@planu/cli 5.3.13 → 5.3.15

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+## [5.3.15] - 2026-08-11
+
+### Bug Fixes
+- fix(spec-1403): apply implementation-review arbitration fixes
+- fix(spec-1403): make destructive housekeeping report-only under typed authority
+
+### Chores
+- chore(spec-1403): record done transition with arbitration evidence
+
+
+## [5.3.14] - 2026-08-10
+
+### Bug Fixes
+- fix(spec-1481): bound trapped fixture life per implementation-review arbitration
+- fix(spec-1481): harden stdio abort test vs load and de-vacuize pid asserts
+- fix(spec-1466): apply implementation-review arbitration fixes
+- fix(spec-1467): require positive integer pid in waitForPid per review arbitration
+- fix(spec-1466): legalize test-evidence overlap in ownership gate and handoff agreement
+- fix(spec-1467): harden timing-sensitive receipt and process-runner tests
+
+### Chores
+- chore(specs): file SPEC-1484 durable heartbeat flaky test dogfood bug
+- chore(specs): file SPEC-1483 stale native artifacts after release abort
+- chore(specs): record SPEC-1481 done transition and file SPEC-1482 lint-gate bug
+- chore(specs): file SPEC-1481 flaky stdio lifecycle test under full-suite load
+- chore(specs): record done transitions for SPEC-1466/1467 and file SPEC-1480 debt spec
+- chore(specs): record implementing transitions for SPEC-1466/1467 with handoff evidence
+- chore(specs): approve SPEC-1466/1467 after round 2; file SPEC-1479
+
+
 ## [5.3.13] - 2026-08-10
 
 ### Bug Fixes

package/dist/engine/cascade-hooks/hooks/housekeeping-on-done.hook.js

@@ -9,8 +9,7 @@ async function handler(ctx) {
     try {
         // Dynamic import keeps module graph lean — housekeeping-sweep is only needed on 'done'.
         const { runHousekeepingSweep } = await import('../../housekeeping/index.js');
-        // Housekeeping also auto-triggers via SPEC-790 in github-release-handler.ts
-        void runHousekeepingSweep({ projectPath, dryRun: false });
+        void runHousekeepingSweep({ projectPath });
     }
     catch (err) {
         const error = err instanceof Error ? err.message : String(err);
@@ -29,7 +28,7 @@ export const housekeepingOnDoneHook = {
     id: 'housekeeping-on-done',
     triggers: ['done'],
     requiresProjectPath: true,
-    label: 'Auto-run housekeeping_sweep on spec done — delete orphan stashes/branches (SPEC-782)',
+    label: 'Auto-run report-only housekeeping_sweep on spec done (SPEC-782)',
     handler,
 };
 //# sourceMappingURL=housekeeping-on-done.hook.js.map

package/dist/engine/handoff-packager.d.ts

@@ -16,8 +16,8 @@ export declare function extractCanonicalFileOwnership(content: string): {
     toModify: string[];
     toCreate: string[];
     toTest: string[];
-    /** Test paths as declared, before conflict filtering — used to exclude conflicted
-     *  paths from other categories even though they no longer appear in `toTest`. */
+    /** Test paths as declared, before conflict stripping — feeds the package-level
+     *  test filter and the ownership-agreement exclusion. */
     toTestDeclared: string[];
     blockers: string[];
 };

