@smartergpt/lexrunner 1.4.0 → 1.5.1

package/CHANGELOG.md

@@ -6,6 +6,122 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 ## [Unreleased]
 
+## [1.5.1] - 2026-08-23
+
+### Fixed
+
+- **Credential-free release ancestry verification** - Verify that the signed release commit is
+  contained in `main` through the authenticated GitHub compare API after checkout credentials are
+  deliberately discarded. This recovery release carries forward the complete 1.5.0 feature set;
+  the immutable `lexrunner-v1.5.0` workflow failed closed before install or publication.
+
+## [1.5.0] - 2026-08-23
+
+### Added
+
+- **Durable Attempt awaitables** - Add bounded lifecycle observation and wakeup contracts that bind
+  the exact Attempt revision and terminal state without embedding credentials or accepting unsafe
+  replay state.
+- **Executable gate receipts** - Retain fresh per-attempt command evidence with exact cwd,
+  shell/argv identity, duration, exit and failure classification, bounded stream hashes, and
+  declared artifact hashes.
+- **Disposable workspace recovery controller** - Add a root-owned WSL2 controller that prepares
+  bounded Attempt-owned ext4 roots from a hash-checked sealed source, records pre-mutation
+  filesystem and Git identities, journals each root before exposing it, and atomically detaches and
+  discards only the exactly bound root. Recovery is resumable across preparation, detach, evidence,
+  and delete crash windows. Complete bounded pre/post manifests and canonical deltas remain
+  resolvable from controller-only evidence after deletion, while strict receipts bind their hashes,
+  worker absence, recovery authorization, and workspace absence without creating a writer grant or
+  launch path.
+- **Governed workspace mutation profile** - Add a non-review task profile whose proposed authority
+  is limited to an Attempt-owned read scope and exact writable-path-set hash with whole-workspace
+  discard recovery. The profile exports no execution-binding constructor: schema records and an
+  adapter manifest cannot mint a write receipt. Protected authority integration must independently
+  resolve exact-image qualification and controller-prepared workspace evidence by hash, validate
+  freshness with its own trusted clock, and construct the generic grant only after those records
+  reconstruct the prompt, source, read, write, ownership, and rollback bindings. The task input
+  hash also binds its normalized duration, output-byte, evidence-byte, and tool-call budgets.
+- **Governed task capability foundation** - Add a review-neutral task/profile binding and positive
+  capability ceiling that represents recoverable workspace writes, explicitly bounded external
+  effects, contained runtime execution, and attenuated nested Delegations without weakening `NO`.
+- **Governed committed-corpus review** - Bind a clean committed native-WSL candidate to its exact
+  Attempt, workspace lease, task packet, launch envelope, and path mapping; export only bounded Git
+  object bytes and the exact patch; seal them read-only for the asynchronous two-phase Codex review.
+- **Independent repository verification** - Reopen the authoritative lifecycle records and require
+  protected provider receipts to match the corpus, prompt, schema, task offer, and Delegation before
+  a review can become admissible.
+
+### Changed
+
+- **Native Windows gate execution** - Run local command gates through a resolved PowerShell runtime
+  with explicit argument and working-directory identity instead of accidentally crossing into WSL
+  or relying on a platform shell shim.
+- **Provider stream failure terminality** - Convert bounded-line, invalid-event, sequence, and
+  transport failures into a durable `failed` executor event with a bounded protected failure frame;
+  cancel the provider, never retain raw failure output in lifecycle state, and reserve `lost` for
+  unexplained stream disappearance.
+- **Governed review task profile** - Express read-only review through a durable generic
