+  `0 blocker / 0 major / 0 minor`; E1 remains separately gated.
+- 2026-08-20: Froze E1 at the merged A02/A03 prerequisite SHA
+  `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620` and began the package-only
+  vertical slice without changing the Action default or tagged smoke reference.
+- 2026-08-20: The E1 package vertical slice passed 2,703 package tests, build,
+  installed-tarball smoke, dry-run shape, dependency metadata/integrity, packed
+  API comparison, and the eight-repository A02 corpus. Final review, full gate,
+  exact-head CI, merge, and publication remain pending.
+- 2026-08-20: Final independent review approved the exact 19,350-byte staged
+  bundle with SHA-256
+  `1a2e3633f8f1c258f9fc606f2afb5e7c826e6015327e5ed8dba14b875eab5434`
+  at `0 blocker / 0 major / 0 minor`.
+- 2026-08-20: `corepack pnpm verify:full` passed fixture validation, 2,703
+  package tests, six workflow tests, lint, build, and installed-package smoke.
+  Ignored local adoption artifacts were quarantined outside the repository for
+  lint and restored afterward; they are not candidate inputs.
diff --git a/docs/npm-publishing.md b/docs/npm-publishing.md
@@ -1,19 +1,21 @@
 # npm Publishing
 
 ArcReady is published on npm as an installable CLI package. The current public
-version is `arcready@0.3.0`. The architecture-approved R01 plan selects `0.4.0`,
-but E1 implementation has not started and no publishable candidate exists yet.
+version is `arcready@0.3.0`. The architecture-approved R01 E1 candidate selects
+`0.4.0` from frozen base `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620`.
+The candidate is not published, and its exact operational commit remains
+pending final validation and review.
 
 ## Current Package
 
-| Field                 | Value                         |
-| --------------------- | ----------------------------- |
-| Package name          | `arcready`                    |
-| Published version     | `0.3.0`                       |
-| Selected next version | `0.4.0` (R01; E1 not started) |
-| License               | MIT                           |
-| Node.js               | `>=22`                        |
-| CLI bin               | `arcready`                    |
+| Field                 | Value                      |
+| --------------------- | -------------------------- |
+| Package name          | `arcready`                 |
+| Published version     | `0.3.0`                    |
+| Selected next version | `0.4.0` (R01 E1 candidate) |
+| License               | MIT                        |
+| Node.js               | `>=22`                     |
+| CLI bin               | `arcready`                 |
 
 The npm package should include only:
 
@@ -52,9 +54,9 @@ Inspect the output before release. The dry run must show the separately approved
 unpublished candidate version and only the expected package files. Do not try to
 publish `arcready@0.3.0` again.
 
-During E1, after the exact operational candidate and selected release SHA exist,
-replace the pre-implementation language in this guide before any publish command
-is authorized.
+Use the versioned
+[v0.4.0 npm checklist](releases/v0.4.0-npm-checklist.md) for E1 evidence. Record
+the exact merged package commit there before any publish command is authorized.
 
