planr 1.7.1 → 1.7.3

package/README.md

@@ -44,6 +44,15 @@ Or with the release installer:
 curl -fsSL https://raw.githubusercontent.com/instructa/planr/main/scripts/install.sh | sh
 ```
 
+<!-- planr:linux-release-portability:start surface=README schema=1 -->
+> **Linux release portability — corrected**
+>
+> Contract state: `status=corrected`; `affectedThrough=v1.7.2`; `correctedFrom=v1.7.3`.
+> Published Linux release, installer, and npm binaries through v1.7.2 require GLIBC_2.39; macOS is unaffected.
+> Starting with v1.7.3, current Linux release, installer, and npm artifacts are static-musl executables and do not require glibc.
+> On an affected Linux release, build from source on the target distribution or upgrade to v1.7.3.
+<!-- planr:linux-release-portability:end surface=README schema=1 -->
+
 Then initialize a project. When selected, Claude Code and Cursor also receive standalone project worker/reviewer roles; Codex workflow skills come from its plugin:
 
 ```bash
@@ -174,6 +183,7 @@ The watcher is likewise a human-only observer. It defaults to the condensed diag
 
 ## What's new
 
+- **1.7.2 — Reproducible release candidates:** Locked the pnpm workspace inventory, made external eval fixtures self-contained, refreshed reviewed workflow runtimes, and made all four published architectures execute the exact tagged version before upload. Model-backed evaluation remains a local, candidate-bound maintainer gate; this patch makes no unmeasured speed or quality claim. See the [1.7.2 changelog](CHANGELOG.md#172---2026-07-25) and [release guidance](https://planr.so/docs/operations/release).
 - **1.7.1 — Leaner agent guidance and safer local releases:** Slimmed the hot-path Planr skills while preserving their execution and review contracts, moved maintainer benchmark inputs and results outside the public repository, added a fail-closed local release-evidence gate without API keys in CI, and verified the optional external Switchloom v0.3.2 integration. The public 1.7 eval CLI remains available in this patch. See the [1.7.1 changelog](CHANGELOG.md#171---2026-07-25) and [release guidance](https://planr.so/docs/operations/release).
 - **1.7.0 — Evidence-backed evaluations:** Added durable eval suites, runs, comparisons, invalidation and rescoring, correctness/quality/performance gates, cost per verified success, and effort recommendations. The complete workflow is available through the CLI; MCP only mirrors selected surfaces and is optional. Security gates now cover repository leaks, vulnerable dependencies, workflow hardening, privacy, and forbidden staged files. See the [Eval Contract](docs/contracts/EVAL_CONTRACT_V1.md), [CLI Reference](https://planr.so/docs/reference/cli), and the [1.7.0 changelog](CHANGELOG.md#170---2026-07-22).
 - **1.6.0 — Human map observation:** Added a condensed boxed diagram, live two-terminal watching, accessible state colors, and clearer satisfied dependency routes. These views are intentionally for human supervision; agents keep using the default tree or JSON snapshots. See [Task Graph Model](https://planr.so/docs/concepts/graph-and-readiness), [CLI Reference](https://planr.so/docs/reference/cli), and the [1.6.0 changelog](CHANGELOG.md#160---2026-07-21).

package/docs/RELEASE.md

@@ -12,12 +12,26 @@ The v1 repository-owned public install order is:
 
 Published npm versions bundle platform-native binaries; see <https://planr.so/docs/operations/release>.
 
-## Version Bump
+## Candidate and publication
+
+`scripts/prepare-release-candidate.sh` is the only supported version-transition
+path. Run it from clean, reviewed source on a release branch. It synchronizes
+`Cargo.toml`, `Cargo.lock`, `package.json`, both plugin manifests under
+`plugins/planr/`, `.cursor-plugin/plugin.json`, and the generated CLI/MCP
+references. It never stages, commits, tags, pushes, or publishes. Commit those
+changes with the changelog and any release-contract transition, then run the
+full candidate verification and independent review on that exact commit.
+
+`scripts/release.sh` is the only supported publication path. It runs on clean
+`main`, requires every version and generated reference to already match the
+requested version, reruns the local eval and deterministic gates, and rejects
+any command that changes the reviewed source. Only then does it create and push
+the annotated tag. Editing manifests by hand or publishing an unprepared commit
+skips this ownership boundary.
 