+  `GovernedTaskSpec`, bind the Delegation offer to its exact task and provider, and independently
+  reconstruct the profile from protected prompt, corpus, output-contract, and budget bindings;
+  release accepted work only after the generic grant and qualified adapter evaluate, and dispatch
+  `PASS`/`BLOCK` interpretation through the exact profile verifier.
+- **Qualified provider topology** - Bind the root-owned repository exporter and exact Git executable
+  and version into live qualification evidence, and securely discard sealed corpora that never
+  become operation-bound.
+
+### Fixed
+
+- **Gate artifact freshness** - Fail closed when declared evidence is missing, stale, unsupported,
+  changed during retention, or cannot be preserved with identical bytes.
+- **Cross-platform package smoke** - Invoke npm and installed package bin targets through the active
+  Node runtime so packed-consumer validation works on Windows without spawning `.cmd` shims.
+- **Windows Git-backed verification** - Render prompt-search diagnostics with stable separators,
+  use privilege-free junction fixtures, and bound process-restart tests with Windows-sized timing
+  and cleanup retries.
+- **Governed refusal and budget enforcement** - Persist an offer-phase `NO` directly from the
+  offered Delegation state, and independently reject duration, output, evidence-byte, or tool-call
+  usage beyond the exact task budget bound to execution requirements and the evidence reservation.
+- **Generic continuation and outcome isolation** - Deny both direct work and post-`ACCEPT`
+  continuation when the durable generic task/execution binding is absent, keep unbound legacy
+  offers refusal-only, reject contradictory `PASS` output with blocking findings, and make generic
+  results and verification receipts accept profile-owned outcome identifiers without embedding the
+  code-review vocabulary. Bind the root task grant issuer to the operator principal named by the
+  protected authorization requirements so a self-consistent caller grant cannot mint authority.
+- **Git object substitution defense** - Verify every exported file against the blob object ID in
+  the candidate tree, preserve that object ID in the sealed manifest, and recheck the binding at
+  both the Windows corpus parser and provider boundary.
+- **Qualification upgrade boundary** - Reject pre-profile qualification manifests so repository
+  review cannot use a legacy attestation that omits the exporter and Git executable hashes.
+- **Repository launch lease race** - Atomically require the bound active workspace lease when
+  authorizing the offer, creating the durable operation, and authorizing post-acceptance work; the
+  independent verifier also rejects results after lease release.
+- **Repository corpus memory bounds** - Read Git blobs one at a time, reject aggregate tree size from
+  object headers before buffering payloads, and stop every Git metadata or patch stream after its
+  declared maximum plus one byte.
+- **Repository receipt lifecycle projection** - Verify the provider's corpus-header receipt against
+  provider-visible fields while independently enforcing the host-owned workspace-lease revision.
+- **Failed repository launch cleanup** - Treat post-validation launch construction transactionally:
+  stop partially created worker units and remove partial spools and unreferenced sealed corpora
+  whenever launch fails before returning a handle.
+
+## [1.4.1] - 2026-08-04
+
+### Added
+
+- **Canonical CLI executable** - Publish `lexrunner` as the primary npm binary alongside
+  `lexrunner-mcp` and the retained `lex-pr` compatibility alias.
+
+### Changed
+
+- **Consistent CLI identity** - Use `lexrunner` in root and subcommand help, completions, diagnostic
+  prefixes, installation guidance, current release documentation, and generated CLI/MCP surface
+  guidance.
+
+### Fixed
+
+- **Package/executable mismatch** - Ensure installing `@smartergpt/lexrunner` exposes an executable
+  matching the package and product name without breaking existing `lex-pr` automation.
+
 ## [1.4.0] - 2026-08-04
 
