@planu/cli 5.3.14 → 5.3.15

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [5.3.15] - 2026-08-11
+
+### Bug Fixes
+- fix(spec-1403): apply implementation-review arbitration fixes
+- fix(spec-1403): make destructive housekeeping report-only under typed authority
+
+### Chores
+- chore(spec-1403): record done transition with arbitration evidence
+
+
 ## [5.3.14] - 2026-08-10
 
 ### Bug Fixes

package/dist/engine/cascade-hooks/hooks/housekeeping-on-done.hook.js

@@ -9,8 +9,7 @@ async function handler(ctx) {
     try {
         // Dynamic import keeps module graph lean — housekeeping-sweep is only needed on 'done'.
         const { runHousekeepingSweep } = await import('../../housekeeping/index.js');
-        // Housekeeping also auto-triggers via SPEC-790 in github-release-handler.ts
-        void runHousekeepingSweep({ projectPath, dryRun: false });
+        void runHousekeepingSweep({ projectPath });
     }
     catch (err) {
         const error = err instanceof Error ? err.message : String(err);
@@ -29,7 +28,7 @@ export const housekeepingOnDoneHook = {
     id: 'housekeeping-on-done',
     triggers: ['done'],
     requiresProjectPath: true,
-    label: 'Auto-run housekeeping_sweep on spec done — delete orphan stashes/branches (SPEC-782)',
+    label: 'Auto-run report-only housekeeping_sweep on spec done (SPEC-782)',
     handler,
 };
 //# sourceMappingURL=housekeeping-on-done.hook.js.map

package/dist/engine/housekeeping/find-stale-branches.d.ts

@@ -27,9 +27,9 @@ export declare function extractSpecIdFromCommit(projectPath: string, sha: string
  */
 export declare function lookupSpecStatus(projectPath: string, specId: string): Promise<string | null>;
 /**
- * Pass 2: for each branch in `skipped` with reason 'not_merged', check if its
- * SPEC ID (from name or tip commit message) is `done` or `discarded` in Planu.
- * Matching branches are moved from `skipped` to `stale` with reason 'spec-done'.
+ * Pass 2: a `not_merged` branch whose spec is done/discarded becomes `stale`
+ * only when `git merge-base --is-ancestor` proves every commit is reachable
+ * from main, develop, or master. Spec status alone never promotes a branch.
  * Mutates both arrays in-place.
  */
 export declare function applySpecDonePass(projectPath: string, skipped: SkippedBranchInfo[], stale: StaleBranchInfo[], branchShas: Map<string, string>): Promise<void>;

