npm - planr - Versions diffs - 1.7.2 → 1.7.3 - Mend

@@ -12,18 +12,26 @@ The v1 repository-owned public install order is:
 Published npm versions bundle platform-native binaries; see <https://planr.so/docs/operations/release>.
-## Version Bump
-`scripts/release.sh` is the only supported release path. The version lives in
-`Cargo.toml`; `package.json`, both plugin manifests under `plugins/planr/`, and
-`.cursor-plugin/plugin.json` must match it. Generated CLI and MCP references
-must match the currently committed version before the release branch merges.
-After bumping on clean `main`, the script refreshes pnpm's derived workspace
-metadata with the frozen lockfile and rejects any lockfile byte change. It then
-builds, regenerates, and strictly checks both references before staging them in
-the same atomic release commit as the six synchronized version files. Manual
-tagging or pre-generating a future version skips this ownership boundary and
-can ship stale references.
+## Candidate and publication
+`scripts/prepare-release-candidate.sh` is the only supported version-transition
+path. Run it from clean, reviewed source on a release branch. It synchronizes
+`Cargo.toml`, `Cargo.lock`, `package.json`, both plugin manifests under
+`plugins/planr/`, `.cursor-plugin/plugin.json`, and the generated CLI/MCP
+references. It never stages, commits, tags, pushes, or publishes. Commit those
+changes with the changelog and any release-contract transition, then run the
+full candidate verification and independent review on that exact commit.
+`scripts/release.sh` is the only supported publication path. It runs on clean
+`main`, requires every version and generated reference to already match the
+requested version, reruns the local eval and deterministic gates, and rejects
+any command that changes the reviewed source. Only then does it create and push
+the annotated tag. Editing manifests by hand or publishing an unprepared commit
+skips this ownership boundary.
+```bash
+scripts/prepare-release-candidate.sh 1.2.0
+```
 ```bash
 export PLANR_RELEASE_EVAL_SUITE="$HOME/projects/planr-evals/suites/planr-lean-skills-dogfood.suite.json"
@@ -56,15 +64,16 @@ stored baseline/candidate/policy identities, and gates that fresh result.
 Requested-only values and policy or binding metadata are never
 effective-treatment proof.
-The script enforces, in order:
+The two scripts enforce, in order:
-1. branch is `main`, worktree is clean, `CHANGELOG.md` already has a committed `## [x.y.z]` section, and the tag does not exist;
-2. the version is written into all synchronized manifests;
-3. `pnpm install --frozen-lockfile` refreshes installed workspace metadata, and any `pnpm-lock.yaml` byte change stops the release before build, references, gates, or Git mutation;
-4. the build synchronizes `Cargo.lock`, and the bumped candidate regenerates and strictly verifies both generated references before any later gate or Git mutation;
-5. the candidate binary validates the sanitized receipt, observed effective treatment, candidate binding, and existing Planr comparison/gate before any Git mutation;
-6. deterministic gates: `cargo test` (including manifest drift), `npm pack --dry-run`, and `scripts/security-local.sh` (betterleaks + trivy);
-7. one mechanical commit containing the six version files plus both generated references, an annotated `vx.y.z` tag carrying that summary, and a single push of branch plus tag.
+1. candidate preparation starts from a clean worktree and a nonexistent tag;
+2. the candidate version is written into all synchronized manifests;
+3. frozen workspace synchronization cannot change `pnpm-lock.yaml`;
+4. the candidate build synchronizes `Cargo.lock`, then regenerates and strictly checks both references without Git mutation;
+5. candidate source, changelog, contracts, and generated files are committed and independently reviewed before publication approval;
+6. publication requires clean `main`, the exact prepared versions/references, a committed changelog section, and no existing tag;
+7. the candidate binary validates the sanitized receipt and recomputed comparison, then deterministic tests, package, and security gates run without changing source;
+8. publication creates and pushes only the annotated `vx.y.z` tag for that reviewed commit.
 Two independent gates back the script:
@@ -96,8 +105,19 @@ Only `-alpha.N`, `-beta.N`, and `-rc.N` suffixes are accepted; everything else t
 Pushing a tag `vX.Y.Z` runs `.github/workflows/release.yml`:
+<!-- planr:linux-release-portability:start surface=maintainerRelease schema=1 -->
+> **Linux release portability — corrected**
+>
+> Contract state: `status=corrected`; `affectedThrough=v1.7.2`; `correctedFrom=v1.7.3`.
+> Published Linux release, installer, and npm binaries through v1.7.2 require GLIBC_2.39; macOS is unaffected.
+> Starting with v1.7.3, current Linux release, installer, and npm artifacts are static-musl executables and do not require glibc.
+> On an affected Linux release, build from source on the target distribution or upgrade to v1.7.3.
+<!-- planr:linux-release-portability:end surface=maintainerRelease schema=1 -->
+When this contract changes, update `docs/contracts/LINUX_RELEASE_PORTABILITY.json`, run `pnpm docs:sync-linux-portability`, and commit every synchronized notice before running the release gates.
 1. `create-release` verifies the tag against `Cargo.toml`, all distribution manifests, and the changelog section, then creates a draft GitHub Release.
-2. `build` compiles and packages `planr-<os>-<arch>.tar.gz` for `darwin-arm64`, `darwin-x86_64`, `linux-x86_64`, and `linux-arm64`, then uploads each asset to the draft release.
+2. `build` compiles and packages `planr-<os>-<arch>.tar.gz` for `darwin-arm64`, `darwin-x86_64`, `linux-x86_64`, and `linux-arm64`, then uploads each asset to the draft release. Future Linux candidates use native x86_64/arm64 GitHub runners and the same digest-pinned Rust 1.90.0 Alpine/musl image. Before upload, the extracted tarball must pass embedded checksums, static ELF checks (no interpreter, shared-library dependency, or glibc symbol), a fresh project/plan/map/pick/done/export lifecycle in digest-pinned Alpine 3.20.8 with networking disabled, and exact-byte npm wrapper execution.
 3. `finalize` downloads all uploaded assets, writes one aggregated `SHA256SUMS` covering every tarball, uploads it, and publishes the release.
 4. `npm-publish` downloads the release assets, verifies them against `SHA256SUMS`, bundles the four platform binaries into `npm/native/`, smoke-tests the wrapper, and publishes to npm via Trusted Publishing (OIDC). Runs only when the repository variable `NPM_PUBLISH_ENABLED` is `true`; requires the one-time Trusted Publisher setup described at <https://planr.so/docs/operations/release>.
 5. `homebrew-tap` regenerates `Formula/planr.rb` with `scripts/generate-formula.sh` and pushes it to `instructa/homebrew-tap` (installed as `brew install instructa/tap/planr`).
@@ -122,6 +142,11 @@ scripts/security-local.sh
 ```
 The external consumer E2E suite must pass when available on the release machine.
+Pull-request CI separately builds both Linux architectures through the canonical
+containerized release script, runs the full portability contract without
+secrets or publication permissions, and aggregates checksums for the exact two
+candidate tarballs. A same-runner `--version` smoke is useful architecture
+evidence but is not Linux compatibility proof by itself.
 ## Build Artifact

