@creatornader/agent-bridge 0.6.1 → 0.6.3

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to agent-bridge are documented in this file.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.3] - 2026-07-26
+
+### Fixed
+
+- Serialize concurrent gateway edge and local-authority mutations through a
+  token-checked lease stored in SQLite. The coordinator recovers an expired
+  crashed-writer lease without releasing a newer owner, and keeps gateway calls
+  outside the local write boundary.
+
+## [0.6.2] - 2026-07-21
+
+### Fixed
+
+- Compare endpoint-migration edge file identifiers as 64-bit integers so distinct
+  Windows files cannot alias after number precision loss.
+
+### Changed
+
+- Record the deployed 0.6.1 production proof and require a release-specific workspace
+  when the proof creates fresh sender and receiver principals.
+
 ## [0.6.1] - 2026-07-21
 
 ### Added
@@ -432,7 +453,12 @@ First tagged release. Marks the point where agent-bridge has shipped its initial
 - Narrative-leak detection in CI + on commit via `creatornader/textleaks@v0.2.0` (renamed from leakguard).
 
 [0.1.0]: https://github.com/creatornader/agent-bridge/releases/tag/v0.1.0
-[Unreleased]: https://github.com/creatornader/agent-bridge/compare/v0.5.1...HEAD
+[Unreleased]: https://github.com/creatornader/agent-bridge/compare/v0.6.3...HEAD
+[0.6.3]: https://github.com/creatornader/agent-bridge/compare/v0.6.2...v0.6.3
+[0.6.2]: https://github.com/creatornader/agent-bridge/compare/v0.6.1...v0.6.2
+[0.6.1]: https://github.com/creatornader/agent-bridge/compare/v0.6.0...v0.6.1
+[0.6.0]: https://github.com/creatornader/agent-bridge/compare/v0.5.2...v0.6.0
+[0.5.2]: https://github.com/creatornader/agent-bridge/compare/v0.5.1...v0.5.2
 [0.5.1]: https://github.com/creatornader/agent-bridge/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/creatornader/agent-bridge/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/creatornader/agent-bridge/compare/v0.3.1...v0.4.0

package/README.md

@@ -126,7 +126,9 @@ deployment gate passes. GitHub must run it from `main` in the protected
 offline outbox replay, exact idempotency, claim, and acknowledgment. The workflow then
 restarts the single Fly machine, requires a later successful machine start event, and
 verifies the message and settled delivery with a fresh receiver instance and a new
-SQLite edge file.
+SQLite edge file. Use a new proof workspace for each release run. Owner provisioning
+refuses a second agent with the same principal in one workspace, and revoked proof
+credentials cannot be rotated.
 Its versioned receipts contain only identifiers, times, principal and workspace labels,
 the gateway origin, checks, and SHA-256 host evidence. They omit credentials, database
 URLs, message content, and SQLite files.
@@ -244,8 +246,9 @@ for its relationship to MCP, A2A, agmsg, brokers, and agent runtimes.
 
 - Node.js 22.23.1 or newer.
 - SQLite 3.51.3 or newer for local and edge storage. The supported Node version includes it.
-- Concurrent local and edge initialization may wait up to 15 seconds for schema work;
-  normal database operations retain their configured busy timeout.
+- Concurrent local and edge initialization may wait up to 15 seconds for schema work.
+  File-backed local and edge stores serialize mutations with a durable token-checked
+  lease, so independently launched MCP clients do not contend as SQLite writers.
 - PostgreSQL 15, 16, 17, or 18 for gateway mode. New PostgreSQL majors fail the
   migration prerequisite and live readiness checks until their catalog digest is
   certified.

package/ROADMAP.md

@@ -151,9 +151,23 @@ The published npm version is the authority for whether this package line has shi
 - Public descriptions explain what an agent can do before introducing protocol and
   storage terminology.
 
