@planu/cli 5.3.14 → 5.3.16

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## [5.3.16] - 2026-08-11
+
+### Bug Fixes
+- fix(spec-1477): bound publication-window wait per implementation-review arbitration
+- fix(spec-1477): publication window blocks same-identity lease supersession mid-receipt
+
+### Chores
+- chore(specs): record SPEC-1477 done transition and file SPEC-1487 dogfood bug
+
+
+## [5.3.15] - 2026-08-11
+
+### Bug Fixes
+- fix(spec-1403): apply implementation-review arbitration fixes
+- fix(spec-1403): make destructive housekeeping report-only under typed authority
+
+### Chores
+- chore(spec-1403): record done transition with arbitration evidence
+
+
 ## [5.3.14] - 2026-08-10
 
 ### Bug Fixes

package/dist/engine/cascade-hooks/hooks/housekeeping-on-done.hook.js

@@ -9,8 +9,7 @@ async function handler(ctx) {
     try {
         // Dynamic import keeps module graph lean — housekeeping-sweep is only needed on 'done'.
         const { runHousekeepingSweep } = await import('../../housekeeping/index.js');
-        // Housekeeping also auto-triggers via SPEC-790 in github-release-handler.ts
-        void runHousekeepingSweep({ projectPath, dryRun: false });
+        void runHousekeepingSweep({ projectPath });
     }
     catch (err) {
         const error = err instanceof Error ? err.message : String(err);
@@ -29,7 +28,7 @@ export const housekeepingOnDoneHook = {
     id: 'housekeeping-on-done',
     triggers: ['done'],
     requiresProjectPath: true,
-    label: 'Auto-run housekeeping_sweep on spec done — delete orphan stashes/branches (SPEC-782)',
+    label: 'Auto-run report-only housekeeping_sweep on spec done (SPEC-782)',
     handler,
 };
 //# sourceMappingURL=housekeeping-on-done.hook.js.map