package/dist/engine/housekeeping/find-stale-branches.js

@@ -148,8 +148,6 @@ export async function extractSpecIdFromCommit(projectPath, sha) {
         return null;
     }
 }
-/** Terminal statuses that mean the branch work is complete. */
-const DONE_STATUSES = new Set(['done', 'discarded']);
 /**
  * Look up the status of a spec by reading 'planu/specs/<specId>-star/spec.md' frontmatter.
  * Returns the raw status string, or null when not found.
@@ -176,43 +174,41 @@ export async function lookupSpecStatus(projectPath, specId) {
         return null;
     }
 }
+async function isProvenIntegrated(projectPath, branch) {
+    for (const base of ['main', 'develop', 'master']) {
+        try {
+            await execFile('git', ['merge-base', '--is-ancestor', branch, base], { cwd: projectPath });
+            return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
 /**
- * Pass 2: for each branch in `skipped` with reason 'not_merged', check if its
- * SPEC ID (from name or tip commit message) is `done` or `discarded` in Planu.
- * Matching branches are moved from `skipped` to `stale` with reason 'spec-done'.
+ * Pass 2: a `not_merged` branch whose spec is done/discarded becomes `stale`
+ * only when `git merge-base --is-ancestor` proves every commit is reachable
+ * from main, develop, or master. Spec status alone never promotes a branch.
  * Mutates both arrays in-place.
  */
 export async function applySpecDonePass(projectPath, skipped, stale, branchShas) {
-    // Fast-path: no not_merged branches → nothing for Pass 2 to do.
-    const notMerged = skipped.filter((b) => b.skipReason === 'not_merged');
-    if (notMerged.length === 0) {
-        return;
-    }
-    const toRemove = new Set();
-    for (const branch of notMerged) {
-        // Try branch name first (zero git calls)
-        let specId = extractSpecIdFromName(branch.name);
-        // Fall back to commit message if name has no spec id (one git call per branch)
-        if (!specId) {
-            const sha = branchShas.get(branch.name) ?? '';
-            specId = await extractSpecIdFromCommit(projectPath, sha);
-        }
+    const candidates = skipped.filter((entry) => entry.skipReason === 'not_merged');
+    for (const candidate of candidates) {
+        const sha = branchShas.get(candidate.name) ?? '';
+        const specId = extractSpecIdFromName(candidate.name) ?? (await extractSpecIdFromCommit(projectPath, sha));
         if (!specId) {
             continue;
         }
         const status = await lookupSpecStatus(projectPath, specId);
-        if (status !== null && DONE_STATUSES.has(status)) {
-            const sha = branchShas.get(branch.name) ?? '';
-            stale.push({ name: branch.name, sha, reason: 'spec-done' });
-            toRemove.add(branch.name);
+        if (status !== 'done' && status !== 'discarded') {
+            continue;
         }
-    }
-    // Remove promoted branches from skipped
-    for (let i = skipped.length - 1; i >= 0; i--) {
-        const entry = skipped[i];
-        if (entry && toRemove.has(entry.name)) {
-            skipped.splice(i, 1);
+        if (!(await isProvenIntegrated(projectPath, candidate.name))) {
+            continue;
         }
+        skipped.splice(skipped.indexOf(candidate), 1);
+        stale.push({ name: candidate.name, sha, reason: 'spec-done' });
     }
 }
 export async function findStaleBranches(input) {