@@ -0,0 +1,9 @@
+{
+  "affectedReleases": [
+    "1.7.2"
+  ],
+  "affectedThrough": "1.7.2",
+  "correctedFrom": "1.7.3",
+  "noticeSchema": 1,
+  "status": "corrected"
+}

@@ -1,6 +1,6 @@
 {
   "name": "planr",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "Local-first planning and execution coordination for coding agents.",
   "license": "MIT",
   "repository": {
@@ -47,6 +47,7 @@
     "docs:verify-agent-landing": "pnpm --filter @planr/docs verify:agent-landing",
     "docs:verify-concepts": "cargo build --bin planr && pnpm --filter @planr/docs verify:concepts",
     "docs:verify-maintenance": "pnpm --filter @planr/docs verify:maintenance",
+    "docs:sync-linux-portability": "pnpm --filter @planr/docs sync:linux-portability",
     "docs:verify-deployment": "pnpm --filter @planr/docs verify:deployment",
     "docs:verify-release": "pnpm --filter @planr/docs verify:release",
     "docs:verify-release-live": "pnpm --filter @planr/docs verify:release-live",

@@ -1,7 +1,7 @@
 {
   "name": "planr",
   "description": "Skill-driven planning and execution loop for coding agents: one planr entry point, an autonomous planr-loop, and evidence-backed task graph skills powered by the planr CLI.",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "author": {
     "name": "instructa"
   },

@@ -1,6 +1,6 @@
 {
   "name": "planr",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "Skill-driven planning and execution loop for coding agents: one $planr entry point, an autonomous $planr-loop, and evidence-backed task graph skills powered by the planr CLI.",
   "author": {
     "name": "instructa",

planr 1.7.2 → 1.7.3