From bf7f89280f2a9c20b4f1d62dba8f71ca046c45db Mon Sep 17 00:00:00 2001 From: aarroyo Date: Sun, 20 Sep 2026 00:06:42 -0500 Subject: [PATCH 1/2] =?UTF-8?q?chore(release):=201.4.0=20=E2=80=94=20every?= =?UTF-8?q?=20changed=20package,=20with=20the=20pins=20that=20carry=20the?= =?UTF-8?q?=20wave?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit core-domain 1.4.0 · contracts 1.3.0 · infra-providers 1.3.0 · core 1.3.0 · agent-runtime 1.3.0 · sdk 2.0.1 · mcp 1.4.0 (+ server.json) · cli 1.4.0. All eight have unpublished source changes, including the 2026-09-19 security wave (#725) in agent-runtime and infra-providers. Internal ranges moved to the minimum that carries what each consumer imports (the CLI pins exactly), the producer declaration in evolith-machine-contracts.json follows the CLI, and the CHANGELOG gains the 1.4.0 section with the per-package coverage table. Rehearsed before opening: the eight tarballs packed from this tree and installed together into a clean directory — no nested @beyondnet copies, `evolith --version` → 1.4.0, `evolith-mcp --version` → 1.4.0, the bundled corpus loads, and check-install-smoke resolves all 43 @beyondnet/* specifiers in that tree. Co-Authored-By: Claude Opus 5 Signed-off-by: aarroyo --- CHANGELOG.md | 23 ++++++++++ package-lock.json | 46 +++++++++---------- src/packages/agent-runtime/package.json | 4 +- src/packages/contracts/package.json | 4 +- src/packages/core-domain/package.json | 2 +- src/packages/core/package.json | 4 +- src/packages/infra-providers/package.json | 6 +-- src/packages/mcp-server/package.json | 10 ++-- src/packages/mcp-server/server.json | 4 +- src/packages/sdk-client/package.json | 6 +-- .../contracts/evolith-machine-contracts.json | 2 +- src/sdk/cli/package.json | 10 ++-- 12 files changed, 72 insertions(+), 49 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c8248f26..4e08e35ff 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,29 @@ ## [Unreleased] +## [1.4.0] - 2026-09-20 + +**Which packages this version covers.** All eight, because all eight changed +since the version each one has on the registry, and the security wave of +2026-09-19 (#725: CWE-78/22/1321, ReDoS, workflow token permissions) touched +`agent-runtime` and `infra-providers`, which were still serving pre-wave builds. +Published in dependency order by `npm-release.yml` with provenance: + +| Package | Version | Why | +| :--- | :--- | :--- | +| `@beyondnet/evolith-core-domain` | 1.3.2 → **1.4.0** | envelope clock (`startEnvelopeClock`/`measuredMeta`/`elapsedMsSince`, GT-686), per-rule tenant overrides and `enabled` (GT-678), upgrade fingerprints and three-way classification (GT-673), the profile-store reader both surfaces share (GT-682) | +| `@beyondnet/evolith-contracts` | 1.2.0 → **1.3.0** | `timing` on the deposit contract, handed over never synthesized (GT-686); capability manifest re-pinned for 55 operations | +| `@beyondnet/evolith-infra-providers` | 1.2.1 → **1.3.0** | loader: a tenant pack's delta attached to ONE rule, Core-vs-Core duplicate ids refused, unknown rule keys rejected by name (GT-678); security fixes from #725 | +| `@beyondnet/evolith-core` | 1.2.0 → **1.3.0** | the composable surface evaluates or refuses (GT-701) | +| `@beyondnet/evolith-agent-runtime` | 1.2.0 → **1.3.0** | LLM provider registry and per-call usage (ADR-0128), verifiable approval grants (GT-679), knowledge adapters with `pg` declared as the runtime dependency it always was (GT-685), the dense reader ignoring lexical-only rows; security fixes from #725 | +| `@beyondnet/evolith-sdk` | 2.0.0 → **2.0.1** | `EVOLITH_API_TIMEOUT_MS` honoured for the REST client timeout | +| `@beyondnet/evolith-mcp` | 1.3.3 → **1.4.0** | `evolith-history`, `evolith-profile`, `evolith-standards` (GT-682 slices, 55 tools), every inner envelope measured (GT-686), rule overrides on `evolith-validate`/`evolith-evaluate` (GT-678), `evolith-upgrade-*` classification (GT-673) | +| `@beyondnet/evolith-cli` | 1.3.2 → **1.4.0** | everything above on the reference surface; exact pins