package/dist/engine/execution/validate-job-executor.js

@@ -11,7 +11,7 @@ import { resolveStorageLayout } from '../../storage/storage-layout.js';
 import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 import { createValidationReceiptAuthority, ensureValidationIssuerKey, issueValidationReceipt, LOCAL_VALIDATION_RECEIPT_ISSUER, preflightValidationReceiptSigner, } from '../validation/validation-receipt.js';
 import { appendArtifact, readArtifact } from '../handoff-artifacts/io.js';
-import { assertValidationFreshnessBarrier, beginValidationFreshnessBarrier, bindValidationFreshnessLease, closeValidationFreshnessLease, rebaselineValidationFreshnessLeaseAfterRecompute, } from '../validation/validation-freshness.js';
+import { assertValidationFreshnessBarrier, beginValidationFreshnessBarrier, beginValidationFreshnessPublicationWindow, bindValidationFreshnessLease, closeValidationFreshnessLease, rebaselineValidationFreshnessLeaseAfterRecompute, } from '../validation/validation-freshness.js';
 import { recoverValidateJobs } from './validate-job-recovery.js';
 import { getRuntimePolicy } from '../runtime-policy.js';
 import { isValidateJob, parseValidatePayload, rehydrateValidationPayload, } from './validate-job-payload.js';
@@ -664,62 +664,69 @@ export class ValidateJobExecutor {
                 policy.receiptCheckpointResultMaxBytes,
         };
     }
+    // eslint-disable-next-line max-lines-per-function -- publication window and the double freshness assert share one auditable receipt-issuance boundary
     async issueReceipt(identity, payload, checkpoint, publicationLease, fencingToken, signal) {
         const receiptBindings = checkpoint.receiptInput.bindings;
-        if (executionAborted(signal)) {
-            signal.throwIfAborted();
-        }
-        if (!(await assertValidationFreshnessBarrier(publicationLease, receiptBindings))) {
-            throw new Error('[Planu] Validation inputs changed before receipt publication');
-        }
-        const database = new RuntimeDatabase({ path: resolveStorageLayout().runtimeDatabase });
+        const endPublicationWindow = beginValidationFreshnessPublicationWindow(publicationLease);
         try {
-            const signingKeyReference = await ensureValidationIssuerKey({
-                projectId: identity.projectId,
-                issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
-            });
-            signal.throwIfAborted();
-            const { store } = createValidationReceiptAuthority({
-                database,
-                workspaceId: identity.workspaceId,
-                projectId: identity.projectId,
-                issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
-                authorizePersistence: (persistenceDatabase) => {
-                    persistenceDatabase.assertActiveJobLease({
-                        id: identity.operationId,
-                        projectId: identity.projectId,
-                        workspaceId: identity.workspaceId,
-                        workerId: this.workerId,
-                        fencingToken,
-                        leaseMs: this.workerTimingPolicy().workerLeaseMs,
-                        now: new Date().toISOString(),
-                    });
-                },
-            });
-            const receipt = await issueValidationReceipt(checkpoint.receiptInput, {
-                issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
-                signingKeyReference,
-                store,
-            });
             if (executionAborted(signal)) {
                 signal.throwIfAborted();
             }
             if (!(await assertValidationFreshnessBarrier(publicationLease, receiptBindings))) {
-                await store.invalidateCurrentBindings(identity.projectId, payload.bindings.specId);
-                throw new Error('[Planu] Validation inputs changed during receipt publication');
+                throw new Error('[Planu] Validation inputs changed before receipt publication');
             }
-            const receiptKey = `validation-receipt:${receipt.receiptId.slice('sha256:'.length)}`;
-            let enrichedReportSha;
+            const database = new RuntimeDatabase({ path: resolveStorageLayout().runtimeDatabase });
             try {
-                enrichedReportSha = await this.persistReceiptArtifacts(identity, payload, receipt.receiptId, receiptKey);
+                const signingKeyReference = await ensureValidationIssuerKey({
+                    projectId: identity.projectId,
+                    issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
+                });
+                signal.throwIfAborted();
+                const { store } = createValidationReceiptAuthority({
+                    database,
+                    workspaceId: identity.workspaceId,
+                    projectId: identity.projectId,
+                    issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
+                    authorizePersistence: (persistenceDatabase) => {
+                        persistenceDatabase.assertActiveJobLease({
+                            id: identity.operationId,
+                            projectId: identity.projectId,
+                            workspaceId: identity.workspaceId,
+                            workerId: this.workerId,
+                            fencingToken,
+                            leaseMs: this.workerTimingPolicy().workerLeaseMs,
+                            now: new Date().toISOString(),
+                        });
+                    },
+                });
+                const receipt = await issueValidationReceipt(checkpoint.receiptInput, {
+                    issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
+                    signingKeyReference,
+                    store,
+                });
+                if (executionAborted(signal)) {
+                    signal.throwIfAborted();
+                }
+                if (!(await assertValidationFreshnessBarrier(publicationLease, receiptBindings))) {
+                    await store.invalidateCurrentBindings(identity.projectId, payload.bindings.specId);
+                    throw new Error('[Planu] Validation inputs changed during receipt publication');
+                }
+                const receiptKey = `validation-receipt:${receipt.receiptId.slice('sha256:'.length)}`;
+                let enrichedReportSha;
+                try {
+                    enrichedReportSha = await this.persistReceiptArtifacts(identity, payload, receipt.receiptId, receiptKey);
+                }
+                catch (error) {
+                    throw new ReceiptPublicationInterruptedError({ cause: error });
+                }
+                return buildReceiptResult(checkpoint.result, receipt.receiptId, receiptKey, enrichedReportSha);
             }
-            catch (error) {
-                throw new ReceiptPublicationInterruptedError({ cause: error });
+            finally {
+                database.close();
             }
-            return buildReceiptResult(checkpoint.result, receipt.receiptId, receiptKey, enrichedReportSha);
         }
         finally {
-            database.close();
+            endPublicationWindow();
         }
     }
     async preparePublicationLease(payload, expectedBindings) {

