openmerit 0.1.6-preview.4 → 0.1.6

package/docs/inference-terminal.md

@@ -1,30 +1,32 @@
 # Inference Terminal
 
-The Inference Terminal is available as a test preview and in the source checkout; it is not in the stable npm release. It gives people and agents a local overview of an application’s models, providers, connections, inference activity, and compute. The selected repository or application path defines its scope. A coding agent can launch or read the terminal, but the coding harness’s own requests, tokens, and costs are outside that scope. Published `openmerit@0.1.5` does not include this command.
+The Inference Terminal is included in the default `openmerit@0.1.6` npm release. It is an early part of OpenMerit, not the complete product vision. It gives people and agents a local overview of an application’s models, providers, connections, inference activity, and compute. The selected repository or application path defines its scope. A coding agent can launch or read the terminal, but the coding harness’s own requests, tokens, and costs are outside that scope. Earlier `openmerit@0.1.5` does not include this command.
 
 The terminal reads existing metadata independently of inference. It does not call a model, change a route, run evaluations, load or unload models, or store prompts and responses. Closing it does not stop your workloads. Collection consumes a small amount of local CPU, memory, and runtime API capacity; it is not zero-overhead monitoring.
 
 ## Share the sample
 
-The [hosted sample preview](https://dash.openmerit.site/) lets you explore the fictional enterprise environment in a browser without installing the terminal. It includes 40 agents, 140 tasks, and 21 models, with the same tabs and inspectors as the local interface. All identities, requests, costs, and hardware readings are illustrative. Shared links use the title **Inference Terminal by OpenMerit** and a dedicated preview image.
+The [hosted sample](https://dash.openmerit.site/) lets you explore a fictional environment in a browser without installing the terminal. It is deployed separately from this npm package, so its sample data and interface can differ. All identities, requests, costs, and hardware readings in the sample are illustrative.
 
-The preview is accessible to anyone with the link and asks search engines not to index it. It does not connect to your machine, accept project uploads, make inference calls, or expose the local snapshot API. Its read-only `/api/sample` endpoint returns fictional data. Real environment collection runs locally through the test install or source-build commands below; the hosted page never runs collectors. Hosted sample refreshes allow up to 30 seconds for the large fictional response on slower connections; local snapshot requests retain their 5-second limit. Only one refresh request runs at a time, even when a transfer takes longer than the normal polling interval.
+The hosted page does not connect to your machine, accept project uploads, or run local collectors. Use the npm installation below to view your own application.
 
-## Install the test preview
+## Install
 
-The terminal is delivered through the existing `openmerit` package under npm’s `preview` tag. Historical ranges are included in `0.1.6-preview.1` and later; the project-evidence corrections below require `0.1.6-preview.2` or later. Expanded endpoint discovery and the review corrections require `0.1.6-preview.3` or later. Repository code/configuration indexing and counts-only diagnostics require `0.1.6-preview.4` or later. Requires **Node.js 22.19 or newer**, with npm available in your terminal. From your application's directory:
+Requires **Node.js 22.19 or newer**, with npm available in your terminal. From your application's directory:
 
 ```sh
 cd /path/to/your/project
-npm install -g openmerit@preview
+npm install -g openmerit
 openmerit dash
 ```
 
-The install uses the existing `openmerit` npm package, with the terminal bundled alongside its coordinator, protocol, and Pi adapter. It downloads a prebuilt test version. No Git checkout, build step, API key, or separate audit command is needed. Installation is global for your Node environment: it does not add a dependency, lockfile, or configuration to the application directory. It replaces any globally installed `openmerit` in the same npm prefix. This preview is separate from the stable package on npm; `npm install -g openmerit` still installs the stable release without `dash`.
+Version `0.1.6` brings the code from `0.1.6-preview.5` into npm's default `latest` channel. It includes historical activity ranges, project-evidence corrections, expanded endpoint discovery, code/configuration indexing, counts-only diagnostics, and phased background indexing. References to earlier preview versions below explain when behavior changed; all of those changes are included in `0.1.6`.
 