package/dist/engine/handoff-packager.js

@@ -213,7 +213,7 @@ export function extractCanonicalFileOwnership(content) {
     const toCreate = parseSection('Create');
     const toModify = parseSection('Modify');
     const toTest = parseSection('Test');
-    const conflicts = [...new Set([...toCreate, ...toModify, ...toTest])].filter((path) => [toCreate, toModify, toTest].filter((paths) => paths.includes(path)).length > 1);
+    const conflicts = toCreate.filter((path) => toModify.includes(path));
     for (const path of conflicts) {
         addBlocker(`CONFLICTING_FILE_OWNERSHIP: ${path}`);
     }
@@ -411,10 +411,11 @@ function extractFileLevelWorkPlanOwnership(content) {
         blockers: [...new Set(state.blockers)].sort(),
     };
 }
-function validateOwnershipAgreement(canonical, workPlan) {
+function validateOwnershipAgreement(canonical, workPlan, testDeclaredPaths) {
     if (!canonical.present || !workPlan.present) {
         return [];
     }
+    const testDeclared = new Set(testDeclaredPaths);
     const classification = (ownership, path) => ownership.toCreate.includes(path)
         ? 'Create'
         : ownership.toModify.includes(path)
@@ -425,7 +426,7 @@ function validateOwnershipAgreement(canonical, workPlan) {
         ...canonical.toModify,
         ...workPlan.toCreate,
         ...workPlan.toModify,
-    ]);
+    ].filter((path) => !testDeclared.has(path)));
     return [...paths].sort().flatMap((path) => {
         const canonicalClass = classification(canonical, path);
         const workPlanClass = classification(workPlan, path);
@@ -598,7 +599,7 @@ export async function packageHandoff(spec, knowledge) {
         ...canonicalFiles.blockers,
         ...canonicalOwnership.blockers,
         ...workPlanOwnership.blockers,
-        ...validateOwnershipAgreement(canonicalOwnership, workPlanOwnership),
+        ...validateOwnershipAgreement(canonicalOwnership, workPlanOwnership, canonicalFiles.toTestDeclared),
         ...(!['draft', 'review', 'approved', 'implementing', 'done', 'discarded'].includes(spec.status)
             ? [`UNSUPPORTED_LIFECYCLE_STATUS: ${spec.status}`]
             : []),

package/dist/engine/housekeeping/find-stale-branches.d.ts

@@ -27,9 +27,9 @@ export declare function extractSpecIdFromCommit(projectPath: string, sha: string
  */
 export declare function lookupSpecStatus(projectPath: string, specId: string): Promise<string | null>;
 /**
- * Pass 2: for each branch in `skipped` with reason 'not_merged', check if its
- * SPEC ID (from name or tip commit message) is `done` or `discarded` in Planu.
- * Matching branches are moved from `skipped` to `stale` with reason 'spec-done'.
+ * Pass 2: a `not_merged` branch whose spec is done/discarded becomes `stale`
+ * only when `git merge-base --is-ancestor` proves every commit is reachable
+ * from main, develop, or master. Spec status alone never promotes a branch.
  * Mutates both arrays in-place.
  */
 export declare function applySpecDonePass(projectPath: string, skipped: SkippedBranchInfo[], stale: StaleBranchInfo[], branchShas: Map<string, string>): Promise<void>;

