@nextcommerce/campaigns-os 1.33.0 → 1.37.1

package/contracts/release-ledger.json

@@ -4593,6 +4593,620 @@
         }
       ],
       "entry_sha256": "76e84afa5f9228efd00a3f8aca8fd2a601a01955ebac370209598633ae3f790c"
+    },
+    {
+      "id": "RL-0119",
+      "sequence": 119,
+      "date": "2026-09-17",
+      "kind": "release",
+      "surface_version": "1.34.0",
+      "changelog_section": "1.34.0",
+      "changelog_sha256": "d0753f1573b293528397ff0d3bee714f6e5fdb74d94d4f19cc14066bf2720ac8",
+      "agent_impact": "New sdk storage-check command scans explicitly scoped Git-tracked HTML/JavaScript against an SDK-owned storage migration manifest. Supply target SDK version and manifest path; inspect incompatible and unknown findings before a bump. The scanner writes neither campaign files nor run journals. Reports carry file hashes and manifest provenance. Unsupported SDK versions and unresolved code cannot establish compatibility; source evidence never replaces browser/order/analytics proof. The SDK manifest is supplied explicitly while campaign-cart #102 awaits publication.",
+      "compatibility": "additive",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "compatibility_policy",
+          "path": "compatibility.json",
+          "surface_entry": "compatibility.json",
+          "summary": "Package compatibility version follows supported surface 1.34.0."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Add sdk CLI command and the scanner reference to supported surface; version 1.34.0."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate the orientation reference for surface 1.34.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate runtime readiness for surface 1.34.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/sdk-storage-compatibility.md",
+          "surface_entry": "docs/sdk-storage-compatibility.md",
+          "summary": "Document explicit manifest provenance, target version, tracked scope, statuses, exclusions and source-only evidence limits."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "docs/versioning.md",
+          "surface_entry": "docs/versioning.md",
+          "summary": "Document package and supported surface version 1.34.0."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Lockfile package version follows 1.34.0; dependencies unchanged."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Version 1.34.0 and ship the SDK storage compatibility reference."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "sdk",
+          "summary": "New read-only sdk storage-check dispatch, flags and report; suppress lifecycle and session writes for this inspection."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "docs/supported-surface.md",
+          "surface_entry": "docs/supported-surface.md",
+          "summary": "Document sdk storage-check as a supported CLI command."
+        }
+      ],
+      "entry_sha256": "1db46aa2c1f7fee6ebc788cb355690113e08ff0542a0494c6011f439f4fa0ba1"
+    },
+    {
+      "id": "RL-0120",
+      "sequence": 120,
+      "date": "2026-09-18",
+      "kind": "release",
+      "surface_version": "1.34.1",
+      "changelog_section": "1.34.1",
+      "changelog_sha256": "79fdc2f42ae0258ffb29a9f8950b50894386cfc38bae80ae711181f0ce5fe872",
+      "agent_impact": "Runtime recipe 1.0.2 reflects Playwright removing fsevents. Exact v1 agreement semantics remain unchanged. Browser installation uses the Playwright resolved beside Campaigns OS.",
+      "compatibility": "compatible",
+      "migration": "After a dependency update, run campaigns-os qa install-browser to install the matching Chromium.",
+      "changes": [
+        {
+          "class": "workflow",
+          "path": ".github/workflows/ci.yml",
+          "surface_entry": null,
+          "summary": "Require independent types, unit, contracts, browser and consumer-install proof behind check."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/accept/current.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/accept/current.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/accept/minimal.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/accept/minimal.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/advisory-enforcement.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/advisory-enforcement.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/allowlist-without-hosts.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/allowlist-without-hosts.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/committed-output-claim.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/committed-output-claim.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/engines-disagreement-warns.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/engines-disagreement-warns.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/lifecycle-scripts-enabled.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/lifecycle-scripts-enabled.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/missing-required-field.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/missing-required-field.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/unknown-kind.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/unknown-kind.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/unknown-network-policy.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/unknown-network-policy.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/unknown-output-check.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/unknown-output-check.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/unknown-revision.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/unknown-revision.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/unknown-step-id.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/unknown-step-id.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/unperformable-check-skipped.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/unperformable-check-skipped.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/runtime-recipe/reject/unpinned-lockfile.json",
+          "surface_entry": "contracts/fixtures/runtime-recipe/reject/unpinned-lockfile.json",
+          "summary": "Regenerate recipe fixtures against revision 1.0.2 and surface 1.34.1."