-`scripts/release.sh` is the only supported release path. The version lives in
-`Cargo.toml`; `package.json`, both plugin manifests under `plugins/planr/`, and
-`.cursor-plugin/plugin.json` must match it. Manual tagging skips this sync and
-ships stale versions.
+```bash
+scripts/prepare-release-candidate.sh 1.2.0
+```
 
 ```bash
 export PLANR_RELEASE_EVAL_SUITE="$HOME/projects/planr-evals/suites/planr-lean-skills-dogfood.suite.json"
@@ -36,6 +50,11 @@ candidate-revision digests, and creation/expiry timestamps. Prompts,
 completions, credentials, personal paths, raw runs, reports, databases, and the
 receipt itself are never committed to Planr.
 
+Fixture paths inside the private suite resolve relative to the suite file's
+directory. The external eval workspace must therefore contain its complete
+fixture tree; release verification does not read ignored files from the Planr
+checkout.
+
 Generate the candidate revision with
 `node scripts/verify-release-eval-receipt.mjs --print-candidate-revision`. At
 release time the candidate binary canonicalizes the explicitly supplied suite,
@@ -45,13 +64,16 @@ stored baseline/candidate/policy identities, and gates that fresh result.
 Requested-only values and policy or binding metadata are never
 effective-treatment proof.
 
-The script enforces, in order:
+The two scripts enforce, in order:
 
-1. branch is `main`, worktree is clean, `CHANGELOG.md` already has a committed `## [x.y.z]` section, and the tag does not exist;
-2. the version is written into all synchronized manifests plus `Cargo.lock`;
-3. the candidate binary validates the sanitized receipt, observed effective treatment, candidate binding, and existing Planr comparison/gate before any Git mutation;
-4. deterministic gates: `cargo test` (including manifest drift), `npm pack --dry-run`, and `scripts/security-local.sh` (betterleaks + trivy);
-5. one mechanical commit `release x.y.z: <summary>`, an annotated `vx.y.z` tag carrying that summary, and a single push of branch plus tag.
+1. candidate preparation starts from a clean worktree and a nonexistent tag;
+2. the candidate version is written into all synchronized manifests;
+3. frozen workspace synchronization cannot change `pnpm-lock.yaml`;
+4. the candidate build synchronizes `Cargo.lock`, then regenerates and strictly checks both references without Git mutation;
+5. candidate source, changelog, contracts, and generated files are committed and independently reviewed before publication approval;
+6. publication requires clean `main`, the exact prepared versions/references, a committed changelog section, and no existing tag;
+7. the candidate binary validates the sanitized receipt and recomputed comparison, then deterministic tests, package, and security gates run without changing source;
+8. publication creates and pushes only the annotated `vx.y.z` tag for that reviewed commit.
 
 Two independent gates back the script:
 
@@ -83,8 +105,19 @@ Only `-alpha.N`, `-beta.N`, and `-rc.N` suffixes are accepted; everything else t
 
 Pushing a tag `vX.Y.Z` runs `.github/workflows/release.yml`:
 
+<!-- planr:linux-release-portability:start surface=maintainerRelease schema=1 -->
+> **Linux release portability — corrected**
+>
+> Contract state: `status=corrected`; `affectedThrough=v1.7.2`; `correctedFrom=v1.7.3`.
+> Published Linux release, installer, and npm binaries through v1.7.2 require GLIBC_2.39; macOS is unaffected.
+> Starting with v1.7.3, current Linux release, installer, and npm artifacts are static-musl executables and do not require glibc.
+> On an affected Linux release, build from source on the target distribution or upgrade to v1.7.3.
+<!-- planr:linux-release-portability:end surface=maintainerRelease schema=1 -->
+
+When this contract changes, update `docs/contracts/LINUX_RELEASE_PORTABILITY.json`, run `pnpm docs:sync-linux-portability`, and commit every synchronized notice before running the release gates.
+
 1. `create-release` verifies the tag against `Cargo.toml`, all distribution manifests, and the changelog section, then creates a draft GitHub Release.
-2. `build` compiles and packages `planr-<os>-<arch>.tar.gz` for `darwin-arm64`, `darwin-x86_64`, `linux-x86_64`, and `linux-arm64`, then uploads each asset to the draft release.
+2. `build` compiles and packages `planr-<os>-<arch>.tar.gz` for `darwin-arm64`, `darwin-x86_64`, `linux-x86_64`, and `linux-arm64`, then uploads each asset to the draft release. Future Linux candidates use native x86_64/arm64 GitHub runners and the same digest-pinned Rust 1.90.0 Alpine/musl image. Before upload, the extracted tarball must pass embedded checksums, static ELF checks (no interpreter, shared-library dependency, or glibc symbol), a fresh project/plan/map/pick/done/export lifecycle in digest-pinned Alpine 3.20.8 with networking disabled, and exact-byte npm wrapper execution.
 3. `finalize` downloads all uploaded assets, writes one aggregated `SHA256SUMS` covering every tarball, uploads it, and publishes the release.
 4. `npm-publish` downloads the release assets, verifies them against `SHA256SUMS`, bundles the four platform binaries into `npm/native/`, smoke-tests the wrapper, and publishes to npm via Trusted Publishing (OIDC). Runs only when the repository variable `NPM_PUBLISH_ENABLED` is `true`; requires the one-time Trusted Publisher setup described at <https://planr.so/docs/operations/release>.
 5. `homebrew-tap` regenerates `Formula/planr.rb` with `scripts/generate-formula.sh` and pushes it to `instructa/homebrew-tap` (installed as `brew install instructa/tap/planr`).
@@ -109,6 +142,11 @@ scripts/security-local.sh
 ```
 