package/dist/engine/housekeeping/find-stale-branches.js

@@ -148,8 +148,6 @@ export async function extractSpecIdFromCommit(projectPath, sha) {
         return null;
     }
 }
-/** Terminal statuses that mean the branch work is complete. */
-const DONE_STATUSES = new Set(['done', 'discarded']);
 /**
  * Look up the status of a spec by reading 'planu/specs/<specId>-star/spec.md' frontmatter.
  * Returns the raw status string, or null when not found.
@@ -176,43 +174,41 @@ export async function lookupSpecStatus(projectPath, specId) {
         return null;
     }
 }
+async function isProvenIntegrated(projectPath, branch) {
+    for (const base of ['main', 'develop', 'master']) {
+        try {
+            await execFile('git', ['merge-base', '--is-ancestor', branch, base], { cwd: projectPath });
+            return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
 /**
- * Pass 2: for each branch in `skipped` with reason 'not_merged', check if its
- * SPEC ID (from name or tip commit message) is `done` or `discarded` in Planu.
- * Matching branches are moved from `skipped` to `stale` with reason 'spec-done'.
+ * Pass 2: a `not_merged` branch whose spec is done/discarded becomes `stale`
+ * only when `git merge-base --is-ancestor` proves every commit is reachable
+ * from main, develop, or master. Spec status alone never promotes a branch.
  * Mutates both arrays in-place.
  */
 export async function applySpecDonePass(projectPath, skipped, stale, branchShas) {
-    // Fast-path: no not_merged branches → nothing for Pass 2 to do.
-    const notMerged = skipped.filter((b) => b.skipReason === 'not_merged');
-    if (notMerged.length === 0) {
-        return;
-    }
-    const toRemove = new Set();
-    for (const branch of notMerged) {
-        // Try branch name first (zero git calls)
-        let specId = extractSpecIdFromName(branch.name);
-        // Fall back to commit message if name has no spec id (one git call per branch)
-        if (!specId) {
-            const sha = branchShas.get(branch.name) ?? '';
-            specId = await extractSpecIdFromCommit(projectPath, sha);
-        }
+    const candidates = skipped.filter((entry) => entry.skipReason === 'not_merged');
+    for (const candidate of candidates) {
+        const sha = branchShas.get(candidate.name) ?? '';
+        const specId = extractSpecIdFromName(candidate.name) ?? (await extractSpecIdFromCommit(projectPath, sha));
         if (!specId) {
             continue;
         }
         const status = await lookupSpecStatus(projectPath, specId);
-        if (status !== null && DONE_STATUSES.has(status)) {
-            const sha = branchShas.get(branch.name) ?? '';
-            stale.push({ name: branch.name, sha, reason: 'spec-done' });
-            toRemove.add(branch.name);
+        if (status !== 'done' && status !== 'discarded') {
+            continue;
         }
-    }
-    // Remove promoted branches from skipped
-    for (let i = skipped.length - 1; i >= 0; i--) {
-        const entry = skipped[i];
-        if (entry && toRemove.has(entry.name)) {
-            skipped.splice(i, 1);
+        if (!(await isProvenIntegrated(projectPath, candidate.name))) {
+            continue;
         }
+        skipped.splice(skipped.indexOf(candidate), 1);
+        stale.push({ name: candidate.name, sha, reason: 'spec-done' });
     }
 }
 export async function findStaleBranches(input) {