package/dist/engine/housekeeping/find-stale-branches.d.ts

@@ -27,9 +27,9 @@ export declare function extractSpecIdFromCommit(projectPath: string, sha: string
  */
 export declare function lookupSpecStatus(projectPath: string, specId: string): Promise<string | null>;
 /**
- * Pass 2: for each branch in `skipped` with reason 'not_merged', check if its
- * SPEC ID (from name or tip commit message) is `done` or `discarded` in Planu.
- * Matching branches are moved from `skipped` to `stale` with reason 'spec-done'.
+ * Pass 2: a `not_merged` branch whose spec is done/discarded becomes `stale`
+ * only when `git merge-base --is-ancestor` proves every commit is reachable
+ * from main, develop, or master. Spec status alone never promotes a branch.
  * Mutates both arrays in-place.
  */
 export declare function applySpecDonePass(projectPath: string, skipped: SkippedBranchInfo[], stale: StaleBranchInfo[], branchShas: Map<string, string>): Promise<void>;

package/dist/engine/housekeeping/find-stale-branches.js

@@ -148,8 +148,6 @@ export async function extractSpecIdFromCommit(projectPath, sha) {
         return null;
     }
 }
-/** Terminal statuses that mean the branch work is complete. */
-const DONE_STATUSES = new Set(['done', 'discarded']);
 /**
  * Look up the status of a spec by reading 'planu/specs/<specId>-star/spec.md' frontmatter.
  * Returns the raw status string, or null when not found.
@@ -176,43 +174,41 @@ export async function lookupSpecStatus(projectPath, specId) {
         return null;
     }
 }
+async function isProvenIntegrated(projectPath, branch) {
+    for (const base of ['main', 'develop', 'master']) {
+        try {
+            await execFile('git', ['merge-base', '--is-ancestor', branch, base], { cwd: projectPath });
+            return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
 /**
- * Pass 2: for each branch in `skipped` with reason 'not_merged', check if its
- * SPEC ID (from name or tip commit message) is `done` or `discarded` in Planu.
- * Matching branches are moved from `skipped` to `stale` with reason 'spec-done'.
+ * Pass 2: a `not_merged` branch whose spec is done/discarded becomes `stale`
+ * only when `git merge-base --is-ancestor` proves every commit is reachable
+ * from main, develop, or master. Spec status alone never promotes a branch.
  * Mutates both arrays in-place.
  */
 export async function applySpecDonePass(projectPath, skipped, stale, branchShas) {
-    // Fast-path: no not_merged branches → nothing for Pass 2 to do.
-    const notMerged = skipped.filter((b) => b.skipReason === 'not_merged');
-    if (notMerged.length === 0) {
-        return;
-    }
-    const toRemove = new Set();
-    for (const branch of notMerged) {
-        // Try branch name first (zero git calls)
-        let specId = extractSpecIdFromName(branch.name);
-        // Fall back to commit message if name has no spec id (one git call per branch)
-        if (!specId) {
-            const sha = branchShas.get(branch.name) ?? '';
-            specId = await extractSpecIdFromCommit(projectPath, sha);
-        }
+    const candidates = skipped.filter((entry) => entry.skipReason === 'not_merged');
+    for (const candidate of candidates) {
+        const sha = branchShas.get(candidate.name) ?? '';
+        const specId = extractSpecIdFromName(candidate.name) ?? (await extractSpecIdFromCommit(projectPath, sha));
         if (!specId) {
             continue;
         }
         const status = await lookupSpecStatus(projectPath, specId);
-        if (status !== null && DONE_STATUSES.has(status)) {
-            const sha = branchShas.get(branch.name) ?? '';
-            stale.push({ name: branch.name, sha, reason: 'spec-done' });
-            toRemove.add(branch.name);
+        if (status !== 'done' && status !== 'discarded') {
+            continue;
         }
-    }
-    // Remove promoted branches from skipped
-    for (let i = skipped.length - 1; i >= 0; i--) {
-        const entry = skipped[i];
-        if (entry && toRemove.has(entry.name)) {
-            skipped.splice(i, 1);
+        if (!(await isProvenIntegrated(projectPath, candidate.name))) {
+            continue;
         }
+        skipped.splice(skipped.indexOf(candidate), 1);
+        stale.push({ name: candidate.name, sha, reason: 'spec-done' });
     }
 }
 export async function findStaleBranches(input) {