+        },
+        {
+          "class": "hashed_surface",
+          "path": "contracts/runtime-recipe.campaigns-os-node-v1.json",
+          "surface_entry": "contracts/runtime-recipe.campaigns-os-node-v1.json",
+          "summary": "Advance recipe to 1.0.2 with an empty exact install-script dependency expectation."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Advance the supported surface to 1.34.1 and refresh the runtime recipe hash."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "Document runtime recipe 1.0.2 and package-owned browser installation and validation."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Document runtime recipe 1.0.2 and package-owned browser installation and validation."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Lock reviewed dependency updates and remove the retired fsevents install script."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Validate Playwright 1.63 and YAML 2.9.1; expose independent CI checks and automatic unit-test discovery."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate the orientation reference for supported surface 1.34.1."
+        }
+      ],
+      "entry_sha256": "e7bb42ad4d748d9fefed5d15a9cef195638f465cf7e93cff2892fde3bd72a1c5"
+    },
+    {
+      "id": "RL-0121",
+      "sequence": 121,
+      "date": "2026-09-18",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.34.1+agent.1",
+      "changelog_sha256": "8b3ea071381418b1516d5e02d4b6b26ce39e7b9f4c0b0fc8ff5b3e05a841ae39",
+      "agent_impact": "HTML parsing uses parse5 8.0.1 and entities 8.1.0. Existing ESM imports and the declared Node >=20.19.0 minimum remain compatible. No consumer action is required.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Upgrade parse5 to ^8.0.1 without changing package exports or the supported Node range."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Lock parse5 8.0.1 and entities 8.1.0 as the reviewed HTML parser dependencies."
+        }
+      ],
+      "entry_sha256": "ae6ef7c17e02e52cad5ba4faa1e4adf8ba3bba375acac36e3e9046d8273c053f"
+    },
+    {
+      "id": "RL-0122",
+      "sequence": 122,
+      "date": "2026-09-18",
+      "kind": "release",
+      "surface_version": "1.35.0",
+      "changelog_section": "1.35.0",
+      "changelog_sha256": "efc41d5b5f2fa2005f6cd93d1ab6e287403edff5be0fbb120e09aef825e7501a",
+      "agent_impact": "Use exact project-local npm releases by default; installed skills and global recovery run the intended copy. Optional tooling diagnose exports redacted installation and local lifecycle evidence without changing sessions or campaign artifacts. Existing lifecycle, orientation trust and QA publication recovery remain unchanged.",
+      "compatibility": "additive",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "documentation",
+          "path": "AGENTS.md",
+          "surface_entry": "AGENTS.md",
+          "summary": "Use exact project-local releases, profile-specific preflight, package-owned browser installation, and read-only redacted diagnostics without changing orientation trust."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Declare the activation/evidence contract and diagnostic reference as named supported documents."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/activation-and-evidence.md",
+          "surface_entry": "docs/activation-and-evidence.md",
+          "summary": "Document six distinct public milestones, access inputs, independent trust/freshness/revisions, and retained-verdict publication recovery."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/diagnostics.md",
+          "surface_entry": "docs/diagnostics.md",
+          "summary": "Document the read-only allowlist export, unsupported vocabulary behavior, independent freshness, and recovery ownership."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Ship the activation/evidence and diagnostic references in npm packages."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": "skills.json",
+          "summary": "Advance all five bundled skill versions for installed-package command conventions."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Explain exact installed-package command resolution and package-owned browser installation for this lifecycle skill."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Explain exact installed-package command resolution and package-owned browser installation for this lifecycle skill."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Explain exact installed-package command resolution and package-owned browser installation for this lifecycle skill."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Explain exact installed-package command resolution and package-owned browser installation for this lifecycle skill."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Explain exact installed-package command resolution and package-owned browser installation for this lifecycle skill."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": null,
+          "summary": "Add tooling diagnose with read-only doctor/next projection, no session sweeping/capture, fixed exception summaries, and global invocation recovery."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate the declarative reference for supported surface 1.35.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate the declarative reference for supported surface 1.35.0."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Record additive package release 1.35.0 in the exact lockfile."