package/dist/engine/housekeeping/sweep-runner.js

@@ -19,9 +19,43 @@ async function deleteBranch(projectPath, branchName) {
         return false;
     }
 }
+async function remoteBranchRefExists(projectPath, branchName) {
+    try {
+        const { stdout } = await execFile('git', ['ls-remote', '--heads', 'origin', branchName], {
+            cwd: projectPath,
+        });
+        return stdout.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function isRemoteBranchProvenMerged(projectPath, branchName) {
+    for (const base of ['main', 'develop', 'master']) {
+        try {
+            await execFile('git', ['merge-base', '--is-ancestor', `origin/${branchName}`, base], {
+                cwd: projectPath,
+            });
+            return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
+async function deleteRemoteBranch(projectPath, branchName) {
+    try {
+        await execFile('git', ['push', 'origin', '--delete', branchName], { cwd: projectPath });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 async function removeWorktree(projectPath, worktreePath) {
     try {
-        await execFile('git', ['worktree', 'remove', '--force', worktreePath], { cwd: projectPath });
+        await execFile('git', ['worktree', 'remove', worktreePath], { cwd: projectPath });
         return true;
     }
     catch {
@@ -41,7 +75,6 @@ async function dropStash(projectPath, stashRef) {
 // Backup helpers
 // ---------------------------------------------------------------------------
 async function backupAndDeleteBranch(projectPath, branch) {
-    // Write to history BEFORE deleting (for recovery)
     try {
         await appendHousekeepingEntry(projectPath, {
             projectPath,
@@ -50,10 +83,30 @@ async function backupAndDeleteBranch(projectPath, branch) {
             sha: branch.sha,
         });
     }
-    catch {
-        // Log failure is non-fatal — continue with deletion
+    catch (error) {
+        return {
+            ok: false,
+            error: `branch ${branch.name}: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return deleteBranch(projectPath, branch.name);
+    return { ok: await deleteBranch(projectPath, branch.name) };
+}
+async function backupAndDeleteRemoteBranch(projectPath, branch) {
+    try {
+        await appendHousekeepingEntry(projectPath, {
+            projectPath,
+            kind: 'branch',
+            ref: `origin/${branch.name}`,
+            sha: branch.sha,
+        });
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: `remote branch origin/${branch.name}: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    return { ok: await deleteRemoteBranch(projectPath, branch.name) };
 }
 async function backupAndRemoveWorktree(projectPath, wt) {
     try {
@@ -64,10 +117,13 @@ async function backupAndRemoveWorktree(projectPath, wt) {
             sha: wt.branch ?? '',
         });
     }
-    catch {
-        // non-fatal
+    catch (error) {
+        return {
+            ok: false,
+            error: `worktree ${wt.path}: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return removeWorktree(projectPath, wt.path);
+    return { ok: await removeWorktree(projectPath, wt.path) };
 }
 async function backupAndDropStash(projectPath, stash) {
     try {
@@ -78,16 +134,19 @@ async function backupAndDropStash(projectPath, stash) {
             sha: String(stash.createdAt),
         });
     }
-    catch {
-        // non-fatal
+    catch (error) {
+        return {
+            ok: false,
+            error: `stash ${stash.ref}: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return dropStash(projectPath, stash.ref);
+    return { ok: await dropStash(projectPath, stash.ref) };
 }
 // ---------------------------------------------------------------------------
 // Main orchestrator
 // ---------------------------------------------------------------------------
 export async function runHousekeepingSweep(input) {
-    const { projectPath, dryRun = true, aggressive = false, includeStashes = false } = input;
+    const { projectPath, authority = { mode: 'report' }, aggressive = false, includeStashes = false, } = input;
     const sweepAt = new Date().toISOString();
     // Find stale items in parallel
     const [{ stale: staleBranches, skipped }, staleWorktrees, staleStashes] = await Promise.all([
@@ -96,6 +155,7 @@ export async function runHousekeepingSweep(input) {
         includeStashes ? findStaleStashes({ projectPath }) : Promise.resolve([]),
     ]);
     const report = {
+        mode: authority.mode,
         sweepAt,
         projectPath,
         wouldDelete: {
@@ -108,34 +168,60 @@ export async function runHousekeepingSweep(input) {
         },
         executed: false,
         deleted: { branches: 0, worktrees: 0, stashes: 0, backups: 0 },
+        errors: [],
     };
-    if (dryRun) {
+    if (authority.mode === 'report') {
         return report;
     }
     // Execute deletions
     report.executed = true;
     // Delete branches (sequential — each needs a backup entry first)
     for (const branch of staleBranches) {
-        const ok = await backupAndDeleteBranch(projectPath, branch);
-        if (ok) {
+        const result = await backupAndDeleteBranch(projectPath, branch);
+        if (result.ok) {
             report.deleted.branches++;
         }
+        else if (result.error) {
+            report.errors.push(result.error);
+        }
+        if (!authority.deleteRemoteRefs) {
+            continue;
+        }
+        if (!(await remoteBranchRefExists(projectPath, branch.name))) {
+            continue;
+        }
+        if (!(await isRemoteBranchProvenMerged(projectPath, branch.name))) {
+            continue;
+        }
+        const remoteResult = await backupAndDeleteRemoteBranch(projectPath, branch);
+        if (remoteResult.ok) {
+            report.deleted.branches++;
+        }
+        else if (remoteResult.error) {
+            report.errors.push(remoteResult.error);
+        }
     }
     // Remove worktrees (sequential)
     for (const wt of staleWorktrees) {
-        const ok = await backupAndRemoveWorktree(projectPath, wt);
-        if (ok) {
+        const result = await backupAndRemoveWorktree(projectPath, wt);
+        if (result.ok) {
             report.deleted.worktrees++;
         }
+        else if (result.error) {
+            report.errors.push(result.error);
+        }
     }
     // Drop stashes (sequential — must handle index shifting)
     // Drop in reverse order so indices stay valid
     const reversedStashes = [...staleStashes].reverse();
     for (const stash of reversedStashes) {
-        const ok = await backupAndDropStash(projectPath, stash);
-        if (ok) {
+        const result = await backupAndDropStash(projectPath, stash);
+        if (result.ok) {
             report.deleted.stashes++;
         }
+        else if (result.error) {
+            report.errors.push(result.error);
+        }
     }
     // SPEC-771: clean stale .bak.* backup files from planu/specs/ (best-effort)
     report.deleted.backups = await cleanStaleBackups(projectPath);