package/dist/engine/housekeeping/sweep-runner.js

@@ -19,9 +19,43 @@ async function deleteBranch(projectPath, branchName) {
         return false;
     }
 }
+async function remoteBranchRefExists(projectPath, branchName) {
+    try {
+        const { stdout } = await execFile('git', ['ls-remote', '--heads', 'origin', branchName], {
+            cwd: projectPath,
+        });
+        return stdout.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function isRemoteBranchProvenMerged(projectPath, branchName) {
+    for (const base of ['main', 'develop', 'master']) {
+        try {
+            await execFile('git', ['merge-base', '--is-ancestor', `origin/${branchName}`, base], {
+                cwd: projectPath,
+            });
+            return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
+async function deleteRemoteBranch(projectPath, branchName) {
+    try {
+        await execFile('git', ['push', 'origin', '--delete', branchName], { cwd: projectPath });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 async function removeWorktree(projectPath, worktreePath) {
     try {
-        await execFile('git', ['worktree', 'remove', '--force', worktreePath], { cwd: projectPath });
+        await execFile('git', ['worktree', 'remove', worktreePath], { cwd: projectPath });
         return true;
     }
     catch {
@@ -41,7 +75,6 @@ async function dropStash(projectPath, stashRef) {
 // Backup helpers
 // ---------------------------------------------------------------------------
 async function backupAndDeleteBranch(projectPath, branch) {
-    // Write to history BEFORE deleting (for recovery)
     try {
         await appendHousekeepingEntry(projectPath, {
             projectPath,
@@ -50,10 +83,30 @@ async function backupAndDeleteBranch(projectPath, branch) {
             sha: branch.sha,
         });
     }
-    catch {
-        // Log failure is non-fatal — continue with deletion
+    catch (error) {
+        return {
+            ok: false,
+            error: `branch ${branch.name}: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return deleteBranch(projectPath, branch.name);
+    return { ok: await deleteBranch(projectPath, branch.name) };
+}
+async function backupAndDeleteRemoteBranch(projectPath, branch) {
+    try {
+        await appendHousekeepingEntry(projectPath, {
+            projectPath,
+            kind: 'branch',
+            ref: `origin/${branch.name}`,
+            sha: branch.sha,
+        });
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: `remote branch origin/${branch.name}: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    return { ok: await deleteRemoteBranch(projectPath, branch.name) };
 }
 async function backupAndRemoveWorktree(projectPath, wt) {
     try {
@@ -64,10 +117,13 @@ async function backupAndRemoveWorktree(projectPath, wt) {
             sha: wt.branch ?? '',
         });
     }
-    catch {
-        // non-fatal
+    catch (error) {
+        return {
+            ok: false,
+            error: `worktree ${wt.path}: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return removeWorktree(projectPath, wt.path);
+    return { ok: await removeWorktree(projectPath, wt.path) };
 }
 async function backupAndDropStash(projectPath, stash) {
     try {
@@ -78,16 +134,19 @@ async function backupAndDropStash(projectPath, stash) {
             sha: String(stash.createdAt),
         });
     }
-    catch {
-        // non-fatal
+    catch (error) {
+        return {
+            ok: false,
+            error: `stash ${stash.ref}: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return dropStash(projectPath, stash.ref);
+    return { ok: await dropStash(projectPath, stash.ref) };
 }
 // ---------------------------------------------------------------------------
 // Main orchestrator
 // ---------------------------------------------------------------------------
 export async function runHousekeepingSweep(input) {
-    const { projectPath, dryRun = true, aggressive = false, includeStashes = false } = input;
+    const { projectPath, authority = { mode: 'report' }, aggressive = false, includeStashes = false, } = input;
     const sweepAt = new Date().toISOString();
     // Find stale items in parallel
     const [{ stale: staleBranches, skipped }, staleWorktrees, staleStashes] = await Promise.all([
@@ -96,6 +155,7 @@ export async function runHousekeepingSweep(input) {
         includeStashes ? findStaleStashes({ projectPath }) : Promise.resolve([]),
     ]);
     const report = {
+        mode: authority.mode,
         sweepAt,
         projectPath,
         wouldDelete: {
@@ -108,34 +168,60 @@ export async function runHousekeepingSweep(input) {
         },
         executed: false,
         deleted: { branches: 0, worktrees: 0, stashes: 0, backups: 0 },
+        errors: [],
     };
-    if (dryRun) {
+    if (authority.mode === 'report') {
         return report;
     }
     // Execute deletions
     report.executed = true;
     // Delete branches (sequential — each needs a backup entry first)
     for (const branch of staleBranches) {
-        const ok = await backupAndDeleteBranch(projectPath, branch);
-        if (ok) {
+        const result = await backupAndDeleteBranch(projectPath, branch);
+        if (result.ok) {
             report.deleted.branches++;
         }
+        else if (result.error) {
+            report.errors.push(result.error);
+        }
+        if (!authority.deleteRemoteRefs) {
+            continue;
+        }
+        if (!(await remoteBranchRefExists(projectPath, branch.name))) {
+            continue;
+        }
+        if (!(await isRemoteBranchProvenMerged(projectPath, branch.name))) {
+            continue;
+        }
+        const remoteResult = await backupAndDeleteRemoteBranch(projectPath, branch);
+        if (remoteResult.ok) {
+            report.deleted.branches++;
+        }
+        else if (remoteResult.error) {
+            report.errors.push(remoteResult.error);
+        }
     }
     // Remove worktrees (sequential)
     for (const wt of staleWorktrees) {
-        const ok = await backupAndRemoveWorktree(projectPath, wt);
-        if (ok) {
+        const result = await backupAndRemoveWorktree(projectPath, wt);
+        if (result.ok) {
             report.deleted.worktrees++;
         }
+        else if (result.error) {
+            report.errors.push(result.error);
+        }
     }
     // Drop stashes (sequential — must handle index shifting)
     // Drop in reverse order so indices stay valid
     const reversedStashes = [...staleStashes].reverse();
     for (const stash of reversedStashes) {
-        const ok = await backupAndDropStash(projectPath, stash);
-        if (ok) {
+        const result = await backupAndDropStash(projectPath, stash);
+        if (result.ok) {
             report.deleted.stashes++;
         }
+        else if (result.error) {
+            report.errors.push(result.error);
+        }
     }
     // SPEC-771: clean stale .bak.* backup files from planu/specs/ (best-effort)
     report.deleted.backups = await cleanStaleBackups(projectPath);