-`openmerit dash` reads the current directory, starts a server bound to `127.0.0.1`, and opens its URL in your default browser after the first snapshot is ready. Port 4310 is preferred; when occupied, the operating system chooses a free local port. The actual URL is always printed. macOS, Windows, and Linux desktop opening use the platform's default URL handler. SSH and headless Linux sessions print the URL instead; use a private SSH port forward to view a remote instance. A browser-launch failure does not stop collection.
+The terminal is bundled alongside the coordinator, protocol, and Pi adapter. The installation downloads prebuilt assets; no Git checkout, build step, API key, Pi installation, or separate audit command is needed to run the terminal. Installation is global for your Node environment: it does not add a dependency, lockfile, or configuration to the application directory. It replaces any globally installed `openmerit` in the same npm prefix.
 
-Run the same install command to update the preview. Remove it with `npm uninstall -g openmerit`, or restore the stable package with `npm install -g openmerit@0.1.5`. Registry preview builds have a `-preview.` version suffix; `npm ls -g openmerit --depth=0` shows which one is installed. `npm view openmerit dist-tags` shows the published preview and stable versions. To replace an earlier hosted `-dash.` test build, run the npm install command above.
+`openmerit dash` reads the current directory, starts a server bound to `127.0.0.1`, and opens its URL before collection finishes. Port 4310 is preferred; when occupied, the operating system chooses a free local port. The actual URL is always printed. macOS, Windows, and Linux desktop opening use the platform's default URL handler. SSH and headless Linux sessions print the URL instead; use a private SSH port forward to view a remote instance. A browser-launch failure does not stop collection.
+
+Run `npm install -g openmerit` to update, including from an earlier `@preview` or hosted `-dash.` build. Stop the old terminal process and launch `openmerit dash` again after updating. Pin this release with `npm install -g openmerit@0.1.6`; remove it with `npm uninstall -g openmerit`. `npm ls -g openmerit --depth=0` shows the installed version, and `npm view openmerit dist-tags` shows the registry channels. The separate `preview` tag can still point to an older prerelease; use the default install for `0.1.6`.
 
 If npm reports `EACCES`, use a user-owned Node installation/npm prefix rather than installing with `sudo`. If `openmerit` is not found after a successful install, reopen the terminal and check that your npm global executable directory is on `PATH`.
 
@@ -56,15 +58,15 @@ openmerit dash --no-open
 | `--no-discovery` | Skip project-file and request-log discovery and additional runtime discovery for this run; explicitly declared runtimes and exports, explicitly linked machine context remain available |
 | `--no-open` | Start collection and print the URL without launching a browser |
 | `--json` | Print one snapshot and exit without starting an HTTP server |
-| `--diagnostics` | **0.1.6-preview.4+:** print repository-index coverage counts only, then exit; no browser, server, or endpoint probes |
+| `--diagnostics` | Print repository-index coverage counts only, then exit; no browser, server, or endpoint probes |
 | `--demo` | Use an explicitly fictional environment; no local collectors run |
 | `--help` | Show usage |
 
 Use Ctrl+C to close the terminal. There is no persistent daemon or background scheduler. Collection runs only while the command is running. The terminal is separate from Pi's `/openmerit pause` and other orchestration commands.
 
-## Repository indexing (0.1.6-preview.4+)
+## Repository indexing
 
-Version `0.1.6-preview.4` adds a bounded, local syntax index of application declarations. No repository access needs to be shared with OpenMerit, and no separate audit step is required. The index runs initially and every 60 seconds while the terminal is running. It creates no files in the application.
+Version `0.1.6` includes a local syntax index of application declarations, introduced in `0.1.6-preview.4` and extended with continuing background batches in `0.1.6-preview.5`. No repository access needs to be shared with OpenMerit, and no separate audit step is required. The index runs initially and rechecks 60 seconds after a pass completes while the terminal is running. It creates no files in the application.
 
 The reader supports Python, JavaScript/TypeScript (including JSX/TSX), JSON, YAML, TOML, and project-local `.env*` files. It finds literal model/endpoint fields, conservative same-file variable and object references, environment references resolved from the nearest project-local dotenv directory, selected SDK call patterns, and enclosing function names. Unknown/private HTTP(S) endpoints remain named by their sanitized address; a custom host or port never establishes a vendor, runtime, deployment, or physical machine. Public Hub/download URLs do not establish an inference service. URLs found by this index are **never probed**; existing explicitly authorized runtime discovery remains separate.
 
