jorgex-stack 1.9.3 → 1.9.4

package/README.md

@@ -106,7 +106,9 @@ Programmatic mode does **not** provide:
 
 ### Pi runtime
 
-Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. This section targets the exact published package **`jorgex-pi@0.8.0`** and keeps Pi out of the adapter/component manifest and model map. Stack 1.9.2 recognizes `npm:jorgex-pi@0.8.0`; this is the managed Stack release, not a claim that every end-user scope has already consumed it.
+Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. The current published Stack `1.9.3` still recognizes the outgoing exact package **`jorgex-pi@0.8.0`**. This checkout carries the next production candidate **`jorgex-pi@0.8.3`**; its Stack release is not published yet, so no future Stack version is named here.
+
+The following command set is retained from the historical published Stack `1.9.2`; it is not a command set for the unpublished candidate release.
 
 ```bash
 pnpm dlx jorgex-stack@1.9.2 install --agents pi
@@ -116,13 +118,13 @@ pnpm dlx jorgex-stack@1.9.2 sync --agents pi
 pnpm dlx jorgex-stack@1.9.2 uninstall --agents pi
 ```
 
-Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. For `0.8.0`, the frozen tarball is `89128340` bytes; the URL is derived from the version and the authoritative size/SHA-256/SHA-512 pin remains in `src/lib/pi-runtime.ts` rather than being duplicated here. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The managed Pi package entry is the exact object `{ "source": "npm:jorgex-pi@0.8.0", "skills": [], "prompts": [] }`; filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
+Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. For the outgoing `0.8.0` pin, the frozen tarball is `89128340` bytes; the URL is derived from the version and the authoritative integrity pin remains in `src/lib/pi-runtime.ts`. The new candidate is `jorgex-pi@0.8.3`, with `89129618` bytes, release provenance commit `0a35c283fe30a9fed87da3cedc00bab97163e68b`, and parity source `fac3ba828c20134858e2a9aa1e68b920270f7b5a`; these values are sourced from the runtime candidate, its test fixture, and the verified public-artifact evidence. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The managed Pi package entry is the exact object `{ "source": "npm:jorgex-pi@0.8.3", "skills": [], "prompts": [] }`; filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
 
-The published Pi 0.8.0 direct-package snapshot adds `work-audit`: the snapshot grows from **17 to 18 skill trees** (96 to 97 files), and the active runtime allowlist grows from **16 to 17 skills**. `playwright-cli` remains in the snapshot but inactive because browser automation is a separate opt-in integration.
+Historically, the published Pi 0.8.0 direct-package snapshot added `work-audit`: the snapshot grew from **17 to 18 skill trees** (96 to 97 files), and the active runtime allowlist grew from **16 to 17 skills**. `playwright-cli` remains in the snapshot but inactive because browser automation is a separate opt-in integration. The 0.8.3 candidate preserves that work-audit introduction.
 
 The published artifact has two separate provenance anchors. The local size/SHA-256/SHA-512 checks bind the downloaded bytes to Stack's accepted candidate; they are checks within that checkout, not independent trust roots. npm's external provenance/attestation is outside Stack runtime verification, and `provenance.commit` is informative unless that external attestation is independently verified.
 
-The published artifact records two distinct commit identities: the release checkout and tarball producer is `9f999747df3e335947a61d38e581555367973b09` (`main`, release `0.8.0`); and the Stack parity source is `11e7666ea4e40bde1de8bc434610747eb797ab9c`. Registry metadata has no `gitHead`; README does not invent a separate source identity, attestation or signature.
+The outgoing published artifact records two distinct commit identities: the release checkout and tarball producer is `9f999747df3e335947a61d38e581555367973b09` (`main`, release `0.8.0`); and the Stack parity source is `11e7666ea4e40bde1de8bc434610747eb797ab9c`. For the new candidate, the verified Pi release checkout is `0a35c283fe30a9fed87da3cedc00bab97163e68b` and the parity source is `fac3ba828c20134858e2a9aa1e68b920270f7b5a`. Registry metadata has no `gitHead`; README does not invent a separate source identity, attestation or signature.
 
