@dzhechkov/cloudru-hub 0.1.4 → 0.1.6

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "106646f93a18c0335ff739c61df9432b9a79b743b53941f15e9bcc64b35504a4"
+        "sha256": "edc0f1b076a22dc14b863bef8b287c1b9d8618a12b7ecf9f6eb0c497f74361f3"
       },
       {
         "path": "LICENSE",
@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "38e29682c26399d930823f68ff35febfc2e0045e3912e1665ed071c9b73c084c"
+        "sha256": "504ce5cd5b6293b3606f861f31406ae89aa6fee45a03c9099d793aa5a456ced1"
       },
       {
         "path": "THIRD_PARTY_NOTICES.md",
@@ -45,7 +45,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "24333e792a9cbdbc5d23f10d47969f3d3e984a2acc000c903b4003ffcf42d02f"
+        "sha256": "b45bf908d1fe1584a6c638635c2840e634265b131abd875089c60afe4214668d"
       },
       {
         "path": "src/classification.js",
@@ -101,5 +101,5 @@
       }
     ]
   },
-  "signature": "jfciH34h4f/SUaAlkeRh4BOQVIFbmJDJv7cewtiBSApv1V/xTPTyUvoEsN0eYyz5w9Y9KrwFjh5dKLp4AQnqDA=="
+  "signature": "5a7f1ENpsTrJdKd9zR9W2F7fuv7leGxi3PKoYqeFoocBgrQl4pNY19NutzvaX0KGpXG2tyDuMcci5Sop8OBvAw=="
 }

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog — @dzhechkov/cloudru-hub
 
+## 0.1.6
+
+Corrects the link added in 0.1.5: the Тимур credit now points at his about page
+(https://shkrbkv.ru/about/), not at a single note. The 0.1.5 entry below is left as written — it
+records what that release actually shipped, and a dated entry is not rewritten to hide a wrong link.
+
+## 0.1.5
+
+Attribution only, no code change. Both README mentions of Тимур — the Hermes engine author whose
+grant satisfied the ADR-001 licence hold — now link to his site
+(https://shkrbkv.ru/notes/agent-guardrails/), so the credit on the npm page points at the person
+rather than just naming him. The LICENSE grant record and the historical changelog entries are left
+exactly as written: a licence text and a dated record are not places to retrofit links.
+
 ## 0.1.4 — 2026-08-12 (FIRST PUBLICATION — ADR-001 hold satisfied, AM-2)
 
 - **The licence hold is SATISFIED and the pack is published.** Тимур — the author of the

package/README.md

@@ -1,7 +1,7 @@
 # @dzhechkov/cloudru-hub
 
 > **STATUS: published — the ADR-001 licence hold is SATISFIED (AM-2, 2026-08-12).**
-> Тимур, the author of the Hermes engine additions, approved publication (owner-reported
+> [Тимур](https://shkrbkv.ru/about/), the author of the Hermes engine additions, approved publication (owner-reported
 > 2026-08-12 — the grant record is linked from the `Grant-Confirmation:` line in LICENSE
 > Part 2; archiving the author's written confirmation is a recorded owner follow-up).
 > The `dz guard` `licence-hold` rule stays armed and keeps verifying
@@ -23,7 +23,7 @@ docker-compose deploy wizard.
   tests): **Dmitry Zhechkov** (MIT — LICENSE Part 1). Per ADR-001 AM-1 the original Go
   CLI on which the engine builds is the owner's work; the Hermes engine is a derivative
   of it.
-- **Hermes engine additions** (the ~144-tool MCP layer): **Тимур**, the Hermes author.
+- **Hermes engine additions** (the ~144-tool MCP layer): **[Тимур](https://shkrbkv.ru/about/)**, the Hermes author.
   **Zero bytes of those additions ship in this package** — no binary, no Go sources, no
   skill corpus. Publication of this package was approved by the author (grant recorded
   2026-08-12 — LICENSE Part 2, `Grant-Confirmation:` link). The author designated no
@@ -98,7 +98,7 @@ and requires the suite to go RED — 13/13 PROVEN (MEASURED — gate run 2026-08
    covers the full engine identity — `hermes`, `dzhechko` (go-module owner), `cloudru-vm-cli`,
    `captainkeys` — with word-boundary matching so the published scope `@dzhechkov` is not
    over-blocked.
-7. **The engine binary-name leak forms are scrubbed, not codename-gated** (0.1.4) — the
+7. **The engine binary-name leak forms are scrubbed, not codename-gated** (since 0.1.3) — the
    bare token `cloudru-vm` is ALSO the legitimate MCP server name that must appear in
    output (`\bcloudru-vm\b` over-blocks the compiler's own injected prose `сервера
    cloudru-vm видны` — PROVEN), so instead the two unambiguous leak FORMS get targeted

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/cloudru-hub",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "licenseHold": {
     "adr": "features/hermes-claude-adaptation/03_adr/001-licence-and-provenance-precondition.md",
     "note": "SATISFIED hold (ADR-001 AM-2, grant recorded 2026-08-12 — see grant-record-2026-08-12.md). The field deliberately STAYS: the dz guard `licence-hold` rule passes a satisfied hold with the trigger in place and keeps verifying LICENSE (no PENDING placeholder, Grant-Confirmation URL), THIRD_PARTY_NOTICES and the SPDX license field on every publish. test/pack-holds.test.mjs goes RED if this field is dropped or the LICENSE grant record is degraded."

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "106646f93a18c0335ff739c61df9432b9a79b743b53941f15e9bcc64b35504a4"
+          "content": "edc0f1b076a22dc14b863bef8b287c1b9d8618a12b7ecf9f6eb0c497f74361f3"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "38e29682c26399d930823f68ff35febfc2e0045e3912e1665ed071c9b73c084c"
+          "content": "504ce5cd5b6293b3606f861f31406ae89aa6fee45a03c9099d793aa5a456ced1"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "24333e792a9cbdbc5d23f10d47969f3d3e984a2acc000c903b4003ffcf42d02f"
+          "content": "b45bf908d1fe1584a6c638635c2840e634265b131abd875089c60afe4214668d"
         }
       ]
     },