 ### Added

package/README.md

@@ -1,4 +1,4 @@
-# LexRunner (`lex-pr`)
+# LexRunner (`lexrunner`)
 
 LexRunner turns a changing set of pull requests into a reviewable integration program: discover
 the work, freeze a dependency plan, run bounded gates, preserve evidence, and merge only with
@@ -19,13 +19,13 @@ branch, pushing, opening a PR, or merging requires separate approval.
 
 LexRunner’s supported workflow has grown in layers. A normal user can stop at any layer.
 
-| Layer               | Current capability                                                                                           | First surface                       |
-| ------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------------- |
-| Deterministic plan  | Freeze PRs and declared dependencies into schema-versioned `plan.json`                                       | `lex-pr weave plan`                 |
-| Merge-weave         | Compute merge order, preview integration, run gates, and apply authorized merges                             | `lex-pr weave *`, `lex-pr gate run` |
-| Run and evidence    | Persist bounded receipts, independent verification, acceptance, and artifacts                                | `lex-pr attempt *`                  |
-| Fanout              | Harvest and analyze issue/PR evidence for parallel work planning                                             | `lex-pr fanout *`                   |
-| Assisted agent work | Prepare an immutable packet and workspace envelope, attach a foreground-owned worker, then verify its claims | CLI/MCP Attempt lifecycle           |
+| Layer               | Current capability                                                                                           | First surface                             |
+| ------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------------------- |
+| Deterministic plan  | Freeze PRs and declared dependencies into schema-versioned `plan.json`                                       | `lexrunner weave plan`                    |
+| Merge-weave         | Compute merge order, preview integration, run gates, and apply authorized merges                             | `lexrunner weave *`, `lexrunner gate run` |
+| Run and evidence    | Persist bounded receipts, independent verification, acceptance, and artifacts                                | `lexrunner attempt *`                     |
+| Fanout              | Harvest and analyze issue/PR evidence for parallel work planning                                             | `lexrunner fanout *`                      |
+| Assisted agent work | Prepare an immutable packet and workspace envelope, attach a foreground-owned worker, then verify its claims | CLI/MCP Attempt lifecycle                 |
 
 The ADR-010 coordination model is accepted and its assisted Attempt lifecycle is implemented.
 LexRunner also has a tested headless reconciliation **application boundary**, but it is not a
@@ -39,21 +39,21 @@ remain unproven. See [ADR-010](docs/adr/ADR-010-agent-work-orchestration-protoco
 First inspect without mutation:
 
 ```bash
-lex-pr --version
-lex-pr workspace doctor --json
-lex-pr weave discover --json
+lexrunner --version
+lexrunner workspace doctor --json
+lexrunner weave discover --json
 ```
 
 After approving a local, reversible artifact, freeze and inspect a plan:
 
 ```bash
-lex-pr weave plan --from-github --output plan.json --json
-lex-pr schema validate plan.json --json
-lex-pr weave merge-order plan.json --json
-lex-pr gate run plan.json --dry-run --json
+lexrunner weave plan --from-github --output plan.json --json
+lexrunner schema validate plan.json --json
+lexrunner weave merge-order plan.json --json
+lexrunner gate run plan.json --dry-run --json
 ```
 
-These commands do not merge. `lex-pr weave apply --execute` is a separate mutation and should be
+These commands do not merge. `lexrunner weave apply --execute` is a separate mutation and should be
 run only after reviewing the frozen plan, authority, gates, and target branch.
 
 For a guided merge-weave walkthrough, use
@@ -94,28 +94,34 @@ organization, so a human with organization access must authenticate the npm CLI
 ```bash
 npm login --scope=@smartergpt --registry=https://registry.npmjs.org/
 npm install --save-dev @smartergpt/lexrunner
-npx lex-pr --version
+npx lexrunner --version
 ```
 
 Global installation is also supported:
 
 ```bash
 npm install --global @smartergpt/lexrunner
-lex-pr --version
+lexrunner --version
 ```
 
 Do not place npm tokens in the repository or a chat transcript. Windows/private-package validation
 is documented in the [Node 24 migration guide](docs/node-24-migration.md).
 
-The checked-in package version is the single source for `lex-pr --version`.
+`lexrunner` is the canonical CLI name. The existing `lex-pr` executable remains an additive
+compatibility alias and invokes the same program, so existing automation does not need to change.
+
+The checked-in package version is the single source for `lexrunner --version` and
+`lex-pr --version`.
 
