planr 1.7.1 → 1.7.2

package/README.md

@@ -174,6 +174,7 @@ The watcher is likewise a human-only observer. It defaults to the condensed diag
 
 ## What's new
 
+- **1.7.2 — Reproducible release candidates:** Locked the pnpm workspace inventory, made external eval fixtures self-contained, refreshed reviewed workflow runtimes, and made all four published architectures execute the exact tagged version before upload. Model-backed evaluation remains a local, candidate-bound maintainer gate; this patch makes no unmeasured speed or quality claim. See the [1.7.2 changelog](CHANGELOG.md#172---2026-07-25) and [release guidance](https://planr.so/docs/operations/release).
 - **1.7.1 — Leaner agent guidance and safer local releases:** Slimmed the hot-path Planr skills while preserving their execution and review contracts, moved maintainer benchmark inputs and results outside the public repository, added a fail-closed local release-evidence gate without API keys in CI, and verified the optional external Switchloom v0.3.2 integration. The public 1.7 eval CLI remains available in this patch. See the [1.7.1 changelog](CHANGELOG.md#171---2026-07-25) and [release guidance](https://planr.so/docs/operations/release).
 - **1.7.0 — Evidence-backed evaluations:** Added durable eval suites, runs, comparisons, invalidation and rescoring, correctness/quality/performance gates, cost per verified success, and effort recommendations. The complete workflow is available through the CLI; MCP only mirrors selected surfaces and is optional. Security gates now cover repository leaks, vulnerable dependencies, workflow hardening, privacy, and forbidden staged files. See the [Eval Contract](docs/contracts/EVAL_CONTRACT_V1.md), [CLI Reference](https://planr.so/docs/reference/cli), and the [1.7.0 changelog](CHANGELOG.md#170---2026-07-22).
 - **1.6.0 — Human map observation:** Added a condensed boxed diagram, live two-terminal watching, accessible state colors, and clearer satisfied dependency routes. These views are intentionally for human supervision; agents keep using the default tree or JSON snapshots. See [Task Graph Model](https://planr.so/docs/concepts/graph-and-readiness), [CLI Reference](https://planr.so/docs/reference/cli), and the [1.6.0 changelog](CHANGELOG.md#160---2026-07-21).

package/docs/RELEASE.md

@@ -16,8 +16,14 @@ Published npm versions bundle platform-native binaries; see <https://planr.so/do
 
 `scripts/release.sh` is the only supported release path. The version lives in
 `Cargo.toml`; `package.json`, both plugin manifests under `plugins/planr/`, and
-`.cursor-plugin/plugin.json` must match it. Manual tagging skips this sync and
-ships stale versions.
+`.cursor-plugin/plugin.json` must match it. Generated CLI and MCP references
+must match the currently committed version before the release branch merges.
+After bumping on clean `main`, the script refreshes pnpm's derived workspace
+metadata with the frozen lockfile and rejects any lockfile byte change. It then
+builds, regenerates, and strictly checks both references before staging them in
+the same atomic release commit as the six synchronized version files. Manual
+tagging or pre-generating a future version skips this ownership boundary and
+can ship stale references.
 
 ```bash
 export PLANR_RELEASE_EVAL_SUITE="$HOME/projects/planr-evals/suites/planr-lean-skills-dogfood.suite.json"
@@ -36,6 +42,11 @@ candidate-revision digests, and creation/expiry timestamps. Prompts,
 completions, credentials, personal paths, raw runs, reports, databases, and the
 receipt itself are never committed to Planr.
 
+Fixture paths inside the private suite resolve relative to the suite file's
+directory. The external eval workspace must therefore contain its complete
+fixture tree; release verification does not read ignored files from the Planr
+checkout.
+
 Generate the candidate revision with
 `node scripts/verify-release-eval-receipt.mjs --print-candidate-revision`. At
 release time the candidate binary canonicalizes the explicitly supplied suite,
@@ -48,10 +59,12 @@ effective-treatment proof.
 The script enforces, in order:
 
 1. branch is `main`, worktree is clean, `CHANGELOG.md` already has a committed `## [x.y.z]` section, and the tag does not exist;
-2. the version is written into all synchronized manifests plus `Cargo.lock`;
-3. the candidate binary validates the sanitized receipt, observed effective treatment, candidate binding, and existing Planr comparison/gate before any Git mutation;
-4. deterministic gates: `cargo test` (including manifest drift), `npm pack --dry-run`, and `scripts/security-local.sh` (betterleaks + trivy);
-5. one mechanical commit `release x.y.z: <summary>`, an annotated `vx.y.z` tag carrying that summary, and a single push of branch plus tag.
+2. the version is written into all synchronized manifests;
+3. `pnpm install --frozen-lockfile` refreshes installed workspace metadata, and any `pnpm-lock.yaml` byte change stops the release before build, references, gates, or Git mutation;
+4. the build synchronizes `Cargo.lock`, and the bumped candidate regenerates and strictly verifies both generated references before any later gate or Git mutation;
+5. the candidate binary validates the sanitized receipt, observed effective treatment, candidate binding, and existing Planr comparison/gate before any Git mutation;
+6. deterministic gates: `cargo test` (including manifest drift), `npm pack --dry-run`, and `scripts/security-local.sh` (betterleaks + trivy);
+7. one mechanical commit containing the six version files plus both generated references, an annotated `vx.y.z` tag carrying that summary, and a single push of branch plus tag.
 
 Two independent gates back the script:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "planr",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "Local-first planning and execution coordination for coding agents.",
   "license": "MIT",
   "repository": {
@@ -25,7 +25,10 @@
     "security:staged": "node scripts/hooks/block-forbidden-staged-files.mjs",
     "build:native": "cargo build --release",
     "test": "cargo test",
+    "verify:github-actions": "node scripts/verify-github-actions.mjs && node scripts/test-verify-github-actions.mjs",
+    "verify:pnpm-workspace": "node scripts/verify-pnpm-workspace.mjs",
     "verify:release-eval-gate": "node scripts/test-release-eval-gate.mjs",
+    "verify:release-script": "node scripts/test-release-script.mjs",
     "pack:check": "npm pack --dry-run",
     "docs:dev": "pnpm --filter @planr/docs dev",
     "docs:alchemy:dev": "pnpm --filter @planr/docs alchemy:dev",

package/plugins/planr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "planr",
   "description": "Skill-driven planning and execution loop for coding agents: one planr entry point, an autonomous planr-loop, and evidence-backed task graph skills powered by the planr CLI.",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "author": {
     "name": "instructa"
   },

package/plugins/planr/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "planr",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "Skill-driven planning and execution loop for coding agents: one $planr entry point, an autonomous $planr-loop, and evidence-backed task graph skills powered by the planr CLI.",
   "author": {
     "name": "instructa",