@@ -74,11 +76,11 @@ The reader supports Python, JavaScript/TypeScript (including JSX/TSX), JSON, YAM
 
 The index does not execute or import project code, load shell files, inspect running processes, consult inherited shell variables, or fetch cloud accounts. It does not resolve cross-file imports, arbitrary expressions, template interpolation, configuration loading order, dynamic routers, YAML aliases, or multiline TOML values. Conditional values remain candidates; a fallback remains a fallback even if a runtime might choose it. Supported syntax is deliberately conservative. Models and task names are never inferred from prose, prompts, or model-name conventions.
 
-Reads stay within the selected directory, skipping symlinks, hidden directories, dependency/build folders, credential-named files, and request-log roots handled by the separate activity reader. Each scan visits at most 8,000 entries and eight nested directories, reads at most 400 supported files, 128 KiB per file and 4 MiB overall, and retains at most 2,000 declarations and 100 detailed coverage notes. Dotenv files are prioritized, then files are sorted by path. These bounds can leave a large repository partially indexed. Removing a declaration removes it after the next scan.
+Reads stay within the selected directory, skipping symlinks, hidden directories, dependency/build folders, credential-named files, and request-log roots handled by the separate activity reader. In published `0.1.6-preview.4`, each scan visits at most 8,000 entries and eight nested directories, reads at most 400 supported files, 128 KiB per file and 4 MiB overall, and retains at most 2,000 declarations and 100 detailed coverage notes. Dotenv files are prioritized, then files are sorted by path. These bounds can leave a large repository partially indexed. Removing a declaration removes it after the next scan.
 
 The snapshot retains selected identifiers, relative file paths, line numbers, and sanitized endpoint addresses. It discards raw source text, prompt/response fields, credentials, URL credentials, query strings, fragments, and resource paths. Known dedicated resource subdomains are redacted. Structural paths such as `/v1` or `/api/v1` may remain. Local endpoint addresses, model names, and filenames can still be sensitive; the full snapshot is intended for local viewing.
 