 <!-- BEGIN GENERATED PACKAGE VERSION -->
 
-Current repository package version: **1.4.0**. npm availability and dist-tags are separate
+Current repository package version: **1.5.1**. npm availability and dist-tags are separate
 release evidence; inspect the registry rather than inferring publication from source metadata.
 <!-- END GENERATED PACKAGE VERSION -->
 
-See the [1.4.0 release notes](docs/releases/1.4.0.md), the
+See the [1.5.1 release notes](docs/releases/1.5.1.md), the
+[1.4.1 canonical CLI release](docs/releases/1.4.1.md), the
+[1.4.0 native-host boundary release](docs/releases/1.4.0.md), the
 [1.3.0 dogfood release](docs/releases/1.3.0.md), the
 [1.2.1 publication repair](docs/releases/1.2.1.md), and the underlying
 [1.2.0 compatibility decision](docs/releases/1.2.0.md) for package disposition, semver rationale,
@@ -172,7 +178,7 @@ For implementation work, use the touched/adjacent gate selector and let CI prove
 high-risk changes:
 
 ```bash
-lex-pr gate select --base <base-sha> --head <head-sha> --json
+lexrunner gate select --base <base-sha> --head <head-sha> --json
 ```
 
 Release validation remains exhaustive. See [`AGENTS.md`](AGENTS.md),
@@ -182,7 +188,7 @@ Release validation remains exhaustive. See [`AGENTS.md`](AGENTS.md),
 ## Package and licensing
 
 - Package: `@smartergpt/lexrunner`
-- CLI: `lex-pr`
+- CLI: `lexrunner` (`lex-pr` compatibility alias)
 - MCP bin: `lexrunner-mcp`
 - Runtime dependency: `@smartergpt/lex` (MIT)
 - LexRunner license: SmarterGPT Source-Available Personal Use License

package/dist/{audit-5ZUBPZZX.js → audit-SKMMC2U4.js}

@@ -23,7 +23,7 @@ import {
   sanitizeEnv,
   sanitizeFileContent,
   writeManifest
-} from "./chunk-R4DWK6FE.js";
+} from "./chunk-6PZDSWCG.js";
 import {
   generateSARIF,
   writeSARIF

package/dist/{autopilot-JXO4MZ6H.js → autopilot-62Y2M2ZO.js}

@@ -16,7 +16,7 @@ import {
   hasCapability,
   parseAutopilotConfig,
   validateAutopilotConfig
-} from "./chunk-WSJEPY7T.js";
+} from "./chunk-TIMHM7VL.js";
 import "./chunk-4FFGNTAV.js";
 import "./chunk-6A4IE3TI.js";
 import "./chunk-VAGHAQT2.js";

package/dist/{chunk-R4DWK6FE.js → chunk-6PZDSWCG.js}

@@ -514,7 +514,7 @@ var AuditEmitter = class {
           const auditContext = await collectContext(contextTypes);
           this.context = auditContext;
         } catch (err) {
-          console.warn("[lex-pr] audit: context collection failed", err);
+          console.warn("[lexrunner] audit: context collection failed", err);
           this.context = {};
         }
       } else {
@@ -534,7 +534,7 @@ var AuditEmitter = class {
     }
     this.ndjsonStream = fs3.createWriteStream(this.ndjsonPath, { flags: "a", autoClose: true });
     this.ndjsonStream.on("error", (err) => {
-      console.warn("[lex-pr] audit: ndjson stream error (ignored)", String(err));
+      console.warn("[lexrunner] audit: ndjson stream error (ignored)", String(err));
     });
     const schemaPath = path3.join(this.auditDir, "audit.schema.json");
     const schema = {
@@ -627,7 +627,7 @@ var AuditEmitter = class {
         this.ndjsonStream.write(line);
       }
     } catch (e) {
-      console.warn("[lex-pr] audit: ndjson write failed (ignored)", String(e));
+      console.warn("[lexrunner] audit: ndjson write failed (ignored)", String(e));
     }
     this.eventCount++;
     this.eventsByType[event] = (this.eventsByType[event] || 0) + 1;
@@ -652,7 +652,7 @@ var AuditEmitter = class {
       try {
         await this.ingestSidecar();
       } catch (e) {
-        console.warn("[lex-pr] audit: sidecar ingestion error (ignored)", String(e));
+        console.warn("[lexrunner] audit: sidecar ingestion error (ignored)", String(e));
       }
     }, 5e3);
     try {
@@ -689,11 +689,14 @@ var AuditEmitter = class {
             this.eventsByType[event.event] = (this.eventsByType[event.event] || 0) + 1;
           }
         } catch (innerErr) {
-          console.warn("[lex-pr] audit: error ingesting sidecar event (ignored)", String(innerErr));
+          console.warn(
+            "[lexrunner] audit: error ingesting sidecar event (ignored)",
+            String(innerErr)
+          );
         }
       });
     } catch (err) {
-      console.warn("[lex-pr] audit: ingestSidecarFiles failed (ignored)", String(err));
+      console.warn("[lexrunner] audit: ingestSidecarFiles failed (ignored)", String(err));
     }
   }
   /**
@@ -862,11 +865,11 @@ var AuditEmitter = class {
             else if (status === "blocked") totalBlocked++;
           }
         } catch (parseError) {
-          console.warn("[lex-pr] audit: skipping malformed line in audit.ndjson");
+          console.warn("[lexrunner] audit: skipping malformed line in audit.ndjson");
         }
       }
     } catch (e) {
-      console.warn("[lex-pr] audit: failed to read audit.ndjson (ignored)", String(e));
+      console.warn("[lexrunner] audit: failed to read audit.ndjson (ignored)", String(e));
       return;
     }
     const gateMatrix = {
@@ -909,11 +912,11 @@ var AuditEmitter = class {
             vulnEvents.push(event);
           }
         } catch (parseError) {
-          console.warn("[lex-pr] audit: skipping malformed line in audit.ndjson");
+          console.warn("[lexrunner] audit: skipping malformed line in audit.ndjson");
         }
       }
     } catch (e) {
-      console.warn("[lex-pr] audit: failed to read audit.ndjson for SARIF (ignored)", String(e));
+      console.warn("[lexrunner] audit: failed to read audit.ndjson for SARIF (ignored)", String(e));
       return;
     }
     if (vulnEvents.length === 0) {