+        }
+      ],
+      "entry_sha256": "4a93e18a369cb149ccd8b80927b31133cc816735ac5d1c4d7a589c234e5a3963"
+    },
+    {
+      "id": "RL-0123",
+      "sequence": 123,
+      "date": "2026-09-18",
+      "kind": "release",
+      "surface_version": "1.36.0",
+      "changelog_section": "1.36.0",
+      "changelog_sha256": "a5f32730cb50238ef8c0d8a0300119410f240ce114a98f574ae5014e8699995a",
+      "agent_impact": "Progress observations reuse canonical next and committed QA without lifecycle or closeout changes. Consumers may validate strict minimal snapshots and group separate Map/spec/build histories; absent binding and unknown vocabulary confer no readiness or trust.",
+      "compatibility": "additive",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "documentation",
+          "path": "AGENTS.md",
+          "surface_entry": "AGENTS.md",
+          "summary": "Explain canonical stage observations, opt-out flags and independent identity/trust semantics."
+        },
+        {
+          "class": "named_surface",
+          "path": "contracts/fixtures/progress/observation.v0.json",
+          "surface_entry": "contracts/fixtures/progress/observation.v0.json",
+          "summary": "Provide a digest-verified receiver agreement fixture with separate Map/spec/build identities."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Declare portable progress helpers, strict snapshot schema, provenance extension and supported reference/fixture."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate declarative supported-surface reference for candidate1.36.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/progress-snapshots.md",
+          "surface_entry": "docs/progress-snapshots.md",
+          "summary": "Document bounded progress wire, independent identities, consent-scoped delivery, exact acknowledgments and receiver remit."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate declarative runtime reference for candidate1.36.0."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "docs/supported-surface.md",
+          "surface_entry": "docs/supported-surface.md",
+          "summary": "Describe additive portable progress consumption without readiness or trust authority."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Record additive candidate1.36.0 in the exact lockfile."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Publish portable progress and JSON schema exports plus their reference in candidate1.36.0."
+        },
+        {
+          "class": "schema",
+          "path": "schemas/campaign-runtime-build-context.v0.schema.json",
+          "surface_entry": "schemas/campaign-runtime-build-context.v0.schema.json",
+          "summary": "Declare optional saved Map provenance and its separate fetched local semantic baseline."
+        },
+        {
+          "class": "schema",
+          "path": "schemas/campaigns-os-progress-snapshot.v0.schema.json",
+          "surface_entry": "schemas/campaigns-os-progress-snapshot.v0.schema.json",
+          "summary": "Add strict bounded versioned progress wire with fixed vocabulary, independent stage/binding and continuation observations."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": null,
+          "summary": "Observe after canonical next and successful committed QA, and retain fresh fetched Map provenance in context intake."
+        }
+      ],
+      "entry_sha256": "181049ebc0cdf27935453579a11e7878b200dadb5bbbc73798226259a684a6a5"
+    },
+    {
+      "id": "RL-0124",
+      "sequence": 124,
+      "date": "2026-09-18",
+      "kind": "amendment",
+      "surface_version": null,
+      "changelog_section": "1.36.0+agent.1",
+      "changelog_sha256": "ed7fb01c149dc14453dbba713e7ca4d8278a36c67a32c608ee528866ee6f7f3a",
+      "agent_impact": "Require a nonempty matching context packet pointer before accepting saved revision provenance or its source endpoint. Retry after live allocation completes; stop all target writers before the documented offline recovery for interrupted lock reclamation.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": null,
+          "surface_entry": "docs/progress-snapshots.md",
+          "summary": "Document strict context binding and bounded dead-owner allocation recovery, with explicit offline recovery for an interrupted claim."
+        }
+      ],
+      "entry_sha256": "62716dd67dad35c1f6aeca337f0a8a47bd4daf78d65461f348fbf6234c6850b1",
+      "amends": "RL-0123",
+      "amendment_reason": "Clarify the strict context binding and allocation recovery recorded for the unreleased progress producer; runtime repairs and positive integration coverage were accepted before candidate publication. The document path is covered once by RL-0123 across the full candidate PR range."
+    },
+    {
+      "id": "RL-0125",
+      "sequence": 125,
+      "date": "2026-09-18",
+      "kind": "release",
+      "surface_version": "1.37.0",
+      "changelog_section": "1.37.0",
+      "changelog_sha256": "683559dec36726ceb6114bfca9239ca0e2dac39adabac933dd6317d0e20879ec",
+      "agent_impact": "Agents can create an offline static Apollo sample without campaign configuration, session changes, networking or evidence. Real campaigns begin in a separate new folder; existing targets and unsupported flags are refused.",
+      "compatibility": "additive",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "documentation",
+          "path": "AGENTS.md",
+          "surface_entry": "AGENTS.md",
+          "summary": "Document offline sample isolation, strict arguments and the separate real-campaign transition."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/agent-relevant-change-policy.v1.json",
+          "surface_entry": "contracts/agent-relevant-change-policy.v1.json",
+          "summary": "Classify internal static projection files while retaining derived manifest and notice obligations."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Add the demo command, reference, attribution notice and hashed provenance manifest at surface 1.37.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "demo/apollo-v0/NOTICE.txt",
+          "surface_entry": "demo/apollo-v0/NOTICE.txt",
+          "summary": "Retain pinned NEXT attribution and Page Kit/Tailwind notices without an additional template licence grant."