-To share coverage without sharing the repository or its identifiers, run this option from the project with **0.1.6-preview.4 or later**:
+To share coverage without sharing the repository or its identifiers, run this option from the project with **0.1.6**:
 
 ```sh
 openmerit dash --diagnostics
@@ -88,6 +90,22 @@ It prints only format/read/skip/declaration/issue counts and scan limits. It doe
 
 `--no-discovery` or `"discovery": false` disables the index. Request history still requires supported application logs or explicit exports. An inactive project can expose its declarations without having retained any usage history; code cannot reconstruct missing requests, tokens, latency, or spend.
 
+## Phased repository indexing
+
+Version `0.1.6` retains the `0.1.6-preview.5` behavior, which replaces the repository-wide entry, depth, file-count, total-byte, and declaration limits above with continuing batches. Versions through `0.1.6-preview.4` retain the earlier bounds.
+
+- **Open immediately:** the loopback server listens before initial collection. The browser shows “Opening your inference terminal” while sources load, without displaying empty metrics as measured zero. Initial collection failures are disclosed and retried on the next collection tick.
+- **Discover, index, link:** a dedicated worker walks eligible directories, then prioritizes dotenv files, structured configuration, and inference-related source names. The initial index publishes usable declarations in batches. The interface shows discovered files while the total is unknown, then checked/total files. Completion means the eligible-file pass finished; exclusions and unresolved syntax still appear in coverage.
+- **Keep collection independent:** saved activity and authorized runtimes continue on the existing 10–30-second interval. While indexing, the browser checks progress every second; this reads a snapshot and does not re-scan or probe endpoints. Worker progress is published at most twice per second. A pass never overlaps another pass.
+- **Reuse unchanged files:** the worker checks again 60 seconds after completing a pass. It caches sanitized parser metadata and file fingerprints in memory. Unchanged source/configuration files need only filesystem checks; changed files are read again, with a content hash avoiding a reparse when only timestamps changed. Dotenv bindings are re-read and discarded each pass. Their changes re-resolve cached call sites. Deleted, newly excluded, oversized, or unreadable files lose their old declarations after the next pass. Restarting the terminal starts a fresh cache.
+- **Stay useful while updating:** after the first pass, the previous index stays visible with an updating status until its replacement is complete. The local browser reuses its reference catalog when the revision is unchanged. The plain `/api/snapshot` response remains self-contained; during initial collection it has `loading: true` and no established measurements. Once ready, repository snapshots include `progress`, `revision`, and coverage counters. The optional `repositoryRevision` query omits `repository.references` only if that revision matches; callers must retain their matching catalog.
+
+Each worker batch yields after 32 files/entries, 1 MiB of reads, or about 40 ms between files. These are scheduling budgets, **not total coverage caps**. A single file still has a 128 KiB read limit, syntax parsing retains its complexity protections, and the detailed issue list retains 100 notes. Issue totals by code now count all notes, including those beyond the detail list. The worker has a 256 MiB old-generation heap ceiling; if it fails, the terminal explicitly marks indexing interrupted, retains any available result, and retries in 60 seconds. This is not a guarantee of unlimited repository capacity: metadata and snapshots still occupy memory. Coverage distinguishes `filesIndexed` (including cache reuse) from `filesRead` and `bytesRead` on the current pass. Policy exclusions, supported syntax, and the absence of cross-file expression evaluation are unchanged.
+
+Nothing is written into the application, and no persistent index or source-content cache is created. Endpoint identities are sanitized before entering the in-memory cache. Static URLs still never trigger network calls. `--json` and `--diagnostics` deliberately wait for a complete one-shot pass and then exit; `--no-discovery` disables this worker.
+
+These changes apply to **repository declarations only**. The separate request-log, runtime, hardware-export, and configuration-inventory limits elsewhere in this guide still apply. They do not recover missing historical usage or make a log importer unlimited.
+
 ## Review corrections (0.1.6-preview.3)
 
 Version `0.1.6-preview.3` includes the following corrections; earlier previews retain their previous behavior:

package/docs/operations.md

@@ -10,7 +10,7 @@ Operational data lives under `.openmerit/` in the target product repository. It
 - `audit-export-errors.jsonl` — failures from optional external event exporters; these failures never replace or erase the canonical local event.
 - `evidence/*.json` — evidence-reference manifests.
 - `scheduler-status.json` — last headless wakeup time and exit code in the unreleased macOS source implementation, when a wakeup actually ran.
-- `terminal.json` — optional source configuration and declared inventory for the unreleased Inference Terminal.
+- `terminal.json` — optional source configuration and declared inventory for the Inference Terminal included in `0.1.6`.
 - `inference.jsonl` — optional request-metadata export supplied by your existing tools for the terminal. The terminal reads this file; it does not instrument your application or create the feed.
 
 Snapshot writes are atomic. Files use owner-only permissions where POSIX modes are supported.

package/docs/security.md

@@ -28,10 +28,14 @@ OpenMerit validates structure and deterministic Pareto conformance, not the trut
 
 Do not include credentials, private traces, or proprietary evaluation data in public issues.
 
-## Inference Terminal (preview)
+## Inference Terminal (0.1.6)
 
