swarm-orchestrator 13.1.3 → 13.1.4

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 13.1.4
+
+### Fixed
+
+- **The readme printed an install command that cannot work.** It offered
+  `npm install -g github:owner/repo#tag` beside the registry line. `dist/` is not committed, so a
+  git ref builds itself on install and needs this package's devDependencies to do it, and npm
+  does not install those under `-g`: it carries the global context into its git-dependency
+  preparation, places the clone as a root package rather than building a tree inside it, and runs
+  `prepare` without the compiler. The same ref installed without `-g` works and always did. Found
+  by a person running the line the readme printed.
+- **That failure surfaced as `ENOENT` on a path the reader never typed.** The build now names the
+  cause and the two commands that do work, rather than reporting a missing file.
+
 ## 13.1.3
 
 The first 13.x on the npm registry. No behaviour changed: this is 13.1.1 with a manifest the

package/README.md

@@ -31,10 +31,17 @@ a workspace it had never seen, recorded in a real terminal:
 
     npm install -g swarm-orchestrator
 
-That is **13.1.3**, and it leaves `swarm` on your path. Installing from the tag works too, and
-builds itself on install:
+That is **13.1.4**, and it leaves `swarm` on your path.
 
-    npm install -g github:moonrunnerkc/swarm-orchestrator#v13.1.3
+Installing from a tag works too, but only into a project rather than globally:
+
+    npm install github:moonrunnerkc/swarm-orchestrator#v13.1.4
+
+`dist/` is not committed, so a git ref builds itself on install and needs this package's
+devDependencies to do it. npm does not install those when a git ref is installed with `-g`: it
+carries the global context into its git-dependency preparation, places the clone as a root
+package, and runs the build without the compiler. The published package needs no build, which
+is why the line above it is the one to use.
 
 Anything below 13 is a different program. This package name carried a pull-request auditor
 through 12.x, and `npm install -g swarm-orchestrator@12` still installs it, so pin the major if

package/docs/build-guide.md

@@ -134,7 +134,7 @@ Failure paths: gate fails, raw output returns to the model, retry under ratchet,
 
 ### 5.1 Package Identity (decided: v13 replaces v12 outright)
 
-swarm-orchestrator on the registry stops at 12.0.0, published with three bins (swarm, swarm-audit, swarm-orchestrator) and a GitHub Action at action.yml; the v12-final tag carries 12.1.1, which was tagged and never published. The decision is a clean replacement, not a coexistence: the package keeps the name swarm-orchestrator and takes a major version, 13. It ships exactly one binary, swarm, and swarm now means the coding agent. swarm-audit and the swarm-orchestrator alias are gone, and swarm audit is not retained even as a deprecated shim, because auditing is not a v13 capability and a shim would imply otherwise. The Action is retired rather than repointed. This is a deliberate hard break for every 12.x consumer, taken knowingly. The README, the Pages site, and the Action description all described the auditor; they are replaced along with the code rather than migrated. Before the default branch becomes v13, tag the last v12 commit so section 3.10's design inputs stay reachable.
+When this was decided, swarm-orchestrator on the registry stopped at 12.0.0, published with three bins (swarm, swarm-audit, swarm-orchestrator) and a GitHub Action at action.yml; the v12-final tag carries 12.1.1, which was tagged and never published. The decision is a clean replacement, not a coexistence: the package keeps the name swarm-orchestrator and takes a major version, 13. It ships exactly one binary, swarm, and swarm now means the coding agent. swarm-audit and the swarm-orchestrator alias are gone, and swarm audit is not retained even as a deprecated shim, because auditing is not a v13 capability and a shim would imply otherwise. The Action is retired rather than repointed. This is a deliberate hard break for every 12.x consumer, taken knowingly. The README, the Pages site, and the Action description all described the auditor; they are replaced along with the code rather than migrated. Before the default branch becomes v13, tag the last v12 commit so section 3.10's design inputs stay reachable. Carried out: the registry now serves 13.1.3 as latest, one binary, no Action, with 12.0.0 left in place for anyone pinned to it.
 
 ## 6. Implementation Sequence
 

package/docs/claims.md

@@ -25,6 +25,8 @@ Paths are relative to this file's directory.
 | Known limitations are documented rather than hidden | `build-guide.md` section 7.1 for the four residuals, the null results in `security-coverage.md`, and the NOT-RUN entries in `evidence/2026-08-18/run-report.md` |
 | Behaviour over ten consecutive real tasks | `evidence/2026-08-18/shakedown/pass-criteria.md`, written and committed before anything ran, and `evidence/2026-08-18/shakedown/results.md`: eleven bundles, all verifying, none of the six stated failure conditions met |
 | The packaged tool installs from its tarball and runs a task end to end, with nothing of this repository beside it | `evidence/2026-08-23/installed-package-run.md`: the 13.1.0 tarball installed into an empty directory, two tasks against a workspace it had never seen, recorded in `evidence/2026-08-23/live-task.cast` and `evidence/2026-08-23/open-evidence.cast`. One goes green and one escalates at the file-set gate citing its ledger record; both bundles verify from outside both directories, and the panel reports `open exited 0` rather than reporting that it opened something |
+| The package on the registry is the artifact this repository built, and carries a signed statement saying so | `evidence/2026-08-24/registry-publish.md`: `npm install -g swarm-orchestrator` serves 13.1.3, published by CI run `32751820534` from tag `v13.1.3`. The shasum the registry serves is the one that run's `npm pack --dry-run` printed before the publish step, and `npm audit signatures` reports the SLSA provenance attestation verified from a clean install. It ties the tarball to this repository, this commit and that run, and it says nothing about whether the code is correct |
+| The project page cannot state a claim this table does not make | `../scripts/build-site.mjs` generates the page from this file: the claims come from the rows above, the struck-through list comes from the section below, and the version comes from `../package.json`. `../scripts/build-site.test.mjs` asserts every row reaches the page, that every forbidden phrase reaches it too, that a path the repository does not track is left as text rather than linked to a 404, and that the only verdict the page renders is the refusal it quotes |
 | The declared-file-set check blocks an out-of-set edit until an amendment is recorded | `evidence/2026-08-18/shakedown/bundles/task-08-file-set-amended`, where the gate blocked three times and the run went green only after an amendment with a reason reached the ledger |
 
 ## What may not be said

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swarm-orchestrator",
-  "version": "13.1.3",
+  "version": "13.1.4",
   "description": "A coding agent whose claims about its own work resolve to machine-captured evidence: an append-only hash-chained ledger, gates that retry under a numeric ratchet, and a signed bundle carrying its own verifier that anyone can check offline.",
   "keywords": [
     "agentic-ai",