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.13",
-  "engineVersion": "5.3.13",
-  "buildId": "1-5.3.13-aarch64-apple-darwin",
+  "cliVersion": "5.3.15",
+  "engineVersion": "5.3.15",
+  "buildId": "1-5.3.15-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "63b4e21bd8fd8154d97f9f1a471fd7a731c6bc0514dec2ef9a2a5d9f1a98eb32",
+  "artifactSha256": "0fbd8c0babdbfb88cae442db9cc57521f67ee345aa1872ed0cd04f464f992584",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "b25f5ddbd51db18f2bebb1e86e7cd31f174e3613e187ec00c7ebc66132a66d0c"
+    "sha256": "41999cac08a7c64a9c899eac628df8e4bc10d70dc1b1923d5951a89f5ac8e878"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "4c29cf026dcfa833b89a328afa3546aecbc02d22",
+    "sourceCommit": "14948c630bfb7a355391c10563934cc79e8bb167",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "8h2IO454Azg9cLFFiaQj1bEZ8np+FAUG+F7hZqLueM1Cu8k3lWakVBIB4h10CNEYk59TFsi02SfqUBXiUhr1DQ=="
+    "value": "bTat4AK64vTOtmTHrAf9w8z5d8GbFuxJZizc1YuZm05VpDaKzSaHkztZ5Hrb+sKu0lppYebpOGwYqTcFmfUMDQ=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.13",
+      "bom-ref": "pkg:cargo/planu-core@5.3.15",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.13",
+      "version": "5.3.15",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "63b4e21bd8fd8154d97f9f1a471fd7a731c6bc0514dec2ef9a2a5d9f1a98eb32"
+          "content": "0fbd8c0babdbfb88cae442db9cc57521f67ee345aa1872ed0cd04f464f992584"
         }
       ]
     }
@@ -70,9 +70,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/bstr@1.13.0",
+      "bom-ref": "pkg:cargo/bstr@1.13.1",
       "name": "bstr",
-      "version": "1.13.0",
+      "version": "1.13.1",
       "externalReferences": [
         {
           "type": "distribution",
@@ -971,7 +971,7 @@
       ]
     },
     {
-      "ref": "pkg:cargo/bstr@1.13.0",
+      "ref": "pkg:cargo/bstr@1.13.1",
       "dependsOn": [
         "pkg:cargo/memchr@2.8.3",
         "pkg:cargo/serde_core@1.0.228"
@@ -1049,7 +1049,7 @@
       "ref": "pkg:cargo/globset@0.4.20",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
-        "pkg:cargo/bstr@1.13.0",
+        "pkg:cargo/bstr@1.13.1",
         "pkg:cargo/log@0.4.33",
         "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.13",
+      "ref": "pkg:cargo/planu-core@5.3.15",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.13",
-  "engineVersion": "5.3.13",
-  "buildId": "1-5.3.13-x86_64-apple-darwin",
+  "cliVersion": "5.3.15",
+  "engineVersion": "5.3.15",
+  "buildId": "1-5.3.15-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "6af7f8df49b56c0e440dbb5088a957943d0b1e8bd6d243392d00e224205dab63",
+  "artifactSha256": "f2b7904e0e93116b6042e9f67e33ca60f2f054a48ae9f365327209473010a38a",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "7fccd089cc1a35511497238f84f697bcee2d0c00534f6fefe3ddfbe770d3d617"