-The preview terminal reads selected project metadata, bounded loopback runtime inventory/metrics endpoints, and whole-machine CPU and memory. It calls no inference endpoint and exposes no mutation API. Default discovery reads only the project's `.env`, `.env.local`, `package.json`, and `requirements.txt`, with per-file bounds and project containment after symlink resolution. It never executes those files or expands expressions. Known credential-variable presence can identify a configured provider; credential contents are neither retained, returned, nor used for provider calls. Only safe loopback origins and recognized service identity metadata survive projection.
+The terminal reads supported project metadata, request logs, explicit exports, and authorized loopback runtime inventory/metrics endpoints. It calls no inference endpoint and exposes no mutation API. A local syntax index reads supported Python, JavaScript/TypeScript, JSON, YAML, TOML, and project-local dotenv declarations. It does not execute or import project code, source shell files, or resolve arbitrary expressions. Known credential-variable presence can identify configuration; credential values are discarded and never used for provider calls. Endpoint addresses are sanitized before retention. Static URLs found by the syntax index never authorize network probes.
 
-Coding-harness histories are outside the terminal’s application scope and are not scanned or imported. The retired Pi history reader and access prompts are removed; legacy grants in `~/.openmerit/terminal-access.json` are never consulted. Application request logs and explicit exports retain only allowlisted metadata. Sources must belong to the selected application; the terminal cannot infer the purpose of an unlabeled API response. Records explicitly marked `scope: "development"` are rejected.
+Loopback runtime probes require supported project endpoint declarations or explicit terminal configuration. No standard ports, remote provider accounts, credential stores, running processes, or general home directories are scanned. Whole-machine readings are context, not per-request measurements; the compute view requires explicit links or supplied host evidence.
 
-The local web service binds to `127.0.0.1` and rejects unexpected Host, Origin, and cross-site browser requests. It only serves bundled assets and specific read-only JSON routes. It is not authenticated against other local processes or machine users. Names and identifiers in imported metadata must still be kept free of secrets. Usage caches disappear when the process exits. Legacy history permission files are left untouched but have no effect. No cloud usage APIs, credential stores, arbitrary source-tree indexing, process inspection, or general home-directory scans are performed. See [terminal data handling and limits](inference-terminal.md) for supported sources, precedence, retention bounds, and sample-data separation.
+Coding-harness histories are outside the terminal's application scope and are not scanned or imported. The retired Pi history reader and access prompts are removed; legacy grants in `~/.openmerit/terminal-access.json` are never consulted. Application request logs and explicit exports retain only allowlisted metadata, without prompts or responses. Sources must belong to the selected application; the terminal cannot infer the purpose of an unlabeled API response. Records explicitly marked `scope: "development"` are rejected.
+
+The local web service binds to `127.0.0.1` and rejects unexpected Host, Origin, and cross-site browser requests. It only serves bundled assets and specific read-only JSON routes. It is not authenticated against other local processes or machine users. Model names, endpoint identifiers, and relative source paths can still be sensitive. Names and identifiers in imported metadata must be kept free of secrets.
+
+Repository metadata and usage caches live in process memory and disappear when the terminal exits. The terminal creates no persistent index or files in the application. Per-file/parser protections, request-log read limits, runtime inventory limits, and explicit coverage gaps still apply. See [terminal data handling and limits](inference-terminal.md) for supported sources, precedence, retention bounds, diagnostics, and sample-data separation.

package/docs/site-faq-maintenance.md

@@ -166,3 +166,25 @@ Reviewed data handling, evidence, background collection, and readiness claims. T
 ## Repository index release preparation — 10 October 2026
 
 Prepared `0.1.6-preview.4` to deliver repository indexing and counts-only diagnostics through the existing npm preview channel. The public guide identifies the minimum version and retains the boundaries on static references, recorded usage, supported syntax, and bounded scans. Registry publication and registry-install verification are pending. The VM source-build acceptance retained the existing 242 records; a separate real HF smoke workload added three successful requests and one credit-related failure. Its provider and route metadata were explicitly logged by the test application, not reconstructed from network traffic. Stable-package homepage FAQ claims remain unchanged; no website deployment is included.
+
+
+## Repository index — published preview.4, 10 October 2026
+
+Published and verified `0.1.6-preview.4`, superseding the unreleased/preparation status above. The npm package integrity matches the tested archive and `preview` points to this version. Direct registry installation and the restarted VM dashboard preserve all 246 real request records and 128 application files across passive refresh, with counts-only diagnostics and package-export checks passing. The release acceptance makes no inference calls; the separate earlier HF test supplied its provider/route identifiers explicitly. Static declarations remain distinct from actual usage. Stable `latest` is still `0.1.5`; homepage FAQ wording and site deployments are unchanged.
+
+
+## Phased repository indexing — unreleased source, 10 October 2026
+
