@hypercarrier/rarebit 0.1.0-alpha.3 → 0.1.0-alpha.4

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.1.0-alpha.4 — 2026-08-02
+
+Alpha.4 is a new artifact with a sanitized current source lineage and unchanged
+product capability from the alpha.3 cutoff tree `db7d388`. The old tag graphs
+remain public and are not privacy-clean. All existing alpha.1, alpha.2, and
+alpha.3 tags, releases, and npm artifacts remain immutable (there is no alpha.1
+GitHub Release). Alpha.3 remains the original readable-Recall release. Intended
+npm routing after publication is `next=alpha.4` and `latest=alpha.1`.
+The source-only machine-readable candidate derivation and vendored-scanner
+binding is [`release/privacy-lineage.v1.json`](release/privacy-lineage.v1.json).
+It is excluded from npm and does not claim publication completion.
+
+This release changes only version and release documentation; runtime behavior
+and readable Markdown Recall are unchanged.
+
 ## 0.1.0-alpha.3 — 2026-08-02
 
 - Recall now sends one human-readable Markdown user message with the exact request and local private JSON evidence references. Idle and busy steer behavior remains unchanged, and JSON files remain machine authority.

package/README.md

@@ -10,12 +10,22 @@ and visual language can change. It is not a Task, Project, runtime, priority,
 attention, or delivery authority. Native Pi Session JSONL remains the evidence
 authority.
 
+Alpha.4 is a new artifact with a sanitized current source lineage. Product
+capability is unchanged from the alpha.3 cutoff tree `db7d388`. The old tag
+graphs remain public and are not privacy-clean. All existing alpha.1, alpha.2,
+and alpha.3 tags, releases, and npm artifacts remain immutable (there is no
+alpha.1 GitHub Release). Alpha.3 remains the original readable-Recall release.
+Intended npm routing after publication is `next=alpha.4` and `latest=alpha.1`.
+The source-only machine-readable candidate derivation and vendored-scanner
+binding is [`release/privacy-lineage.v1.json`](release/privacy-lineage.v1.json).
+It is excluded from npm and does not claim publication completion.
+
 ## Install
 
 Use Node 22 or later and Pi 0.83 or later. Install it in Pi from npm:
 
 ```sh
-pi install npm:@hypercarrier/rarebit@0.1.0-alpha.3
+pi install npm:@hypercarrier/rarebit@0.1.0-alpha.4
 pi list
 ```
 
@@ -34,7 +44,7 @@ To use the CLI in a normal Node project, install it and invoke the local bin
 with npm:
 
 ```sh
-npm install @hypercarrier/rarebit@0.1.0-alpha.3
+npm install @hypercarrier/rarebit@0.1.0-alpha.4
 npm exec -- rarebit --help
 ```
 
@@ -118,11 +128,15 @@ sensitive. Do not put their paths or content in a ticket.
 Pin alpha versions for reproducible installs:
 
 ```sh
-pi install npm:@hypercarrier/rarebit@0.1.0-alpha.3
-pi update npm:@hypercarrier/rarebit
+pi install npm:@hypercarrier/rarebit@0.1.0-alpha.4
 pi remove npm:@hypercarrier/rarebit
 ```
 
+The exact-version install also moves an existing Rarebit npm installation to
+that pin. Pi skips versioned npm sources during package updates. Do not use an
+unpinned source for alpha.4 recovery: unpinned npm resolution follows the
+retained `latest`, which remains alpha.1.
+
 To roll back, reinstall a known version with `pi install npm:@hypercarrier/rarebit@<version>`.
 Removal stops package loading. It does not alter Pi Session JSONL or delete
 Rarebit sidecars, job leases, or Recall temp files. Remove retained local data

package/RUNBOOK.md

@@ -1,13 +1,21 @@
 # Rarebit runbook
 
+This runbook applies to `0.1.0-alpha.4`. Operational behavior, including
+readable Markdown Recall, is unchanged from alpha.3; see [CHANGELOG.md](CHANGELOG.md)
+for sanitized-lineage and release-routing details.
+
 Set `rarebit.model` in global Pi settings or in a trusted Project's
 `.pi/settings.json`. It must be `provider/model` or an object with `provider`
 and `id`. Rarebit fails closed when it is missing or invalid. It does not use
 Pi's interactive `defaultModel`.
 
-Run `pi update npm:@hypercarrier/rarebit` to update an npm installation. Run
-`pi remove npm:@hypercarrier/rarebit` to stop loading it. These commands do not
-modify native Sessions or remove Rarebit retained data.
+Install or move this package to the alpha.4 pin with
+`pi install npm:@hypercarrier/rarebit@0.1.0-alpha.4`. Pi treats versioned npm
+sources as pinned, so package update commands skip it. Do not use an unpinned
+source for alpha.4 recovery: unpinned npm resolution follows the retained
+`latest`, which remains alpha.1. Run `pi remove npm:@hypercarrier/rarebit` to
+stop loading it. These commands do not modify native Sessions or remove Rarebit
+retained data.
 
 Inspect derived state without treating it as a transcript:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypercarrier/rarebit",
-  "version": "0.1.0-alpha.3",
+  "version": "0.1.0-alpha.4",
   "description": "Sparse, provenance-bearing conversational evidence recovery for Pi sessions.",
   "license": "MIT",
   "author": "HyperCarrier contributors",

package/scripts/verify-package.mjs

@@ -22,7 +22,7 @@ const forbiddenPath = /(^|\/)(\.git|node_modules|\.github|hc-rarebit\.mjs)(\/|$)
 const allowedBare = new Set(["@earendil-works/pi-ai"]);
 const packageFor = (specifier) => specifier.startsWith("@") ? specifier.split("/").slice(0, 2).join("/") : specifier.split("/")[0];
 const packageJson = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
-assert.equal(packageJson.version, "0.1.0-alpha.3", "release version mismatch");
+assert.equal(packageJson.version, "0.1.0-alpha.4", "release version mismatch");
 
 const packed = JSON.parse(npm(["pack", "--json", "--ignore-scripts"]))[0];
 const tarball = join(root, packed.filename);