 Install, sync and uninstall back up every managed file before changing it and are idempotent. `doctor` reports package and projection drift without repairing it. Uninstall removes only receipt-owned package/projection state, retains shared files also owned by another runtime, and preserves user content outside marked sections. Engram remains user-owned and is never removed; the receipts only carry the verified executable hand-off required by the package.
 
@@ -130,9 +132,9 @@ The package owns Pi's native primary-model projection: `openai-codex/gpt-5.6-sol
 
 Engram remains mandatory and user-owned. An existing binary is preserved. Interactive install may offer the native `brew`/`go`/release channel with explicit confirmation; `--yes` and non-TTY installs fail with a remedy when Engram is absent. The database and memories are never updated or deleted, and uninstall never deletes the Engram binary. Under `--target-dir`, Stack accepts only `<target>/bin/engram`, isolates Pi/Home/XDG/AppData/temp/npm-cache paths inside the target, and never consults the host Engram or Pi configuration.
 
-Stack 1.9.2 recognizes the exact Pi receipt for `npm:jorgex-pi@0.8.0`; use exact versions, never `latest`, and never edit receipts or hashes or delete `HOME`, Engram, or another runtime's projection to force trust. The rollback examples are in [docs/references/pi-runtime.md](docs/references/pi-runtime.md).
+The published Stack `1.9.3` recognizes the outgoing exact Pi receipt for `npm:jorgex-pi@0.8.0`. This checkout's production candidate is `npm:jorgex-pi@0.8.3`, but the corresponding new Stack release is not published yet; use exact versions, never `latest`, and never edit receipts or hashes or delete `HOME`, Engram, or another runtime's projection to force trust. The historical rollback examples are in [docs/references/pi-runtime.md](docs/references/pi-runtime.md).
 
-Stack 1.9.2 was accepted by npm and its readback confirmed public registry metadata and tarball availability. The 24-hour managed-consumption maturity rule applies only to real installation or consumption of the new Pi package; development, PR validation, merge and Stack publication may proceed immediately. Installing it on a real user scope before 24 hours requires Jorge's explicit exception.
+Stack 1.9.3 is the verified published Stack release. The new Pi 0.8.3 artifact has independently verified public registry bytes, but its adopting Stack release still requires post-merge publication and public npm readback before a new Stack version or transition command is documented. The 24-hour managed-consumption maturity rule applies only to real installation or consumption of the new Pi package; development, PR validation, merge and Stack publication may proceed immediately. Installing it on a real user scope before 24 hours requires Jorge's explicit exception.
 
 `update --agents pi` only runs the Pi package lifecycle; it does not enter the global Stack updater. `update --check --agents pi` is a read-only Pi doctor. Uninstall runs package cleanup, backs up Pi's settings before removal, removes only the exact receipt-owned package after verifying absence, and preserves all companion/user state. Full behavior, failure states and troubleshooting are in [docs/references/pi-runtime.md](docs/references/pi-runtime.md).
 

package/dist/cli.js

@@ -5142,16 +5142,16 @@ import { createHash } from "crypto";
 var PI_RUNTIME_CANDIDATE = {
   package: {
     name: "jorgex-pi",
-    version: "0.8.0",
-    source: "npm:jorgex-pi@0.8.0"
+    version: "0.8.3",
+    source: "npm:jorgex-pi@0.8.3"
   },
   provenance: {
-    commit: "9f999747df3e335947a61d38e581555367973b09"
+    commit: "0a35c283fe30a9fed87da3cedc00bab97163e68b"
   },
   tarball: {
-    bytes: 89128340,
-    sha256: "b001f9dea23669b7211af228df6ea6442bcd90a9a928aa1a47c3e7132966f989",
-    sha512: "a591bf223e2d48ddecc89341253dc0ac41a6f843796c04ca62f47dc7587b3ec9afafdffba63e52fe99f833aec5ac0b34926eaf3c26f2755003bbf8e6891f6bd9"
+    bytes: 89129618,
+    sha256: "4dfe5aed6ad3043b285d4d171656934708df159846634712a88f947ca8334ef4",
+    sha512: "36f958cb2edcb2ce22e28c59f32ddcb976b889a37cba3637e89478261ddc05d3a9cf1001d29a6aca30a92d935cb07b50243c4d3eca783ed8e580bf15bb3d07aa"
   },
   pi: {
     testedVersions: ["0.84.2"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.3",
+  "version": "1.9.4",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",