+        },
+        {
+          "class": "hashed_surface",
+          "path": "demo/apollo-v0/provenance.json",
+          "surface_entry": "demo/apollo-v0/provenance.json",
+          "summary": "Pin the published maintainer toolchain, input hashes and every validated output digest."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/activation-and-evidence.md",
+          "surface_entry": "docs/activation-and-evidence.md",
+          "summary": "Describe offline visual sampling without granting campaign proof."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/demo-preview.md",
+          "surface_entry": "docs/demo-preview.md",
+          "summary": "Specify exclusive creation, offline exploration, regeneration and preserved sample edits."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate the reference with the explicit internal static projection classification."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate the runtime reference for package version 1.37.0."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "docs/supported-surface.md",
+          "surface_entry": "docs/supported-surface.md",
+          "summary": "Document the supported command and provenance boundary."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Keep exact package identity at candidate 1.37.0."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Ship the static bundle and reference without adding runtime compiler or Page Kit dependencies."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": null,
+          "summary": "Dispatch demo before session recovery and lifecycle capture, rejecting unsupported arguments before creation."
+        }
+      ],
+      "entry_sha256": "51781e61741ac908cb8407935f8af301eac88213700eac5605951c920be11920"
+    },
+    {
+      "id": "RL-0126",
+      "sequence": 126,
+      "date": "2026-09-18",
+      "kind": "release",
+      "surface_version": "1.37.1",
+      "changelog_section": "1.37.1",
+      "changelog_sha256": "2c7f1178c26f0d5c920a5842f03e78fa01446bc2738974f7d792fe6c72f4ba8b",
+      "agent_impact": "When a demo destination changes during copying, preserve its files and retry with a different new directory. Argument validation, ownership checks and cleanup semantics are unchanged.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Advance the compatible package patch to 1.37.1 without changing hashed contracts."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Keep the package patch identity at 1.37.1."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Keep the exact lockfile package identity at 1.37.1."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate the runtime reference for package version 1.37.1."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": null,
+          "summary": "Explain raw argv validation before private parsed-target extraction without altering dispatch."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate the orientation reference for surface version 1.37.1."
+        }
+      ],
+      "entry_sha256": "76423be9a8624b8a3b398f4a4bfd47ff17b48f45d6a3bc44a22e122172684c6a"
     }
   ]
 }

package/contracts/runtime-recipe.campaigns-os-node-v1.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.1",
+  "recipe_revision": "1.0.2",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -84,7 +84,7 @@
       "stdin": "closed",
       "lifecycle_scripts": "disabled",
       "timeout_bound": "install_seconds",
-      "rationale": "ci rather than install, so the lockfile is authoritative and the tree is reproducible. --ignore-scripts is the load-bearing flag: it suppresses every dependency lifecycle script and the target's own prepare. Exactly one dependency in the resolved tree declares an install script, and it ships a prebuilt binary in its published tarball, so nothing in the tree needs its scripts to function. --no-audit and --fund=false remove two network- and output-side effects that are not part of preparing a runtime."
+      "rationale": "ci rather than install, so the lockfile is authoritative and the tree is reproducible. --ignore-scripts is the load-bearing flag: it suppresses every dependency lifecycle script and the target's own prepare. No dependency in the resolved tree declares an install script. The exact list in target_expectations remains a reviewed expectation: additions and removals require a recipe revision, so existing v1 consumers retain the same agreement semantics. --no-audit and --fund=false remove two network- and output-side effects that are not part of preparing a runtime."
     },
     {
       "id": "build",
@@ -286,9 +286,7 @@
       "build:spec": "tsc -p campaign-spec/tsconfig.build.json",
       "prepare": "npm run build:spec"
     },
-    "install_script_dependencies": [
-      "fsevents"
-    ]
+    "install_script_dependencies": []
   },
   "capabilities": {
     "_note": "What a generation prepared by this recipe can and cannot do. Stated explicitly because 'runtime ready' invites the wrong reading: the same flag that makes the install safe also means the prepared generation has no browser to drive. Preparing a runtime and being able to run browser QA are different readiness questions, and this recipe answers only the first.",