@smartergpt/lexrunner 1.4.1 → 1.5.1

package/CHANGELOG.md

@@ -6,6 +6,104 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 ## [Unreleased]
 
+## [1.5.1] - 2026-08-23
+
+### Fixed
+
+- **Credential-free release ancestry verification** - Verify that the signed release commit is
+  contained in `main` through the authenticated GitHub compare API after checkout credentials are
+  deliberately discarded. This recovery release carries forward the complete 1.5.0 feature set;
+  the immutable `lexrunner-v1.5.0` workflow failed closed before install or publication.
+
+## [1.5.0] - 2026-08-23
+
+### Added
+
+- **Durable Attempt awaitables** - Add bounded lifecycle observation and wakeup contracts that bind
+  the exact Attempt revision and terminal state without embedding credentials or accepting unsafe
+  replay state.
+- **Executable gate receipts** - Retain fresh per-attempt command evidence with exact cwd,
+  shell/argv identity, duration, exit and failure classification, bounded stream hashes, and
+  declared artifact hashes.
+- **Disposable workspace recovery controller** - Add a root-owned WSL2 controller that prepares
+  bounded Attempt-owned ext4 roots from a hash-checked sealed source, records pre-mutation
+  filesystem and Git identities, journals each root before exposing it, and atomically detaches and
+  discards only the exactly bound root. Recovery is resumable across preparation, detach, evidence,
+  and delete crash windows. Complete bounded pre/post manifests and canonical deltas remain
+  resolvable from controller-only evidence after deletion, while strict receipts bind their hashes,
+  worker absence, recovery authorization, and workspace absence without creating a writer grant or
+  launch path.
+- **Governed workspace mutation profile** - Add a non-review task profile whose proposed authority
+  is limited to an Attempt-owned read scope and exact writable-path-set hash with whole-workspace
+  discard recovery. The profile exports no execution-binding constructor: schema records and an
+  adapter manifest cannot mint a write receipt. Protected authority integration must independently
+  resolve exact-image qualification and controller-prepared workspace evidence by hash, validate
+  freshness with its own trusted clock, and construct the generic grant only after those records
+  reconstruct the prompt, source, read, write, ownership, and rollback bindings. The task input
+  hash also binds its normalized duration, output-byte, evidence-byte, and tool-call budgets.
+- **Governed task capability foundation** - Add a review-neutral task/profile binding and positive
+  capability ceiling that represents recoverable workspace writes, explicitly bounded external
+  effects, contained runtime execution, and attenuated nested Delegations without weakening `NO`.
+- **Governed committed-corpus review** - Bind a clean committed native-WSL candidate to its exact
+  Attempt, workspace lease, task packet, launch envelope, and path mapping; export only bounded Git
+  object bytes and the exact patch; seal them read-only for the asynchronous two-phase Codex review.
+- **Independent repository verification** - Reopen the authoritative lifecycle records and require
+  protected provider receipts to match the corpus, prompt, schema, task offer, and Delegation before
+  a review can become admissible.
+
+### Changed
+
+- **Native Windows gate execution** - Run local command gates through a resolved PowerShell runtime
+  with explicit argument and working-directory identity instead of accidentally crossing into WSL
+  or relying on a platform shell shim.
+- **Provider stream failure terminality** - Convert bounded-line, invalid-event, sequence, and
+  transport failures into a durable `failed` executor event with a bounded protected failure frame;
+  cancel the provider, never retain raw failure output in lifecycle state, and reserve `lost` for
+  unexplained stream disappearance.
+- **Governed review task profile** - Express read-only review through a durable generic
+  `GovernedTaskSpec`, bind the Delegation offer to its exact task and provider, and independently
+  reconstruct the profile from protected prompt, corpus, output-contract, and budget bindings;
+  release accepted work only after the generic grant and qualified adapter evaluate, and dispatch
+  `PASS`/`BLOCK` interpretation through the exact profile verifier.
+- **Qualified provider topology** - Bind the root-owned repository exporter and exact Git executable
+  and version into live qualification evidence, and securely discard sealed corpora that never
+  become operation-bound.
+
+### Fixed
+
+- **Gate artifact freshness** - Fail closed when declared evidence is missing, stale, unsupported,
+  changed during retention, or cannot be preserved with identical bytes.
+- **Cross-platform package smoke** - Invoke npm and installed package bin targets through the active
+  Node runtime so packed-consumer validation works on Windows without spawning `.cmd` shims.
+- **Windows Git-backed verification** - Render prompt-search diagnostics with stable separators,
+  use privilege-free junction fixtures, and bound process-restart tests with Windows-sized timing
+  and cleanup retries.
+- **Governed refusal and budget enforcement** - Persist an offer-phase `NO` directly from the
+  offered Delegation state, and independently reject duration, output, evidence-byte, or tool-call
+  usage beyond the exact task budget bound to execution requirements and the evidence reservation.
+- **Generic continuation and outcome isolation** - Deny both direct work and post-`ACCEPT`
+  continuation when the durable generic task/execution binding is absent, keep unbound legacy
+  offers refusal-only, reject contradictory `PASS` output with blocking findings, and make generic
+  results and verification receipts accept profile-owned outcome identifiers without embedding the
+  code-review vocabulary. Bind the root task grant issuer to the operator principal named by the
+  protected authorization requirements so a self-consistent caller grant cannot mint authority.
+- **Git object substitution defense** - Verify every exported file against the blob object ID in
+  the candidate tree, preserve that object ID in the sealed manifest, and recheck the binding at
+  both the Windows corpus parser and provider boundary.
+- **Qualification upgrade boundary** - Reject pre-profile qualification manifests so repository
+  review cannot use a legacy attestation that omits the exporter and Git executable hashes.
+- **Repository launch lease race** - Atomically require the bound active workspace lease when
+  authorizing the offer, creating the durable operation, and authorizing post-acceptance work; the
+  independent verifier also rejects results after lease release.
+- **Repository corpus memory bounds** - Read Git blobs one at a time, reject aggregate tree size from
+  object headers before buffering payloads, and stop every Git metadata or patch stream after its
+  declared maximum plus one byte.
+- **Repository receipt lifecycle projection** - Verify the provider's corpus-header receipt against
+  provider-visible fields while independently enforcing the host-owned workspace-lease revision.
+- **Failed repository launch cleanup** - Treat post-validation launch construction transactionally:
+  stop partially created worker units and remove partial spools and unreferenced sealed corpora
+  whenever launch fails before returning a handle.
+
 ## [1.4.1] - 2026-08-04
 