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.14",
-  "engineVersion": "5.3.14",
-  "buildId": "1-5.3.14-aarch64-apple-darwin",
+  "cliVersion": "5.3.15",
+  "engineVersion": "5.3.15",
+  "buildId": "1-5.3.15-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "4c174c7bc2bf7e440d3295feb2d8039ae905dc1c588007ae50bb74b0c6b7fd26",
+  "artifactSha256": "0fbd8c0babdbfb88cae442db9cc57521f67ee345aa1872ed0cd04f464f992584",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "e00b7cad12d3665a3ffa98b91f795bd81d23128775a5574b801bf70c8adc7afb"
+    "sha256": "41999cac08a7c64a9c899eac628df8e4bc10d70dc1b1923d5951a89f5ac8e878"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "a847a7442e7735a9f4f2a9878eccbd52fc54509b",
+    "sourceCommit": "14948c630bfb7a355391c10563934cc79e8bb167",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "rOWsQsW8oC6kfbEGi+9Ez3Z3MUyXiyyBakI+adPC6o5DECM+mdC++CQ04n0lMuTidLK+PGXq1ZjkkRA45iKfDg=="
+    "value": "bTat4AK64vTOtmTHrAf9w8z5d8GbFuxJZizc1YuZm05VpDaKzSaHkztZ5Hrb+sKu0lppYebpOGwYqTcFmfUMDQ=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.14",
+      "bom-ref": "pkg:cargo/planu-core@5.3.15",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.14",
+      "version": "5.3.15",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4c174c7bc2bf7e440d3295feb2d8039ae905dc1c588007ae50bb74b0c6b7fd26"
+          "content": "0fbd8c0babdbfb88cae442db9cc57521f67ee345aa1872ed0cd04f464f992584"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.14",
+      "ref": "pkg:cargo/planu-core@5.3.15",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.14",
-  "engineVersion": "5.3.14",
-  "buildId": "1-5.3.14-x86_64-apple-darwin",
+  "cliVersion": "5.3.15",
+  "engineVersion": "5.3.15",
+  "buildId": "1-5.3.15-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "585436bd096f716d38077ee00628f80f10b2b7a53eebc064c71a348c691a120c",
+  "artifactSha256": "f2b7904e0e93116b6042e9f67e33ca60f2f054a48ae9f365327209473010a38a",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "fdd221a66ce155cf8571f478400c90e78b0fd644f4872d75688fb406c1d3ea7e"
+    "sha256": "40bb12bea402c3d433ca284cbb80c122ffcacb68defa17409da65583f9fe0b73"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "a847a7442e7735a9f4f2a9878eccbd52fc54509b",
+    "sourceCommit": "14948c630bfb7a355391c10563934cc79e8bb167",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "Fily8bX8ubTUGRXVQypr+6847eqkD+bGCPQQNXTMhaG+vj3IK3SNrPGfR7uRNT74D0K1inVGIV3umQbQ6IMvCw=="
+    "value": "wDC/VmuwtNH7DIZHFeD9JAuHp08V8yDMSOgopr83IQIBnQkWBsqS9lQ2Zchxh7JNiTEfICvSQF7lMxA9Dk6UAQ=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.14",
+      "bom-ref": "pkg:cargo/planu-core@5.3.15",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.14",
+      "version": "5.3.15",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "585436bd096f716d38077ee00628f80f10b2b7a53eebc064c71a348c691a120c"
+          "content": "f2b7904e0e93116b6042e9f67e33ca60f2f054a48ae9f365327209473010a38a"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.14",
+      "ref": "pkg:cargo/planu-core@5.3.15",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.14",
-  "engineVersion": "5.3.14",
-  "buildId": "1-5.3.14-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.15",
+  "engineVersion": "5.3.15",
+  "buildId": "1-5.3.15-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "a8a29c8478e18fa30f1db2c123fa8a9f3df6021ee41371415b0b58c058102477",
+  "artifactSha256": "01ea24db6f97e97faeef630279a6ee999acb4a7562771459a2423a7598304253",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "d11c991b3337d7a437cc66106a2f8d3b4b119f6b088c3509e7b8c754f4eddd0f"
+    "sha256": "02f9bcacd4b15056f3b945e103ed330d231fc9ac0f1a377dd1ec326e60b2b1dc"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "a847a7442e7735a9f4f2a9878eccbd52fc54509b",
+    "sourceCommit": "14948c630bfb7a355391c10563934cc79e8bb167",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "N0GemRSWE3adFqXfPJQ8W/oU9aAgejnHCza7s3SBXjU8sFS/ntUtZ3q8MGFP+lN/QDqHnhHIyM/XSqM7KzejDw=="
+    "value": "LwJ+lJNVWcGsacrsWvGRbBS6WQTC7iMOAg3yfb0AZtdsHLBvAyG1700kh/1E1CbKEUR73CbUmU2TzEzVkesUAw=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.14",
+      "bom-ref": "pkg:cargo/planu-core@5.3.15",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.14",
+      "version": "5.3.15",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a8a29c8478e18fa30f1db2c123fa8a9f3df6021ee41371415b0b58c058102477"
+          "content": "01ea24db6f97e97faeef630279a6ee999acb4a7562771459a2423a7598304253"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.14",
+      "ref": "pkg:cargo/planu-core@5.3.15",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.14",
-  "engineVersion": "5.3.14",
-  "buildId": "1-5.3.14-aarch64-unknown-linux-musl",
+  "cliVersion": "5.3.15",
+  "engineVersion": "5.3.15",
+  "buildId": "1-5.3.15-aarch64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "musl",
-  "artifactSha256": "bd0f6ff601ab21a2052364567465ba319d847a5b67f061bb5107360a88c03971",
+  "artifactSha256": "77906aaa7ef35468fae4f48928d7fe427f6b42134f6ba27b7b10852a904a9063",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-musl.node.sbom.json",
-    "sha256": "8fbe609d1e94a3650544e02908b35b6ebdf93eac6dcd1ddf7983add76da5b57e"
+    "sha256": "03b4827b05fb040843d38ede98208022adce12d8c584a6f4a909eab71d18b439"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "a847a7442e7735a9f4f2a9878eccbd52fc54509b",
+    "sourceCommit": "14948c630bfb7a355391c10563934cc79e8bb167",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "dUqTPahkHmCiAEmSaMEnq3zUKFiVBV+ZuMZTP4c8AryvORF2OoCGUglSVf+Ol9Ww8H4CIyByxkftL01Awk8rAw=="
+    "value": "cK02P++x9IPGghpCbgzJx1roAidXZtDiELr8LDUtD6JfRGvOf6l3VwX+Lvd+cSz/dLK1cosRIjoeZFovhbTnDg=="
   }
 }

