@creatornader/agent-bridge 0.6.1 → 0.6.2

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to agent-bridge are documented in this file.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.2] - 2026-07-21
+
+### Fixed
+
+- Compare endpoint-migration edge file identifiers as 64-bit integers so distinct
+  Windows files cannot alias after number precision loss.
+
+### Changed
+
+- Record the deployed 0.6.1 production proof and require a release-specific workspace
+  when the proof creates fresh sender and receiver principals.
+
 ## [0.6.1] - 2026-07-21
 
 ### Added

package/README.md

@@ -126,7 +126,9 @@ deployment gate passes. GitHub must run it from `main` in the protected
 offline outbox replay, exact idempotency, claim, and acknowledgment. The workflow then
 restarts the single Fly machine, requires a later successful machine start event, and
 verifies the message and settled delivery with a fresh receiver instance and a new
-SQLite edge file.
+SQLite edge file. Use a new proof workspace for each release run. Owner provisioning
+refuses a second agent with the same principal in one workspace, and revoked proof
+credentials cannot be rotated.
 Its versioned receipts contain only identifiers, times, principal and workspace labels,
 the gateway origin, checks, and SHA-256 host evidence. They omit credentials, database
 URLs, message content, and SQLite files.

package/ROADMAP.md

@@ -151,9 +151,16 @@ The published npm version is the authority for whether this package line has shi
 - Public descriptions explain what an agent can do before introducing protocol and
   storage terminology.
 
+### 0.6.2 package contents
+
+- Endpoint migration compares Windows edge file identifiers as 64-bit integers so
+  distinct SQLite files cannot alias after number precision loss.
+- Production proof guidance records the deployed 0.6.1 evidence and uses a
+  release-specific workspace for fresh proof principals.
+
 ### Production validation and adoption
 
-Completed through the published and deployed 0.6.0 package:
+Completed through the published and deployed 0.6.1 package:
 
 - Migrated the project authority from the legacy Supabase schema to the canonical
   PostgreSQL schema after a write freeze, exact-major backup, and restore drill. The
@@ -181,7 +188,7 @@ Completed through the published and deployed 0.6.0 package:
 
 The production proof is repeatable release evidence, not a permanent certification.
 Every gateway release must match its package version and source revision before the
-workflow runs with disposable credentials.
+workflow runs with disposable credentials in a release-specific proof workspace.
 
 ## Near-term work
 

package/dist/cli.js

@@ -6228,15 +6228,15 @@ function targetCurrent(request, env, execute) {
 function edgeIdentity(path) {
   if (!existsSync7(path)) return null;
   verifyPrivatePathAccess(path, "file");
-  const details = lstatSync6(path);
+  const details = lstatSync6(path, { bigint: true });
   if (!details.isFile() || details.isSymbolicLink()) fail3("EDGE_ALIAS", "edge database is not a private regular file");
   return { dev: details.dev, ino: details.ino, nlink: details.nlink };
 }
 function edgeIdentitiesAlias(left, right) {
-  const leftHasFileId = left.dev !== 0 || left.ino !== 0;
-  const rightHasFileId = right.dev !== 0 || right.ino !== 0;
+  const leftHasFileId = left.dev !== 0n || left.ino !== 0n;
+  const rightHasFileId = right.dev !== 0n || right.ino !== 0n;
   if (leftHasFileId && rightHasFileId) return left.dev === right.dev && left.ino === right.ino;
-  if (left.nlink > 1 && right.nlink > 1) {
+  if (left.nlink > 1n && right.nlink > 1n) {
     fail3("EDGE_ALIAS", "edge file identity is ambiguous on this platform");
   }
   return false;