@smartergpt/lexrunner 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -6,6 +6,36 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 ## [Unreleased]
 
+## [1.4.0] - 2026-08-04
+
+### Added
+
+- **Native-host workspace boundary** - Add the versioned `WorkspaceBoundary` contract, production
+  Linux backend, runtime resolver, lease-bound authority lineage, and shared hostile-race
+  conformance coverage that preserves the existing Linux containment guarantee while defining the
+  fail-closed path to a native Windows backend.
+
+### Changed
+
+- **Lex 4 compatibility** - Upgrade `@smartergpt/lex` to the audited 4.x line while preserving all
+  directly consumed public exports.
+- **Deterministic install scripts** - Check in explicit npm allow/deny decisions for native SQLite,
+  esbuild, and Lex lifecycle scripts.
+
+### Fixed
+
+- **Native Windows bootstrap** - Validate clean installation, dependency policy, build, and focused
+  portable regressions in Windows CI without claiming runtime parity through skipped tests.
+- **Cross-platform patch application** - Apply unified diffs through argument-safe `git apply`
+  instead of requiring a separately installed GNU `patch` executable.
+- **Boundary integrity** - Canonicalize receipt identity sets, preserve path-private diagnostics,
+  bind observations to live leases, and route Linux Git operations through boundary capabilities.
+- **Plan validation stability** - Bound CLI validation subprocesses and retain actionable timeout
+  diagnostics under hosted-runner load.
+- **Dependency audit** - Remove all currently reported production and development advisories,
+  including the Sharp/libvips path and newly disclosed URI, address, middleware, PostCSS, and brace
+  expansion findings.
+
 ## [1.3.0] - 2026-07-30
 
 ### Added

package/README.md

@@ -111,11 +111,12 @@ The checked-in package version is the single source for `lex-pr --version`.
 
 <!-- BEGIN GENERATED PACKAGE VERSION -->
 
-Current repository package version: **1.3.0**. npm availability and dist-tags are separate
+Current repository package version: **1.4.0**. npm availability and dist-tags are separate
 release evidence; inspect the registry rather than inferring publication from source metadata.
 <!-- END GENERATED PACKAGE VERSION -->
 
-See the [1.3.0 release notes](docs/releases/1.3.0.md), the
+See the [1.4.0 release notes](docs/releases/1.4.0.md), the
+[1.3.0 dogfood release](docs/releases/1.3.0.md), the
 [1.2.1 publication repair](docs/releases/1.2.1.md), and the underlying
 [1.2.0 compatibility decision](docs/releases/1.2.0.md) for package disposition, semver rationale,
 supported assisted behavior, and deferred guarantees.