package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.14",
+      "bom-ref": "pkg:cargo/planu-core@5.3.15",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.14",
+      "version": "5.3.15",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bd0f6ff601ab21a2052364567465ba319d847a5b67f061bb5107360a88c03971"
+          "content": "77906aaa7ef35468fae4f48928d7fe427f6b42134f6ba27b7b10852a904a9063"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.14",
+      "ref": "pkg:cargo/planu-core@5.3.15",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.14",
-  "engineVersion": "5.3.14",
-  "buildId": "1-5.3.14-x86_64-unknown-linux-gnu",
+  "cliVersion": "5.3.15",
+  "engineVersion": "5.3.15",
+  "buildId": "1-5.3.15-x86_64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "glibc",
-  "artifactSha256": "ab11f8980f5b174b9c2d5b6806daa3d356a12e841b2eaf668c106a3c45cd816e",
+  "artifactSha256": "ef2493926703d865ea8673d8357a238058a32a64325050d3880518d8884f25f2",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-gnu.node.sbom.json",
-    "sha256": "24889fae3a9cff6f55b7cd1d60b6ea1ccb7fa9a8e53f3e2609e1aab97d6fa88b"
+    "sha256": "c9934e8615cac53687cc3de64ba400212a12aa8653cb320f9435c131fde66026"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "a847a7442e7735a9f4f2a9878eccbd52fc54509b",
+    "sourceCommit": "14948c630bfb7a355391c10563934cc79e8bb167",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "Scj9Wqin6lntJ7TVv9I4nGUPwfYEIkvDW957suo9QXU3oLZIdwo+gWy+8r0jfMvNzqkbJrXuaUseiGzMnV31Aw=="
+    "value": "AfBRj+G23Cdv1PqCjbZHpYdDXB5LW1JcgIbwcMstlFPhrv8ln9HTsyVOCE1PVl1ZeKMGP2YsTqgQj+XJb7tfBw=="
   }
 }