 ## Before Real Publish
 

diff --git a/docs/releases/v0.4.0-npm-checklist.md b/docs/releases/v0.4.0-npm-checklist.md
@@ -0,0 +1,102 @@
+# ArcReady v0.4.0 npm checklist
+
+Status: E1 candidate — not published
+
+This checklist owns the package-publication evidence for R01 E1. The GitHub
+Action, Git tag, tagged smoke, and GitHub Release are later checkpoints and must
+not be created from this checklist.
+
+## Frozen provenance
+
+- Version: `0.4.0`
+- E1 base: `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620`
+- Exact reviewed candidate commit: pending
+- Exact merged package commit: pending
+- Reviewed staged bundle SHA-256:
+  `1a2e3633f8f1c258f9fc606f2afb5e7c826e6015327e5ed8dba14b875eab5434`
+- npm registry `gitHead`: pending publication
+- Working tree at selected candidate: pending clean-tree verification
+
+Any runtime-affecting change after the frozen base requires a new cumulative
+inventory and review decision. Release-only metadata and documentation must be
+included in the exact reviewed candidate.
+
+## Package contract
+
+- [x] Manifest version and terminal version are `0.4.0`.
+- [x] Node engine remains `>=22` and license remains MIT.
+- [x] Runtime dependencies are exactly `@solidity-parser/parser@0.20.2` and
+      `typescript@5.9.3`; their licenses and lockfile integrity are verified.
+- [x] Packed paths are only `dist/`, `README.md`, and `package.json`; source maps
+      and repository files are absent.
+- [x] Sorted packed entry paths, sizes, and SHA-256 values are recorded from the
+      exact candidate artifact.
+- [x] Packed v0.3.0 and candidate declarations are compared; existing public
+      exports remain and the intended addition is documented.
+- [x] Inventory remains 19 known, 15 default, seven known wallet, six default
+      wallet, and four canonical rules.
+- [x] Legacy output/configuration/reporters/scoring/exits remain compatible.
+- [x] `scan --json-v2` remains opt-in with `contractVersion: "2.0"`.
+- [x] `action.yml`, the external tagged smoke, and current v0.3 Action examples
+      remain on `0.3.0` during E1.
+
+Dry-run artifact: 10 entries, 92,141 bytes packed, 436,925 bytes unpacked,
+SHA-1 `936ed9a88a47273690782072488ee52e761c37c1`, integrity
+`sha512-X8FumZlkylSwXYHNOQhGtXj1o9Ljbh4XFJD7i/JsN5fm45amIokidantNPL7wtDGG/NyVt8gLK8zSTRdDhMLfw==`.
+
+| Packed path                     | SHA-256                                                            |
+| ------------------------------- | ------------------------------------------------------------------ |
+| `README.md`                     | `747236a631af06979bafd8ea31a5ee6cee092b897d0936fd77f7c5c8c26e7426` |
+| `dist/bin.d.ts`                 | `a59c47872b71f12589942892464e764c0db350c20b72228645615cc36e0a0725` |
+| `dist/bin.js`                   | `e5802b62ab9d00bd27eeee7725caa7766af9f78cb4d2ee47841e2acb379c6387` |
+| `dist/chunk-SVC4FMEK.js`        | `34143ad65033386ea15db32d076f30864f58919ade7c9783b1ae04a3d4cb9495` |
+| `dist/chunk-W7XUSBJX.js`        | `27f5c93ce5c1883c1a62fedfd1aeb28950a39580ae0894734990a176e5d8206e` |
+| `dist/index.d.ts`               | `2cf4842d1e05f800a59b84b5e052b0bff3be6afb9ce80247351de1d7be9632fc` |
+| `dist/index.js`                 | `a990746addb778bd28af5e083d2c7146cddf8ccf82b7838359757183b966e6c0` |
+| `dist/prevrandao-analysis.d.ts` | `ac79b93b7d046c2d66305c2399e2afba7b3fdd9bad71d4d70ce81096eec5c3e1` |
+| `dist/prevrandao-analysis.js`   | `bdc6335d9a80f867489850e4e284dc6be2a6f58027ee7fa7cb595a1cdf0276a6` |
+| `package.json`                  | `b6c4785694e5a79bc95c11e818d8303acca0e215773405f059f5731cc0ea629e` |
+
+Packed declaration comparison found 70 v0.3.0 exports and 71 candidate
+exports: no removal and only `arcUsdcAmountConversionRule` added. The existing
+`getRulesForScan` declaration gains one optional configured-rules parameter.
+
+## Candidate validation
+
+- [x] `corepack pnpm exec prettier --check <changed files>`
+- [x] `git diff --check`
+- [x] targeted package tests: 42 files and 2,703 tests passed
+- [x] `corepack pnpm build`
+- [x] `corepack pnpm smoke:package`
+- [x] `npm publish --dry-run --json` from `packages/arcready`
+- [x] clean tarball install under supported Node with terminal, legacy JSON, and
+      canonical JSON probes
+- [x] A02 pinned corpus rerun: eight clean pinned repositories, 545 files,
+      score 100/pass/zero findings in every repository
+- [x] `corepack pnpm verify:full`: fixtures, 2,703 package tests, six workflow
+      tests, lint, build, and installed-package smoke passed
+- [x] final independent adversarial review: APPROVE with zero blocker, major,
+      or minor findings
+- [ ] exact-head required CI: pending
+
+## Pre-publish authorization
+
+- [ ] E1 candidate merged with explicit approval.
