@ai-ecoverse/slicc-agent 6.14.2 → 6.14.3

package/README.md

@@ -158,7 +158,7 @@ The first provider is AWS Bedrock with a Bedrock API key as the bearer token; th
 
 ### In slicc-spectrum
 
-`@ai-ecoverse/slicc-spectrum` is an optional peer dependency, `^1.96.0`. 1.94.0 is the first release with the provider picker (`providers()`, `remove`, `vaultName`, `customBase`, a field's `options` and `value`); 1.94.1 shows a field with `options` as an `sp-picker` on its `value`; 1.95.0 shows a `blocked` provider in the picker as unpickable with “Needs the SLICC extension or CLI”; and 1.96.0 registers an MCP token's server URL (`Account.url`) with the vault itself, after a “Connect to {url}?” confirm, and offers Reconnect when the URL moves. `test/integration/settings-ui.test.mjs` checks each in a real `<slicc-settings>`: Bedrock's region picker on the stored region, a blocked provider that can't be picked until a CORS-free route appears, and the moved note once `mcp.json` points a connected server elsewhere.
+`@ai-ecoverse/slicc-spectrum` is an optional peer dependency, `^1.98.0`. 1.94.0 is the first release with the provider picker (`providers()`, `remove`, `vaultName`, `customBase`, a field's `options` and `value`); 1.94.1 shows a field with `options` as an `sp-picker` on its `value`; 1.95.0 shows a `blocked` provider in the picker as unpickable with “Needs the SLICC extension or CLI”; 1.96.0 registers an MCP token's server URL (`Account.url`) with the vault itself, after a “Connect to {url}?” confirm, and offers Reconnect when the URL moves; and 1.98.0 saves a field's value as its `vaultSetting` on the vault record (`VaultPort.settings`, V3). `test/integration/settings-ui.test.mjs` checks each in a real `<slicc-settings>`: Bedrock's region picker on the stored region, a blocked provider that can't be picked until a CORS-free route appears, the moved note once `mcp.json` points a connected server elsewhere, and that adding Cloudflare Workers AI or Azure (by resource name) puts the key with its tenant fields as the record's vault `settings` (`CLOUDFLARE_ACCOUNT_ID`, `AZURE_OPENAI_RESOURCE_NAME`).
 
 `@ai-ecoverse/slicc-agent/spectrum` turns an `AgentConnection` into slicc-spectrum's `AgentPort`, so `<slicc-app>` shows the real agent:
 
@@ -824,7 +824,7 @@ Every same-repo pull request gets one `cert-review` status from `.github/workflo
   - **Not behaviour:** anything else, such as `evals/`, `test/`, `README.md`, `AGENTS.md`, `renovate.json`, `lefthook.yml` and `scripts/check-*.mjs`. It gets a green `not behaviour: <files>`.
   - **Evidence comes by id from the job that made it:** the jobs that run the pull request's code (`pack candidate` builds it; both `suite` legs run its tests) share the run's artifact store with the jobs that don't, and code in them can reach the runner's artifact token. So each producer job hands on its artifact's `artifact-id` and `artifact-digest`, consumers download by `artifact-ids` with `digest-mismatch: error`, no upload uses `overwrite`, and the base build has its own job, `pack base`, which runs only main's code and restores no Actions cache, because the candidate job shares the run's cache scope. `tools/cert-review/artifacts.mjs` lists the run's artifacts and fails on any in `agent-tgz-` or `cert-review-` that its producer didn't upload with that id, name and digest. `same` runs it before it compares the tarballs, and it uploads its evidence before it posts, so "not behaviour (identical dist)" can't be bought with a planted artifact. `record` runs it on everything, and a failure makes the record INCOMPLETE. **Protected:** the base build, the delta, the same-dist evidence and the review's verdict and evidence. **Not protected, by design:** the candidate tarball and both suites' results (the base leg runs the pull request's tests on main's tree), because code on a runner can always lie about its own results. They're taken by exact name, at most one each.
   - **Same dist:** a behaviour change is packed for real on both sides. If the tarballs carry the same files, entry types, modes and bytes once each side's exact version and `gitHead` are normalised (source maps without their `mappings`), and `package.json` differs only in `devDependencies`, `version` and `gitHead`, the status is `not behaviour (identical dist)` with both sha256. A change to the reviewer, `release.yml`, `ci.yml`, `.releaserc*` or `scripts/publish.mjs` always gets the full review.
-- **When it runs:** on `merge-ok`, and again on every push while the label is on. Before that a behaviour change is red with `waits for merge-ok`. A same-repo pull request by `renovate[bot]` is reviewed without the label, on every push, so a devDependency bump settles as `not behaviour (identical dist)` without anyone labelling it, and a bump that changes what ships gets the full review.
+- **When it runs:** on every same-repo pull request that isn't a draft: `opened`, `ready_for_review`, `reopened` and every push. Draft status replaces the old `merge-ok` label: **mark a pull request ready = it gets reviewed, and merges on green**; a pull request held for anything stays a draft. A draft that changes shipped behaviour is red with `draft: not reviewed, mark it ready for review` and gets no review; `converted_to_draft` cancels a running review (one concurrency group per pull request) and sets that red status, so an older result on the same head can't satisfy the check. Renovate's pull requests aren't drafts, so they're reviewed on every push like anyone's: a devDependency bump settles as `not behaviour (identical dist)` by itself, and a bump that changes what ships gets the full review. Labels other than `cert-review-approved` don't start or cancel anything.
 - **The full review:**
   - The integration suite runs on the merged tree and on main's tree, on `vars.CERT_RUNNER`, with no secrets in those steps. The agent's tests bundle `src/`, so they run on the tree the tarball was packed from.
   - **The NEGATIVE:** the pull request's `test/` diff is applied to main's tree, and its integration tests must fail there for a fix (a test file that fails to load is never a NEGATIVE). Unit tests stay out of git and out of it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "6.14.2",
+  "version": "6.14.3",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",
@@ -68,7 +68,7 @@
     "@ai-ecoverse/slicc-kernel": "1.132.1",
     "@ai-ecoverse/slicc-scrub": "1.0.0",
     "@ai-ecoverse/slicc-shared-web": "1.25.1",
-    "@ai-ecoverse/slicc-spectrum": "1.98.0",
+    "@ai-ecoverse/slicc-spectrum": "1.99.0",
     "@ai-ecoverse/wasi-fnox": "1.39.0-5",
     "@ai-ecoverse/wasm-bash": "5.3.0-21",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-10",
@@ -86,7 +86,7 @@
   },
   "dependencies": {
     "@ai-ecoverse/slicc-browsers": "1.9.0",
-    "@ai-ecoverse/slicc-vault": "1.13.0",
+    "@ai-ecoverse/slicc-vault": "1.14.0",
     "@aws-sdk/middleware-websocket": "^3.972.54",
     "@earendil-works/chord": "1.3.0",
     "@earendil-works/pi-ai": "1.3.0",
@@ -98,7 +98,7 @@
   },
   "peerDependencies": {
     "@ai-ecoverse/slicc-kernel": ">=1.110.0 <2",
-    "@ai-ecoverse/slicc-spectrum": "^1.96.0"
+    "@ai-ecoverse/slicc-spectrum": "^1.98.0"
   },
   "peerDependenciesMeta": {
     "@ai-ecoverse/slicc-spectrum": {