package/dist/engine/housekeeping/sweep-runner.js

@@ -19,9 +19,43 @@ async function deleteBranch(projectPath, branchName) {
         return false;
     }
 }
+async function remoteBranchRefExists(projectPath, branchName) {
+    try {
+        const { stdout } = await execFile('git', ['ls-remote', '--heads', 'origin', branchName], {
+            cwd: projectPath,
+        });
+        return stdout.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function isRemoteBranchProvenMerged(projectPath, branchName) {
+    for (const base of ['main', 'develop', 'master']) {
+        try {
+            await execFile('git', ['merge-base', '--is-ancestor', `origin/${branchName}`, base], {
+                cwd: projectPath,
+            });
+            return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
+async function deleteRemoteBranch(projectPath, branchName) {
+    try {
+        await execFile('git', ['push', 'origin', '--delete', branchName], { cwd: projectPath });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 async function removeWorktree(projectPath, worktreePath) {
     try {
-        await execFile('git', ['worktree', 'remove', '--force', worktreePath], { cwd: projectPath });
+        await execFile('git', ['worktree', 'remove', worktreePath], { cwd: projectPath });
         return true;
     }
     catch {
@@ -41,7 +75,6 @@ async function dropStash(projectPath, stashRef) {
 // Backup helpers
 // ---------------------------------------------------------------------------
 async function backupAndDeleteBranch(projectPath, branch) {
-    // Write to history BEFORE deleting (for recovery)
     try {
         await appendHousekeepingEntry(projectPath, {
             projectPath,
@@ -50,10 +83,30 @@ async function backupAndDeleteBranch(projectPath, branch) {
             sha: branch.sha,
         });
     }
-    catch {
-        // Log failure is non-fatal — continue with deletion
+    catch (error) {
+        return {
+            ok: false,
+            error: `branch ${branch.name}: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return deleteBranch(projectPath, branch.name);
+    return { ok: await deleteBranch(projectPath, branch.name) };
+}
+async function backupAndDeleteRemoteBranch(projectPath, branch) {
+    try {
+        await appendHousekeepingEntry(projectPath, {
+            projectPath,
+            kind: 'branch',
+            ref: `origin/${branch.name}`,
+            sha: branch.sha,
+        });
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: `remote branch origin/${branch.name}: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    return { ok: await deleteRemoteBranch(projectPath, branch.name) };
 }
 async function backupAndRemoveWorktree(projectPath, wt) {
     try {
@@ -64,10 +117,13 @@ async function backupAndRemoveWorktree(projectPath, wt) {
             sha: wt.branch ?? '',
         });
     }
-    catch {
-        // non-fatal
+    catch (error) {
+        return {
+            ok: false,
+            error: `worktree ${wt.path}: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return removeWorktree(projectPath, wt.path);
+    return { ok: await removeWorktree(projectPath, wt.path) };
 }
 async function backupAndDropStash(projectPath, stash) {
     try {
@@ -78,16 +134,19 @@ async function backupAndDropStash(projectPath, stash) {
             sha: String(stash.createdAt),
         });
     }
-    catch {
-        // non-fatal
+    catch (error) {
+        return {
+            ok: false,
