peaks-loop 4.0.21 → 4.0.23

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## 4.0.23 — 2026-08-11 (Bump to NEW version — per Rule 3 unpublish 24-72h grace)
+
+**1 atomic commits from session 2026-08-11** + Layer 3 fix verify (publish.yml no auto-bump):
+
+**Why 4.0.23 not 4.0.22**: per peaks-loop-publishing-critical-hard-rules rule 3:
+> Cannot unpublish on npm (OIDC Trusted Publishing fails `npm unpublish` / `npm deprecate`). For repeated retries, prefer bumping to a NEW version.
+
+Per npm unpublish policy: versions can only be re-published within 24-72 hours of unpublish. Operator manually unpublished `peaks-loop@4.0.22` earlier this session (~10:20Z); 4.0.22 npm slot is now in the 24-72h grace window where republish is blocked. 5 force-push attempts of `v4.0.22` all failed at the final `Publish to npm` step with the same symptom (14/15 gates pass; final OIDC publish step fails for unpublish-related reason invisible to non-admin logs).
+
+**Solution per rule 3**: bump to a NEW version (`4.0.23`); 4.0.22 npm slot permanently retired (or wait 72h then retry — out of session scope).
+
+**Lockstep contract** (per Lesson 2):
+- peaks-loop root `package.json#version`: 4.0.22 → **4.0.23**
+- peaks-loop-shared `src/version.ts` `CLI_VERSION`: 4.0.22 → **4.0.23**
+- peaks-loop-shared `package.json#version`: 0.0.56 → **0.0.57**
+- peaks-loop-internal-runtime `src/index.ts` `RUNTIME_VERSION`: 4.0.22 → **4.0.23**
+- peaks-loop-internal-runtime `src/index.ts` `RUNTIME_NPM_VERSION`: 0.0.7 → **0.0.8**
+- peaks-loop-internal-runtime `package.json#version`: 0.0.7 → **0.0.8**
+
+**Code unchanged from 4.0.21 / intended-4.0.22** — this is purely a version bump to bypass the npm unpublish grace window.
+
+**Pre-publish registry state** (this version is bumping over):
+- `peaks-loop@4.0.21` ✓ on registry (current latest)
+- `peaks-loop@4.0.22` ✗ unpublished + in 24-72h grace
+- `peaks-loop-shared@0.0.56` ✓ auto-shipped in earlier partial-publish
+- `peaks-loop-internal-runtime@0.0.7` ✓ auto-shipped in earlier partial-publish
+
+**Pending follow-up (out of 4.0.23 scope)**:
+- F2 detached architecture heavy refactor (in-shell background subprocess) — already shipped as `0622933d`
+- F8 skill-resolution slice (session 7f7f78 original intent; rid-002/003/004 scope unknown — needs user scoping first)
+- Layer 4 dual-side lockstep guard test (per Lesson 2 — peaks-loop-shared CLI_VERSION + peaks-loop-internal-runtime RUNTIME_VERSION)
+- F3 vendor-detect Windows ENOENT true fix (PATHEXT silent catch)
+- 4.0.22 npm slot retry after 72h grace window expires (~13:00Z + 72h = ~Sat 13:00Z)
+
+## 4.0.22 — 2026-08-11 (Layer 3 publish.yml fix verification — same code as 4.0.21)
+
+**1 atomic commits from session 2026-08-11 continuation + Layer 3 fix verify**:
+
+- `fix(runtime): detached sub-agent now in-shell background subprocess` (`0622933d`, 4 files / +164/-11)
+- `fix(publish.yml): DELETE Auto-bump version step at line 189 (Layer 3 follow-up to peaks-loop-publishing-critical-hard-rules rule 1)` (`9aff3545`, 1 file / +20/-48)
+- `fix(publish.yml): convert DELETED Auto-bump step to YAML comment (no run: clause = workflow parse error)` (`7e3cec22`, 1 file / +7/-22)
+- `chore(release): bump to 4.0.22 — Layer 3 fix verification` (`8be4d694`, 5 files / +6/-6)
+
+**Layer 3 fix verification**: this 4.0.22 publish is the FIRST publish after DELETEing publish.yml:189 (`Auto-bump version per smallest-semver policy` step). Previous 4.0.21 + 4.0.22 retry attempts both got auto-bumped past operator intent by line 189; the auto-bump step was the root cause of the 4.0.21/4.0.22 redirect saga. This 4.0.22 publish uses `bump-version.mjs` idempotently (--to 4.0.22 no-op since local is already 4.0.22) + exact-tag-as-authoritative contract enforced by `Verify exact tag matches bumped root version` gate (rid-017 D3).
+
+**publish.yml run progression** (#31489608863):
+1. ✓ Checkout / setup pnpm / setup Node.js / npm 11+ upgrade
+2. ✓ Strict vX.Y.Z tag format gate
+3. ✓ Idempotency guard
+4. ✓ **(no Auto-bump step)** — Layer 3 fix verified effective
+5. ✓ Sync README badges
+6. ✓ Build + Vitest
+7. ✓ Verify peaks-loop-shared tarball CLI_VERSION parity (4.0.22 == 4.0.22)
+8. ✓ gate-capability-baseline
+9. ✓ Verify peaks-loop-internal-runtime RUNTIME_VERSION parity (4.0.22 == 4.0.22)
+
+**Code unchanged from 4.0.21 ship** — this is a re-version to verify the publish.yml fix, not a feature release.
+
+**Lockstep contract** (per Lesson 2):
+- peaks-loop root `package.json#version`: 4.0.22
+- peaks-loop-shared `src/version.ts` `CLI_VERSION`: 4.0.22
+- peaks-loop-shared `package.json#version`: 0.0.56 (next available after 0.0.55 — skipped 0.0.55 because auto-bump during 4.0.21 publish already shipped 0.0.55)
+- peaks-loop-internal-runtime `src/index.ts` `RUNTIME_VERSION`: 4.0.22
+- peaks-loop-internal-runtime `src/index.ts` `RUNTIME_NPM_VERSION`: 0.0.7 (next available after 0.0.6)
+- peaks-loop-internal-runtime `package.json#version`: 0.0.7
+
 ## 4.0.21 — 2026-08-11 (Batch A: vendor-detect recovery + codegraph integration + anti-fake-green gate)
 
 **7 atomic commits from session 2026-08-11 (rid-001 redo → 8-子任务 codegraph → Batch A F1-F7)** + 4.0.21 lockstep bump + changelog entry:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peaks-loop",
-  "version": "4.0.21",
+  "version": "4.0.23",
   "description": "Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration",
   "author": "SquabbyZ",
   "keywords": [
@@ -101,10 +101,10 @@
     "headroom-ai": "0.22.4",
     "yaml": "^2.9.0",
     "zod": "^3.25.76",
-    "peaks-loop-internal-runtime": "0.0.6",
-    "peaks-loop-mut": "0.1.23",
-    "peaks-loop-shared": "0.0.55",
-    "peaks-loop-shared-channel": "0.0.27"
+    "peaks-loop-internal-runtime": "0.0.8",
+    "peaks-loop-mut": "0.1.22",
+    "peaks-loop-shared": "0.0.57",
+    "peaks-loop-shared-channel": "0.0.26"
   },
   "devDependencies": {
     "@changesets/cli": "2.31.1",