+### 0.6.2 package contents
+
+- Endpoint migration compares Windows edge file identifiers as 64-bit integers so
+  distinct SQLite files cannot alias after number precision loss.
+- Production proof guidance records the deployed 0.6.1 evidence and uses a
+  release-specific workspace for fresh proof principals.
+
+### 0.6.3 package contents
+
+- Local SQLite and gateway-edge SQLite mutations coordinate through a durable,
+  token-checked lease. Concurrent MCP processes serialize writes, recover an
+  expired crashed-writer lease safely, and keep gateway calls outside the local
+  write boundary.
+
 ### Production validation and adoption
 
-Completed through the published and deployed 0.6.0 package:
+Completed through the published and deployed 0.6.1 package:
 
 - Migrated the project authority from the legacy Supabase schema to the canonical
   PostgreSQL schema after a write freeze, exact-major backup, and restore drill. The
@@ -181,7 +195,7 @@ Completed through the published and deployed 0.6.0 package:
 
 The production proof is repeatable release evidence, not a permanent certification.
 Every gateway release must match its package version and source revision before the
-workflow runs with disposable credentials.
+workflow runs with disposable credentials in a release-specific proof workspace.
 
 ## Near-term work
 

package/dist/bridge.d.ts

@@ -6,7 +6,7 @@ export { B as BridgeService, P as PublicMessageQuery } from './bridge-service-Dj
 import { P as PgQueryable } from './postgres-bridge-store-ChoOuFEY.js';
 export { a as PgTransactionClient, b as PostgresBridgeStore } from './postgres-bridge-store-ChoOuFEY.js';
 export { A as AuthenticatedCredential, C as CredentialResolver, G as GatewayOptions, P as PostgresCredentialResolver, b as bearerToken, c as createGateway, h as hashCredential, s as safeTokenHashEqual } from './gateway-DWZ3pX48.js';
-export { E as EdgeConflictError, a as EdgeDrainLease, b as EdgeEnqueueResult, c as EdgeMigrationDrainingError, d as EdgeMigrationGate, e as EdgeMigrationGateState, f as EdgeMigrationLeaseError, g as EdgeMigrationRetiredError, h as EdgeOutboxRecord, i as EdgeReadOnlyInspection, j as EdgeScope, k as EdgeStats, P as PendingMessage, S as SQLiteEdgeStore, l as edgeMessageFingerprint, m as edgeScopeKey, n as inspectEdgeScopeReadOnly, s as stableIdempotency } from './sqlite-edge-store-BAFUeysk.js';
+export { E as EdgeConflictError, a as EdgeDrainLease, b as EdgeEnqueueResult, c as EdgeMigrationDrainingError, d as EdgeMigrationGate, e as EdgeMigrationGateState, f as EdgeMigrationLeaseError, g as EdgeMigrationRetiredError, h as EdgeOutboxRecord, i as EdgeReadOnlyInspection, j as EdgeScope, k as EdgeStats, P as PendingMessage, S as SQLiteEdgeStore, l as edgeMessageFingerprint, m as edgeScopeKey, n as inspectEdgeScopeReadOnly, s as stableIdempotency } from './sqlite-edge-store-C-pVhdgx.js';
 export { CachedMessagePage, SQLiteBridgeStore, SyncDiagnostics, SyncInsertResult, SyncReport, SyncingBridgeStore, SyncingBridgeStoreOptions, isRetryableSyncError } from './sqlite.js';
 import 'node:http';
 

package/dist/bridge.js

@@ -15,10 +15,10 @@ import {
   inspectEdgeScopeReadOnly,
   isRetryableSyncError,
   stableIdempotency
-} from "./chunk-ZUZ7TCIH.js";
+} from "./chunk-U4M67GFU.js";
 import {
   SQLiteBridgeStore
-} from "./chunk-IVG4XWWS.js";
+} from "./chunk-7PYY3S27.js";
 import "./chunk-GTK4KOED.js";
 import {
   PostgresBridgeStore