+            error: `stash ${stash.ref}: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return dropStash(projectPath, stash.ref);
+    return { ok: await dropStash(projectPath, stash.ref) };
 }
 // ---------------------------------------------------------------------------
 // Main orchestrator
 // ---------------------------------------------------------------------------
 export async function runHousekeepingSweep(input) {
-    const { projectPath, dryRun = true, aggressive = false, includeStashes = false } = input;
+    const { projectPath, authority = { mode: 'report' }, aggressive = false, includeStashes = false, } = input;
     const sweepAt = new Date().toISOString();
     // Find stale items in parallel
     const [{ stale: staleBranches, skipped }, staleWorktrees, staleStashes] = await Promise.all([
@@ -96,6 +155,7 @@ export async function runHousekeepingSweep(input) {
         includeStashes ? findStaleStashes({ projectPath }) : Promise.resolve([]),
     ]);
     const report = {
+        mode: authority.mode,
         sweepAt,
         projectPath,
         wouldDelete: {
@@ -108,34 +168,60 @@ export async function runHousekeepingSweep(input) {
         },
         executed: false,
         deleted: { branches: 0, worktrees: 0, stashes: 0, backups: 0 },
+        errors: [],
     };
-    if (dryRun) {
+    if (authority.mode === 'report') {
         return report;
     }
     // Execute deletions
     report.executed = true;
     // Delete branches (sequential — each needs a backup entry first)
     for (const branch of staleBranches) {
-        const ok = await backupAndDeleteBranch(projectPath, branch);
-        if (ok) {
+        const result = await backupAndDeleteBranch(projectPath, branch);
+        if (result.ok) {
             report.deleted.branches++;
         }
+        else if (result.error) {
+            report.errors.push(result.error);
+        }
+        if (!authority.deleteRemoteRefs) {
+            continue;
+        }
+        if (!(await remoteBranchRefExists(projectPath, branch.name))) {
+            continue;
+        }
+        if (!(await isRemoteBranchProvenMerged(projectPath, branch.name))) {
+            continue;
+        }
+        const remoteResult = await backupAndDeleteRemoteBranch(projectPath, branch);
+        if (remoteResult.ok) {
+            report.deleted.branches++;
+        }
+        else if (remoteResult.error) {
+            report.errors.push(remoteResult.error);
+        }
     }
     // Remove worktrees (sequential)
     for (const wt of staleWorktrees) {
-        const ok = await backupAndRemoveWorktree(projectPath, wt);
-        if (ok) {
+        const result = await backupAndRemoveWorktree(projectPath, wt);
+        if (result.ok) {
             report.deleted.worktrees++;
         }
+        else if (result.error) {
+            report.errors.push(result.error);
+        }
     }
     // Drop stashes (sequential — must handle index shifting)
     // Drop in reverse order so indices stay valid
     const reversedStashes = [...staleStashes].reverse();
     for (const stash of reversedStashes) {
-        const ok = await backupAndDropStash(projectPath, stash);
-        if (ok) {
+        const result = await backupAndDropStash(projectPath, stash);
+        if (result.ok) {
             report.deleted.stashes++;
         }
+        else if (result.error) {
+            report.errors.push(result.error);
+        }
     }
     // SPEC-771: clean stale .bak.* backup files from planu/specs/ (best-effort)
     report.deleted.backups = await cleanStaleBackups(projectPath);

