jorgex-stack 1.9.25 → 1.9.26

package/README.md

@@ -106,9 +106,9 @@ Programmatic mode does **not** provide:
 
 ### Pi runtime
 
-El canon de Stack de este checkout contiene 14 agentes; el pin Pi vigente conserva temporalmente la snapshot empaquetada anterior de 15 agentes. Este checkpoint no cambia ese pin ni anticipa una nueva publicación.
+El canon de Stack y el paquete Pi fijado comparten ya el inventario de 14 agentes (primary y 13 subagentes). La identidad exacta del pin y su procedencia se mantienen en `src/lib/pi-runtime-pin.json`; esta adopción no implica una nueva publicación de Stack ni una instalación personal.
 
-Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. The following version references describe a historical Stack/Pi transition, not the current pin: Stack `1.9.7` recognized **`jorgex-pi@0.8.4`**, while Pi `0.8.5` was a separately published candidate. The current pin, package integrity and lifecycle are maintained in [docs/references/pi-runtime.md](docs/references/pi-runtime.md); this README does not predict a future release.
+Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. The version references that follow describe historical Stack/Pi transitions, not the current pin. The current pin, package integrity and lifecycle are maintained in [docs/references/pi-runtime.md](docs/references/pi-runtime.md) and `src/lib/pi-runtime-pin.json`; this README does not imply a future release.
 
 The following command block is retained as historical reference for that transition:
 
@@ -120,9 +120,9 @@ pnpm dlx jorgex-stack@1.9.7 sync --agents pi
 pnpm dlx jorgex-stack@1.9.7 uninstall --agents pi
 ```
 
-Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. The historical `0.8.0` tarball was `89128340` bytes; the exact current artifact and integrity values are authoritative in `src/lib/pi-runtime.ts`. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The published `1.9.7` entry is `{ "source": "npm:jorgex-pi@0.8.4", "skills": [], "prompts": [] }`; the checkout's `0.8.5` entry is a candidate only. Filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
+Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. The historical `0.8.0` tarball was `89128340` bytes; the exact adopted artifact and integrity values are authoritative in `src/lib/pi-runtime-pin.json`, while the lifecycle remains authoritative in `src/lib/pi-runtime.ts`. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The published `1.9.7` entry `{ "source": "npm:jorgex-pi@0.8.4", "skills": [], "prompts": [] }` and the `0.8.5` snapshot reference are historical; they do not describe the adopted pin. Filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
 
-Historically, the published Pi 0.8.0 direct-package snapshot added `work-audit`: the snapshot grew from **17 to 18 skill trees** (96 to 97 files), and the active runtime allowlist grew from **16 to 17 skills**. The Pi 0.8.5 candidate records 18 skill trees and 98 files; reference F2-A is included while the private F1 skills remain preserved. `playwright-cli` remains in the snapshot but inactive because browser automation is a separate opt-in integration.
+Historically, the published Pi 0.8.0 direct-package snapshot added `work-audit`: the snapshot grew from **17 to 18 skill trees** (96 to 97 files), and the active runtime allowlist grew from **16 to 17 skills**. The historical Pi 0.8.5 snapshot reference records 18 skill trees and 98 files; it does not describe the adopted pin. Reference F2-A is included while the private F1 skills remain preserved. `playwright-cli` remains in the snapshot but inactive because browser automation is a separate opt-in integration.
 
 The historical published artifact has two separate provenance anchors. The local size/SHA-256/SHA-512 checks bind the downloaded bytes to Stack's accepted artifact; they are checks within that checkout, not independent trust roots. npm's external provenance/attestation is outside Stack runtime verification, and `provenance.commit` is informative unless that external attestation is independently verified.
 

package/dist/cli.js

@@ -5160,16 +5160,16 @@ import { createHash } from "crypto";
 var pi_runtime_pin_default = {
   package: {
     name: "jorgex-pi",
-    version: "0.8.9",
-    source: "npm:jorgex-pi@0.8.9"
+    version: "0.8.11",
+    source: "npm:jorgex-pi@0.8.11"
   },
   provenance: {
-    commit: "7bf86025b5aeb2280b3bc504b46d6b0ee18b118f"
+    commit: "8690d0cab6e4149c95e299b2ef3d7277b8b06263"
   },
   tarball: {
-    bytes: 89143538,
-    sha256: "90085e5ea9f333de20c0aa3244bb6b1b67435298461433e2086df0155db231c0",
-    sha512: "9d7e99e008c0d61138759073ae03dee39be1f30c7af9a592fd8bd2f347154ef98cad0e813d60995d29da9d13b9b45d370c2ac0065684ebdbb8f22fa319610a98"
+    bytes: 89141979,
+    sha256: "f0b34be384e5c761043348e7eb561fe56d475ef61479a0a93cd563d28dd28d8b",
+    sha512: "ad76a61dc7388b3b077f89a77dc211596f3d82b8f44a503552ba0eff655cbfdc3ee99b395d647806a637e87ed731483e71e6cfef9c21f3945ce3b4b8f3bd7c57"
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.25",
+  "version": "1.9.26",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",