jorgex-stack 1.9.7 → 1.9.8

package/README.md

@@ -106,21 +106,21 @@ Programmatic mode does **not** provide:
 
 ### Pi runtime
 
-Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. The published Stack `1.9.5` recognizes the exact package **`jorgex-pi@0.8.3`**. The Stack `1.9.6` candidate prepares adoption of the published package **`jorgex-pi@0.8.4`**, but `1.9.6` is not published yet.
+Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. The published Stack `1.9.7` recognizes the exact package **`jorgex-pi@0.8.4`**. Pi `0.8.5` is published independently; this checkout keeps the Stack `1.9.7` baseline with the Pi `0.8.5` candidate pin. On merge, Stack is expected to auto-bump to `1.9.8` and publish without waiting 24 hours.
 
-The current published command set uses Stack `1.9.5` with Pi `0.8.3`:
+The current published command set uses Stack `1.9.7` with Pi `0.8.4`:
 
 ```bash
-pnpm dlx jorgex-stack@1.9.5 install --agents pi
-pnpm dlx jorgex-stack@1.9.5 doctor --agents pi
-pnpm dlx jorgex-stack@1.9.5 models --agents pi
-pnpm dlx jorgex-stack@1.9.5 sync --agents pi
-pnpm dlx jorgex-stack@1.9.5 uninstall --agents pi
+pnpm dlx jorgex-stack@1.9.7 install --agents pi
+pnpm dlx jorgex-stack@1.9.7 doctor --agents pi
+pnpm dlx jorgex-stack@1.9.7 models --agents pi
+pnpm dlx jorgex-stack@1.9.7 sync --agents pi
+pnpm dlx jorgex-stack@1.9.7 uninstall --agents pi
 ```
 
-Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. The historical `0.8.0` tarball was `89128340` bytes; the exact current artifact and integrity values are authoritative in `src/lib/pi-runtime.ts`. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The published `1.9.5` entry remains `{ "source": "npm:jorgex-pi@0.8.3", "skills": [], "prompts": [] }`; the `1.9.6` candidate changes that entry to `{ "source": "npm:jorgex-pi@0.8.4", "skills": [], "prompts": [] }`. Its code already recognizes the 0.8.4 receipt, while published-channel commands must wait for Stack 1.9.6 to be published. Filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
+Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. The historical `0.8.0` tarball was `89128340` bytes; the exact current artifact and integrity values are authoritative in `src/lib/pi-runtime.ts`. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The published `1.9.7` entry is `{ "source": "npm:jorgex-pi@0.8.4", "skills": [], "prompts": [] }`; the checkout's `0.8.5` entry is a candidate only. Filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
 
-Historically, the published Pi 0.8.0 direct-package snapshot added `work-audit`: the snapshot grew from **17 to 18 skill trees** (96 to 97 files), and the active runtime allowlist grew from **16 to 17 skills**. `playwright-cli` remains in the snapshot but inactive because browser automation is a separate opt-in integration. The published 0.8.3 package preserves that work-audit introduction.
+Historically, the published Pi 0.8.0 direct-package snapshot added `work-audit`: the snapshot grew from **17 to 18 skill trees** (96 to 97 files), and the active runtime allowlist grew from **16 to 17 skills**. The Pi 0.8.5 candidate records 18 skill trees and 98 files; reference F2-A is included while the private F1 skills remain preserved. `playwright-cli` remains in the snapshot but inactive because browser automation is a separate opt-in integration.
 
 The historical published artifact has two separate provenance anchors. The local size/SHA-256/SHA-512 checks bind the downloaded bytes to Stack's accepted artifact; they are checks within that checkout, not independent trust roots. npm's external provenance/attestation is outside Stack runtime verification, and `provenance.commit` is informative unless that external attestation is independently verified.
 