 The external consumer E2E suite must pass when available on the release machine.
+Pull-request CI separately builds both Linux architectures through the canonical
+containerized release script, runs the full portability contract without
+secrets or publication permissions, and aggregates checksums for the exact two
+candidate tarballs. A same-runner `--version` smoke is useful architecture
+evidence but is not Linux compatibility proof by itself.
 
 ## Build Artifact
 

package/docs/contracts/LINUX_RELEASE_PORTABILITY.json

@@ -0,0 +1,9 @@
+{
+  "affectedReleases": [
+    "1.7.2"
+  ],
+  "affectedThrough": "1.7.2",
+  "correctedFrom": "1.7.3",
+  "noticeSchema": 1,
+  "status": "corrected"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "planr",
-  "version": "1.7.1",
+  "version": "1.7.3",
   "description": "Local-first planning and execution coordination for coding agents.",
   "license": "MIT",
   "repository": {
@@ -25,7 +25,10 @@
     "security:staged": "node scripts/hooks/block-forbidden-staged-files.mjs",
     "build:native": "cargo build --release",
     "test": "cargo test",
+    "verify:github-actions": "node scripts/verify-github-actions.mjs && node scripts/test-verify-github-actions.mjs",
+    "verify:pnpm-workspace": "node scripts/verify-pnpm-workspace.mjs",
     "verify:release-eval-gate": "node scripts/test-release-eval-gate.mjs",
+    "verify:release-script": "node scripts/test-release-script.mjs",
     "pack:check": "npm pack --dry-run",
     "docs:dev": "pnpm --filter @planr/docs dev",
     "docs:alchemy:dev": "pnpm --filter @planr/docs alchemy:dev",
@@ -44,6 +47,7 @@
     "docs:verify-agent-landing": "pnpm --filter @planr/docs verify:agent-landing",
     "docs:verify-concepts": "cargo build --bin planr && pnpm --filter @planr/docs verify:concepts",
     "docs:verify-maintenance": "pnpm --filter @planr/docs verify:maintenance",
+    "docs:sync-linux-portability": "pnpm --filter @planr/docs sync:linux-portability",
     "docs:verify-deployment": "pnpm --filter @planr/docs verify:deployment",
     "docs:verify-release": "pnpm --filter @planr/docs verify:release",
     "docs:verify-release-live": "pnpm --filter @planr/docs verify:release-live",

package/plugins/planr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "planr",
   "description": "Skill-driven planning and execution loop for coding agents: one planr entry point, an autonomous planr-loop, and evidence-backed task graph skills powered by the planr CLI.",
-  "version": "1.7.1",
+  "version": "1.7.3",
   "author": {
     "name": "instructa"
   },

package/plugins/planr/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "planr",
-  "version": "1.7.1",
+  "version": "1.7.3",
   "description": "Skill-driven planning and execution loop for coding agents: one $planr entry point, an autonomous $planr-loop, and evidence-backed task graph skills powered by the planr CLI.",
   "author": {
     "name": "instructa",