+- [ ] `npm view arcready@0.4.0` confirms the version is absent.
+- [ ] `npm whoami` and package-owner permission are confirmed immediately before
+      publication.
+- [ ] Dry-run contents and integrity match the reviewed candidate.
+- [ ] Maintainer gives a separate explicit approval for `npm publish`.
+
+Do not run `npm publish` merely because the candidate passes validation. If the
+version appears in the registry unexpectedly, integrity differs, or any package
+boundary changes, stop the release and resolve the conflict without overwriting
+or unpublishing an immutable release.
+
+## Post-publish evidence
+
+- [ ] Registry version, integrity, tarball contents, and `gitHead` recorded.
+- [ ] Clean install from the registry passes version, default C12 behavior,
+      legacy output, and canonical opt-in probes.
+- [ ] Exact E1 package SHA and registry evidence copied to the R01 completion
+      record for E2 input-equality and package-entry hash comparison.
diff --git a/docs/releases/v0.4.0.md b/docs/releases/v0.4.0.md
@@ -0,0 +1,55 @@
+# ArcReady v0.4.0
+
+ArcReady v0.4.0 publishes the cumulative precision, compatibility, and reporting
+work merged after v0.3.0 as an installable npm package. It does not broaden the
+approved analyzer surface as part of the release process.
+
+## Highlights
+
+- Publishes 19 known rules with 15 selected by default, including six default
+  wallet rules and four rules in the opt-in canonical JSON runtime.
+- Adds the public `arcUsdcAmountConversionRule` export.
+- Adds experimental `arcready scan --json-v2` output while retaining canonical
+  `contractVersion: "2.0"` and keeping the legacy output mode and schema as the
+  default CLI surface.
+- Publishes the reviewed Arc-specific precision work for CCTP domains, wrapped
+  USDC, relayer gas, chain metadata, USDC amount interpretation, bounded
+  ethers/viem blob ownership, and PREVRANDAO source/artifact flows.
+- Corrects Arc Testnet hexadecimal chain identity to `0x4CEF52`.
+- Keeps four deprecated rules public and default-excluded. The attestation and
+  gas-label advice rules support explicit non-off configuration; the two legacy
+  App Kit rule objects remain available only for direct API compatibility.
+- Includes pinned `@solidity-parser/parser@0.20.2` and `typescript@5.9.3`
+  runtime dependencies.
+
+## Compatibility and migration
+
+Legacy configuration, terminal/JSON/Markdown/HTML reporters, scoring, and exit
+behavior remain supported. Existing consumers do not need to adopt JSON v2.
+Users who intentionally relied on the attestation or gas-label advice rule must
+select it explicitly in configuration. Consumers that directly invoke either
+deprecated App Kit export may continue doing so, but preset/config selection
+does not re-enable those legacy detectors.
+The library's `getRulesForScan` declaration adds an optional configured-rules
+parameter; all 70 exports packed in v0.3.0 remain, with
+`arcUsdcAmountConversionRule` as the sole new exported symbol.
+
+ArcReady remains a narrow, local-first static compatibility gate. It does not
+perform live RPC or API verification, compile or simulate transactions, prove
+deployment state, inspect rendered UI, or certify a repository as compatible.
+Imported/cross-file values, JSX/TSX, HTML, generated code, and runtime behavior
+remain outside the supported evidence boundary unless a specific rule says
+otherwise.
+
+## Coordinated Action release
+
+This E1 release publishes only `arcready@0.4.0` on npm. The repository Action
+default and external tagged smoke remain on v0.3.0 until the separately reviewed
+R01 E2 checkpoints complete. Do not use these notes to create a `v0.4.0` Git tag
+or GitHub Release during E1.
+
+## Publication status
+
+Release candidate only. npm publication requires final independent review, the
+full repository gate, exact-head CI, merge approval, package-owner verification,
+and a separate explicit publish approval.
diff --git a/docs/roadmap.md b/docs/roadmap.md
@@ -325,9 +325,10 @@ A03 performs none of those distribution mutations.
 The [R01 release plan](exec-plans/active/R01.md) selects a staged v0.4.0
 candidate: npm package first, then the Action default, exact-SHA external proof,
 immutable tag, tagged external smoke, and finally the GitHub Release. Its
-architecture review passed with `0 blocker / 0 major / 0 minor`; E1 has not
-started, and explicit approval remains required at every merge, publish, tag,
-and GitHub Release checkpoint.
+architecture review passed with `0 blocker / 0 major / 0 minor`. E1 package
+candidate implementation is in progress from frozen base `4b7ee02`; explicit
+approval remains required at every merge, publish, tag, and GitHub Release
+checkpoint.
 