@@ -132,9 +132,9 @@ The package owns Pi's native primary-model projection: `openai-codex/gpt-5.6-sol
 
 Engram remains mandatory and user-owned. An existing binary is preserved. Interactive install may offer the native `brew`/`go`/release channel with explicit confirmation; `--yes` and non-TTY installs fail with a remedy when Engram is absent. The database and memories are never updated or deleted, and uninstall never deletes the Engram binary. Under `--target-dir`, Stack accepts only `<target>/bin/engram`, isolates Pi/Home/XDG/AppData/temp/npm-cache paths inside the target, and never consults the host Engram or Pi configuration.
 
-The published Stack `1.9.5` recognizes the exact Pi receipt `npm:jorgex-pi@0.8.3`. The Stack `1.9.6` candidate code already recognizes `npm:jorgex-pi@0.8.4`; consuming that pairing through the published channel waits until Stack `1.9.6` is published. Use exact versions, never `latest`, and never edit receipts or hashes or delete `HOME`, Engram, or another runtime's projection to force trust. The transition and rollback commands are in [docs/references/pi-runtime.md](docs/references/pi-runtime.md).
+The published Stack `1.9.7` recognizes the exact Pi receipt `npm:jorgex-pi@0.8.4`. Use exact versions, never `latest`, and never edit receipts or hashes or delete `HOME`, Engram, or another runtime's projection to force trust. The transition and rollback commands are in [docs/references/pi-runtime.md](docs/references/pi-runtime.md).
 
-Stack 1.9.5 → Pi 0.8.3 is the current published pairing. Stack 1.9.6 → Pi 0.8.4 is only a candidate until Stack 1.9.6 is published. The 24-hour managed-consumption maturity rule applies only to real installation or consumption of the new Pi package; development, PR validation, merge and Stack publication may proceed immediately. Installing it on a real user scope before the maturity window requires Jorge's explicit exception.
+The 24-hour managed-consumption maturity rule applies only to real installation or consumption of the new Pi package; development, PR validation, merge and Stack publication may proceed immediately. Installing it on a real user scope before the maturity window requires Jorge's explicit exception.
 
 `update --agents pi` only runs the Pi package lifecycle; it does not enter the global Stack updater. `update --check --agents pi` is a read-only Pi doctor. Uninstall runs package cleanup, backs up Pi's settings before removal, removes only the exact receipt-owned package after verifying absence, and preserves all companion/user state. Full behavior, failure states and troubleshooting are in [docs/references/pi-runtime.md](docs/references/pi-runtime.md).
 

package/dist/cli.js

@@ -5142,16 +5142,16 @@ import { createHash } from "crypto";
 var PI_RUNTIME_CANDIDATE = {
   package: {
     name: "jorgex-pi",
-    version: "0.8.4",
-    source: "npm:jorgex-pi@0.8.4"
+    version: "0.8.5",
+    source: "npm:jorgex-pi@0.8.5"
   },
   provenance: {
-    commit: "2b5cf37d9bfdb0c574e66712000ecc432eca8a69"
+    commit: "57cb15413c1dda408251ff80ff9d5658b7e91793"
   },
   tarball: {
-    bytes: 89133070,
-    sha256: "e30cbc0595bfbaa35b37f97096b77d46749315e3cf6ab13f830fe84432798b10",
-    sha512: "39255e7ccf7aad2cbe1069e2dbeb3335dc59f28ad1f0f32b677889e39e167e5fd39b546da9f448c33fad4581f0b4a8f1dda95a2f1b1bce010cc031b188ffc292"
+    bytes: 89133857,
+    sha256: "ea7ce0fa88c324d15756fbb1f7e222d2d87156de8a17cede8f3f317ad0d90c7e",
+    sha512: "0f6be4e79be3b7add6949b0d3d913a79acb0dd338ea0459d500358fec46ddb1925ad2ec926d0fbe899c7e48f0a7cb9681424fc1a0d1ab104e7e25d350478b989"
   },
   pi: {
     testedVersions: ["0.84.2"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.7",
+  "version": "1.9.8",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",