 ### Added

package/README.md

@@ -115,11 +115,12 @@ The checked-in package version is the single source for `lexrunner --version` an
 
 <!-- BEGIN GENERATED PACKAGE VERSION -->
 
-Current repository package version: **1.4.1**. npm availability and dist-tags are separate
+Current repository package version: **1.5.1**. npm availability and dist-tags are separate
 release evidence; inspect the registry rather than inferring publication from source metadata.
 <!-- END GENERATED PACKAGE VERSION -->
 
-See the [1.4.1 release notes](docs/releases/1.4.1.md), the
+See the [1.5.1 release notes](docs/releases/1.5.1.md), the
+[1.4.1 canonical CLI release](docs/releases/1.4.1.md), the
 [1.4.0 native-host boundary release](docs/releases/1.4.0.md), the
 [1.3.0 dogfood release](docs/releases/1.3.0.md), the
 [1.2.1 publication repair](docs/releases/1.2.1.md), and the underlying

package/dist/{autopilot-EBZ44LYS.js → autopilot-62Y2M2ZO.js}

@@ -16,7 +16,7 @@ import {
   hasCapability,
   parseAutopilotConfig,
   validateAutopilotConfig
-} from "./chunk-4R52WTFO.js";
+} from "./chunk-TIMHM7VL.js";
 import "./chunk-4FFGNTAV.js";
 import "./chunk-6A4IE3TI.js";
 import "./chunk-VAGHAQT2.js";