package/dist/{chunk-WFN4JTZI.js → chunk-LQSRQ6Z3.js}

@@ -213,18 +213,18 @@ function readGovernanceLogs() {
         const [major] = rawLog.schemaVersion.split(".").map(Number);
         if (major > CURRENT_MAJOR_VERSION) {
           console.warn(
-            `[lex-pr] Skipping log ${file}: schema v${rawLog.schemaVersion} not supported (current: v${CURRENT_MAJOR_VERSION}.x.x)`
+            `[lexrunner] Skipping log ${file}: schema v${rawLog.schemaVersion} not supported (current: v${CURRENT_MAJOR_VERSION}.x.x)`
           );
           continue;
         }
       } else {
-        console.warn(`[lex-pr] Skipping log ${file}: missing schemaVersion (legacy format)`);
+        console.warn(`[lexrunner] Skipping log ${file}: missing schemaVersion (legacy format)`);
         continue;
       }
       const parsed = GovernanceComparisonLogSchema.parse(rawLog);
       logs.push(parsed);
     } catch (error) {
-      console.warn(`[lex-pr] Skipping invalid log ${file}:`, error);
+      console.warn(`[lexrunner] Skipping invalid log ${file}:`, error);
     }
   }
   logs.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
@@ -248,7 +248,7 @@ function readGovernanceLogsWithLegacy() {
         const [major] = rawLog.schemaVersion.split(".").map(Number);
         if (major > CURRENT_MAJOR_VERSION) {
           console.warn(
-            `[lex-pr] Skipping log ${file}: schema v${rawLog.schemaVersion} not supported (current: v${CURRENT_MAJOR_VERSION}.x.x)`
+            `[lexrunner] Skipping log ${file}: schema v${rawLog.schemaVersion} not supported (current: v${CURRENT_MAJOR_VERSION}.x.x)`
           );
           continue;
         }
@@ -291,7 +291,7 @@ function readGovernanceLogsWithLegacy() {
         normalizationWarnings: warnings
       });
     } catch (error) {
-      console.warn(`[lex-pr] Skipping invalid log ${file} (even with normalization):`, error);
+      console.warn(`[lexrunner] Skipping invalid log ${file} (even with normalization):`, error);
     }
   }
   results.sort((a, b) => new Date(b.log.timestamp).getTime() - new Date(a.log.timestamp).getTime());