 Core milestones must not silently change an already selected release commit.
 

diff --git a/packages/arcready/README.md b/packages/arcready/README.md
@@ -4,6 +4,27 @@ ArcReady is an Arc-specific CI quality gate and integration validator for wallet
 
 > ArcReady is an independent open-source project. It is not an official Circle or Arc product.
 
+## v0.4.0 package boundary
+
+The `arcready@0.4.0` npm package publishes the precision and compatibility work
+already reviewed on the selected release base. It contains 19 known rules, 15
+rules in the default scan, six default wallet rules, and four rules in the
+opt-in canonical JSON runtime. Four deprecated rules remain public and
+default-excluded: the attestation and gas-label advice rules support explicit
+non-off configuration, while the two legacy App Kit rule objects remain
+available only for direct API compatibility.
+
+This package also includes the additive `arcUsdcAmountConversionRule` library
+export, the experimental opt-in `scan --json-v2` command, and the pinned
+`@solidity-parser/parser@0.20.2` and `typescript@5.9.3` runtime dependencies.
+Legacy reports, configuration, scoring, and normal CLI exit behavior remain
+available. ArcReady still performs local static analysis only; it does not make
+live RPC, API, simulation, deployment, or compatibility-certification claims.
+
+The coordinated GitHub Action `v0.4.0` is a later release checkpoint. Until
+that checkpoint is completed, `tanka420/arcready@v0.3.0` continues to select
+the published v0.3 Action and CLI by default.
+
 ## Install
 
 Run without installing:

diff --git a/packages/arcready/package.json b/packages/arcready/package.json
@@ -1,6 +1,6 @@
 {
   "name": "arcready",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Arc-specific CI quality gate and integration validator for wallets, bridges, App Kit integrations, and dApps.",
   "license": "MIT",
   "type": "module",

diff --git a/packages/arcready/test/cli-json-v2.test.ts b/packages/arcready/test/cli-json-v2.test.ts
@@ -472,7 +472,7 @@ describe("legacy CLI regression", () => {
     const { report } = await runScan(legacyJson.cwd);
 
     expect(terminal.code).toBe(0);
-    expect(terminal.stdout).toContain("ArcReady v0.3.0");
+    expect(terminal.stdout).toContain(`ArcReady v${publicApi.PACKAGE_VERSION}`);
     expect(terminal.stdout).not.toContain('"contractVersion"');
     expect(terminal.stdout).not.toContain('"selectedOccurrences"');
     expect(legacyJson.stdout).toBe(jsonReporter.render(report));