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.14",
-  "engineVersion": "5.3.14",
-  "buildId": "1-5.3.14-aarch64-apple-darwin",
+  "cliVersion": "5.3.16",
+  "engineVersion": "5.3.16",
+  "buildId": "1-5.3.16-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "4c174c7bc2bf7e440d3295feb2d8039ae905dc1c588007ae50bb74b0c6b7fd26",
+  "artifactSha256": "2a6db4c53e8d2e492a44dc8c276b3f1ec9e00f20056225221aa142752a9dfb4b",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "e00b7cad12d3665a3ffa98b91f795bd81d23128775a5574b801bf70c8adc7afb"
+    "sha256": "6bfb518a006ae80f0a94328c6fc0be1fa7d86b9a5bab2d7476a80fc8171dfd71"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "a847a7442e7735a9f4f2a9878eccbd52fc54509b",
+    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "rOWsQsW8oC6kfbEGi+9Ez3Z3MUyXiyyBakI+adPC6o5DECM+mdC++CQ04n0lMuTidLK+PGXq1ZjkkRA45iKfDg=="
+    "value": "6QDQPYqy6xJ4RHk+SGv1DdPTxgQDQCG63NMTaK2Kk72npIDR7g6h/mCKNLhFDXPALcS7kjqKRijf/PzRqnmCBQ=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.14",
+      "bom-ref": "pkg:cargo/planu-core@5.3.16",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.14",
+      "version": "5.3.16",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4c174c7bc2bf7e440d3295feb2d8039ae905dc1c588007ae50bb74b0c6b7fd26"
+          "content": "2a6db4c53e8d2e492a44dc8c276b3f1ec9e00f20056225221aa142752a9dfb4b"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.14",
+      "ref": "pkg:cargo/planu-core@5.3.16",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.14",
-  "engineVersion": "5.3.14",
-  "buildId": "1-5.3.14-x86_64-apple-darwin",
+  "cliVersion": "5.3.16",
+  "engineVersion": "5.3.16",
+  "buildId": "1-5.3.16-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "585436bd096f716d38077ee00628f80f10b2b7a53eebc064c71a348c691a120c",
+  "artifactSha256": "be5de1bbcd0f9b4989aa82c5b51f0a7425c3eb1fa9dfd772cc362f476db433f5",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "fdd221a66ce155cf8571f478400c90e78b0fd644f4872d75688fb406c1d3ea7e"
+    "sha256": "38a7cc4b3d77c4414c58fd23af446914e84db52dd937e13b763da35b1962ab1e"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "a847a7442e7735a9f4f2a9878eccbd52fc54509b",
+    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "Fily8bX8ubTUGRXVQypr+6847eqkD+bGCPQQNXTMhaG+vj3IK3SNrPGfR7uRNT74D0K1inVGIV3umQbQ6IMvCw=="
+    "value": "7X8ph1LL1pB4hXlWcXD109sTeHzyRTa94ozW52TdCg6y1LIH1kNwuz4rU0g0KK4CLpnanRpeLpu7NODRGiP2AQ=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.14",
+      "bom-ref": "pkg:cargo/planu-core@5.3.16",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.14",
+      "version": "5.3.16",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "585436bd096f716d38077ee00628f80f10b2b7a53eebc064c71a348c691a120c"
+          "content": "be5de1bbcd0f9b4989aa82c5b51f0a7425c3eb1fa9dfd772cc362f476db433f5"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.14",
+      "ref": "pkg:cargo/planu-core@5.3.16",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.14",
-  "engineVersion": "5.3.14",
-  "buildId": "1-5.3.14-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.16",
+  "engineVersion": "5.3.16",
+  "buildId": "1-5.3.16-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "a8a29c8478e18fa30f1db2c123fa8a9f3df6021ee41371415b0b58c058102477",
+  "artifactSha256": "01d8ce2cb696744dc58095e8ff7fb2be6afcbccf467b0cd0eb538b6be530e210",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "d11c991b3337d7a437cc66106a2f8d3b4b119f6b088c3509e7b8c754f4eddd0f"
+    "sha256": "5eb69bed870789d764c02f63f0371c51872314e22a888c60af9842c35f536a4b"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "a847a7442e7735a9f4f2a9878eccbd52fc54509b",
+    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "N0GemRSWE3adFqXfPJQ8W/oU9aAgejnHCza7s3SBXjU8sFS/ntUtZ3q8MGFP+lN/QDqHnhHIyM/XSqM7KzejDw=="
+    "value": "EJcdFkXbSIapzhu002fZ/X4QRUCpbJjwj4AYsg0G2BiERBQjMavAeiXqVNLr75Jt84NRmcOqXhidCvaEV0snCQ=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.14",
+      "bom-ref": "pkg:cargo/planu-core@5.3.16",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.14",
+      "version": "5.3.16",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a8a29c8478e18fa30f1db2c123fa8a9f3df6021ee41371415b0b58c058102477"
+          "content": "01d8ce2cb696744dc58095e8ff7fb2be6afcbccf467b0cd0eb538b6be530e210"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.14",
+      "ref": "pkg:cargo/planu-core@5.3.16",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",