pentesting 0.100.11 → 0.100.13

package/ARCHITECTURE.md

@@ -422,10 +422,14 @@ Compilation is outside the application runtime boundary and is always executed
 through resource-capped Docker wrappers. Host Cargo is not an emergency
 fallback. `dbuild.sh` owns individual Cargo commands, `dverify.sh` owns
 sequential gate profiles, and `dbuild-image.sh` owns BuildKit. Each path shares
-storage admission, effective-limit inspection, a machine-wide lock, watchdogs,
-and structured failure reports. Automated CI/CD is disabled; maintainers invoke
-these wrappers explicitly. The
-normative contract is [Docker-only build safety](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILD_SAFETY.md).
+storage admission, effective-limit inspection, a machine-wide lock, watchdogs,
+and structured failure reports. Automated CI/CD is disabled; maintainers invoke
+these wrappers explicitly. The
+normative contract is [Docker-only build safety](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILD_SAFETY.md).
+
+Patch publication performs one Cross build. The version-checked, checksummed
+AMD64 musl artifact is uploaded to GitHub and packaged into Docker from a
+minimal context; its dependency cache stays in a versioned Docker volume.
 
 The measured next-stage simplification and deletion plan is indexed at
 [Minimal Core plan](https://github.com/agnusdei1207/pentesting/blob/main/docs/plans/2026/07/10/minimal-core/README.md).

package/README.md

@@ -80,9 +80,12 @@ powershell -NoProfile -ExecutionPolicy Bypass -File scripts/dbuild.ps1 test -p b
 powershell -NoProfile -ExecutionPolicy Bypass -File scripts/nverify.ps1                  # Windows npm verify
 ```
 
-The wrappers cap memory, CPU, PIDs, jobs, test threads, and time; verify storage
-before launch; serialize resource-intensive work; and leave a redacted resource
-report. Automated CI/CD is disabled. Full policy: [Docker-only build safety](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILD_SAFETY.md).
+The wrappers cap memory, CPU, PIDs, jobs, test threads, and time; verify storage
+before launch; serialize resource-intensive work; and leave a redacted resource
+report. Automated CI/CD is disabled. Full policy: [Docker-only build safety](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILD_SAFETY.md).
+
+Patch releases compile once, verify the binary version and SHA-256, and reuse
+that same AMD64 artifact for GitHub and Docker publication.
 
 ### 🐳 Run with Docker
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pentesting",
-  "version": "0.100.11",
-  "builderReleaseTag": "v0.100.11",
+  "version": "0.100.13",
+  "builderReleaseTag": "v0.100.13",
   "description": "pentesting — coding agent runtime with audited reverse-shell capture, verified PTY session upgrades, pivot control, evidence transcripts, and safe session reclamation.",
   "license": "MIT",
   "author": "agnusdei1207",