+    "sha256": "40bb12bea402c3d433ca284cbb80c122ffcacb68defa17409da65583f9fe0b73"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "4c29cf026dcfa833b89a328afa3546aecbc02d22",
+    "sourceCommit": "14948c630bfb7a355391c10563934cc79e8bb167",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "tnN9tivctc9090o+HeQTDhLowV/Z+Kp4mUQcxpxj7CKiLWrClaGzwlcEABXsF8YJcSLHSrxiUnB+397bAOaQDw=="
+    "value": "wDC/VmuwtNH7DIZHFeD9JAuHp08V8yDMSOgopr83IQIBnQkWBsqS9lQ2Zchxh7JNiTEfICvSQF7lMxA9Dk6UAQ=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.13",
+      "bom-ref": "pkg:cargo/planu-core@5.3.15",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.13",
+      "version": "5.3.15",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6af7f8df49b56c0e440dbb5088a957943d0b1e8bd6d243392d00e224205dab63"
+          "content": "f2b7904e0e93116b6042e9f67e33ca60f2f054a48ae9f365327209473010a38a"
         }
       ]
     }
@@ -70,9 +70,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/bstr@1.13.0",
+      "bom-ref": "pkg:cargo/bstr@1.13.1",
       "name": "bstr",
-      "version": "1.13.0",
+      "version": "1.13.1",
       "externalReferences": [
         {
           "type": "distribution",
@@ -971,7 +971,7 @@
       ]
     },
     {
-      "ref": "pkg:cargo/bstr@1.13.0",
+      "ref": "pkg:cargo/bstr@1.13.1",
       "dependsOn": [
         "pkg:cargo/memchr@2.8.3",
         "pkg:cargo/serde_core@1.0.228"
@@ -1049,7 +1049,7 @@
       "ref": "pkg:cargo/globset@0.4.20",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
-        "pkg:cargo/bstr@1.13.0",
+        "pkg:cargo/bstr@1.13.1",
         "pkg:cargo/log@0.4.33",
         "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.13",
+      "ref": "pkg:cargo/planu-core@5.3.15",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.13",
-  "engineVersion": "5.3.13",
-  "buildId": "1-5.3.13-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.15",
+  "engineVersion": "5.3.15",
+  "buildId": "1-5.3.15-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "6dc15d18af613ad34ab23bc8d36387596c6d4e56a32130500d87581637afc5c6",
+  "artifactSha256": "01ea24db6f97e97faeef630279a6ee999acb4a7562771459a2423a7598304253",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "5284d0de91c78b38db90e45d503bdfc1663bdd347d02afa2d4ee077973a558c5"
+    "sha256": "02f9bcacd4b15056f3b945e103ed330d231fc9ac0f1a377dd1ec326e60b2b1dc"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "4c29cf026dcfa833b89a328afa3546aecbc02d22",
+    "sourceCommit": "14948c630bfb7a355391c10563934cc79e8bb167",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "QBwJ3Bv0Cu43hS/zvTdSyOE9ua2CpkENsXB8xP6XmxGGXvGiJSQkkK2Un6PQ/7EZKt88wuJd95a6bZKfCSzdDw=="
+    "value": "LwJ+lJNVWcGsacrsWvGRbBS6WQTC7iMOAg3yfb0AZtdsHLBvAyG1700kh/1E1CbKEUR73CbUmU2TzEzVkesUAw=="
   }
 }