+Reviewed startup, background collection, data handling, coverage and readiness claims. The source build opens the local dashboard before initial collection and indexes declarations in a dedicated worker. Repository-wide coverage limits become continuing batch budgets; per-file and parser protections remain, along with a worker memory ceiling. Fingerprints and sanitized parser metadata live only in process memory; no project files or persistent source cache are created. Rechecks start 60 seconds after a completed pass, while request/runtime collection keeps its existing interval and limits. Progress and failures remain explicit. The guide separates this unreleased behavior from published preview.4. No homepage FAQ wording, npm publication, or site deployment is implied.
+
+
+## Phased indexing release preparation — 10 October 2026
+
+Prepared `0.1.6-preview.5` for the existing npm preview channel. The source build passed all 281 verification tests. A separate 5,001-file synthetic repository on the four-core, 4 GiB VM exposed 25,001 references: URL ready in 43 ms, first declarations at about 1 second, full index at 4.1 seconds. An edit/deletion pass reused 4,998 files, read about 9 KiB, and completed in 1.27 seconds. These are fixture measurements, not a universal performance guarantee. The private VM source build preserved all 246 real request records and all 128 application files through passive refresh. Registry publication and installation verification are pending. The guide identifies behavior by minimum version; stable `latest`, homepage FAQ claims, and site deployments are unchanged.
+
+
+## npm default-channel release preparation — 11 October 2026
+
+Prepared `0.1.6` using the unchanged runtime code from npm `0.1.6-preview.5`. The packaged README, terminal install guide, command entry, architecture/operations references, and terminal security boundaries now describe the default npm installation. Registry publication remains pending release verification and authentication.
+
+Reviewed homepage evidence, data, background, cost, and readiness claims. The terminal remains passive, requires recorded evidence for usage, does not call models or perform routing/evaluations, and stops when the command exits. Indexing is explicitly local and syntax-limited. Its availability in the default npm package does not establish the complete OpenMerit product vision or measured optimization results. Pi coordinator behavior is unchanged from the preview; existing version-specific `0.1.5` caveats are historical. This is an npm-only release: repository branches, the website, and its separately deployed documentation are not changed or deployed. The npm README points to the bundled terminal guide for this version's behavior.

package/docs/site-terminal-preview.md

@@ -134,3 +134,16 @@ After publication, the VM updated directly with `npm install -g openmerit@previe
 Friends can update with `npm install -g openmerit@preview`, stop any running terminal, and run `openmerit dash` again from their application directory. The main website and hosted sample were not deployed. The source branch remains `codex/inference-terminal-preview`; this is a preview release, not a stable-channel release or a claim of universal log compatibility.
 
 Evidence: `/private/tmp/terminal-preview3-release/verify.log`, `pack.json`, `registry.json`, `tags.json`, `tarball-vm.json`, and `registry-vm.json`. Publication screenshot: `/private/tmp/terminal-preview3-release/npm-published.png`.
+
+
+### Repository index — npm preview release, 10 October 2026
+
+Published source commit `38d294f` as `openmerit@0.1.6-preview.4` under the `preview` dist-tag. The 103-file package is 1,080,626 bytes, with SHA-1 `f5217dc0e49f89cb48c129d65cd046443667a56a`. npm registry SHA-512 integrity matches the exact tested tarball. Availability and the preview tag were verified after npm processing; stable `latest` remains `0.1.5`. The release adds bounded repository syntax indexing, nested configuration and custom endpoint references, file/line evidence, and counts-only diagnostics. Static declarations remain distinct from recorded usage.
+
+Full release verification passed 272 tests (162 terminal tests) plus syntax, typecheck, build, demo, and documentation checks. Before publication, the exact release tarball was installed in an isolated VM prefix and passed plain `openmerit dash`, a passive refresh, diagnostics, package-export imports, and installed/served asset hashes. It preserved all 246 request records and all 128 application files.
+
+After publication, the VM updated from the registry using `npm install -g openmerit@preview` with sudo for its existing root-owned prefix. Installation completed in 14 seconds; plain `openmerit dash` started in 306 ms. The temporary source-build service override was moved to the VM release evidence directory, restoring the original `/usr/local/bin/openmerit` service command. The persistent dashboard at `http://127.0.0.1:4313/` passed the same checks across a passive refresh. All 246 request records remained deeply equal and all 128 application files stayed unchanged. The four HF records retain three completed requests, one prior credit failure, 99 input tokens, and 30 output tokens. Those calls were made by a separate test application before release acceptance; the application explicitly logged its provider/route metadata. Installation and acceptance generated no new inference calls.
+
+Friends can update with `npm install -g openmerit@preview`, stop the running terminal, and launch `openmerit dash` again in the application directory. This verifies the saved VM workload and supported source patterns; it does not establish complete discovery of arbitrary applications or reconstruct missing usage. The hosted sample and main website were not deployed.
+
+Evidence: `/private/tmp/terminal-preview4-release/verify.log`, `pack.json`, `build.json`, `registry.json`, `tags.json`, `tarball-vm.json`, `registry-vm.json`, and `persistent-vm.json`. Publication screenshot: `/private/tmp/terminal-preview4-release/npm-published.png`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmerit",
-  "version": "0.1.6-preview.4",
+  "version": "0.1.6",
   "description": "Evidence-driven model decisions for coding harnesses.",
   "type": "module",
   "bin": {