moved to the versions that carry it | + +The sections below were written under `[Unreleased]` and ship with this +version. + + ### Release process — the CLI releases on `cli-vX.Y.Z`, not on the monorepo tag (#707) `sdk-cli-release.yml` no longer runs on `v*` tags. A `vX.Y.Z` tag names the diff --git a/package-lock.json b/package-lock.json index 802feb5e1..acce79677 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16502,10 +16502,10 @@ }, "src/packages/agent-runtime": { "name": "@beyondnet/evolith-agent-runtime", - "version": "1.2.0", + "version": "1.3.0", "license": "MIT", "dependencies": { - "@beyondnet/evolith-core-domain": "^1.3.0", + "@beyondnet/evolith-core-domain": "^1.4.0", "pg": "8.16.3", "yaml": "2.9.1" }, @@ -16559,10 +16559,10 @@ }, "src/packages/contracts": { "name": "@beyondnet/evolith-contracts", - "version": "1.2.0", + "version": "1.3.0", "license": "MIT", "devDependencies": { - "@beyondnet/evolith-core-domain": "^1.1.0", + "@beyondnet/evolith-core-domain": "^1.4.0", "@types/jest": "30.0.0", "@types/node": "26.6.1", "jest": "30.4.2", @@ -16589,10 +16589,10 @@ }, "src/packages/core": { "name": "@beyondnet/evolith-core", - "version": "1.2.0", + "version": "1.3.0", "license": "MIT", "dependencies": { - "@beyondnet/evolith-core-domain": "^1.1.0" + "@beyondnet/evolith-core-domain": "^1.4.0" }, "devDependencies": { "@types/jest": "30.0.0", @@ -16604,7 +16604,7 @@ }, "src/packages/core-domain": { "name": "@beyondnet/evolith-core-domain", - "version": "1.3.2", + "version": "1.4.0", "license": "MIT", "dependencies": { "@open-policy-agent/opa-wasm": "1.10.0", @@ -16862,11 +16862,11 @@ }, "src/packages/infra-providers": { "name": "@beyondnet/evolith-infra-providers", - "version": "1.2.1", + "version": "1.3.0", "license": "MIT", "dependencies": { - "@beyondnet/evolith-contracts": "^1.2.0", - "@beyondnet/evolith-core-domain": "^1.2.0", + "@beyondnet/evolith-contracts": "^1.3.0", + "@beyondnet/evolith-core-domain": "^1.4.0", "@nestjs/common": "11.2.1", "ajv": "8.20.0", "ajv-formats": "3.0.1", @@ -16916,13 +16916,13 @@ }, "src/packages/mcp-server": { "name": "@beyondnet/evolith-mcp", - "version": "1.3.3", + "version": "1.4.0", "license": "MIT", "dependencies": { - "@beyondnet/evolith-agent-runtime": "^1.1.0", - "@beyondnet/evolith-core": "^1.2.0", - "@beyondnet/evolith-core-domain": "^1.3.1", - "@beyondnet/evolith-infra-providers": "^1.2.1", + "@beyondnet/evolith-agent-runtime": "^1.3.0", + "@beyondnet/evolith-core": "^1.3.0", + "@beyondnet/evolith-core-domain": "^1.4.0", + "@beyondnet/evolith-infra-providers": "^1.3.0", "@beyondnet/evolith-sdk": "^2.0.0", "@modelcontextprotocol/sdk": "1.29.0", "@nestjs/cache-manager": "3.1.3", @@ -17337,11 +17337,11 @@ }, "src/packages/sdk-client": { "name": "@beyondnet/evolith-sdk", - "version": "2.0.0", + "version": "2.0.1", "license": "MIT", "dependencies": { - "@beyondnet/evolith-agent-runtime": "^1.1.0", - "@beyondnet/evolith-core-domain": "^1.1.0" + "@beyondnet/evolith-agent-runtime": "^1.3.0", + "@beyondnet/evolith-core-domain": "^1.4.0" }, "devDependencies": { "@types/jest": "30.0.0", @@ -17370,13 +17370,13 @@ }, "src/sdk/cli": { "name": "@beyondnet/evolith-cli", - "version": "1.3.2", + "version": "1.4.0", "license": "MIT", "dependencies": { - "@beyondnet/evolith-agent-runtime": "1.2.0", - "@beyondnet/evolith-core-domain": "1.3.2", - "@beyondnet/evolith-infra-providers": "1.2.1", - "@beyondnet/evolith-sdk": "2.0.0", + "@beyondnet/evolith-agent-runtime": "1.3.0", + "@beyondnet/evolith-core-domain": "1.4.0", + "@beyondnet/evolith-infra-providers": "1.3.0", + "@beyondnet/evolith-sdk": "2.0.1", "@clack/prompts": "1.8.1", "@hono/node-server": "1.19.15", "@modelcontextprotocol/sdk": "1.29.0", diff --git a/src/packages/agent-runtime/package.json b/src/packages/agent-runtime/package.json index 9183c6b53..a5c411ab5 100644 --- a/src/packages/agent-runtime/package.json +++ b/src/packages/agent-runtime/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-agent-runtime", - "version": "1.2.0", + "version": "1.3.0", "description": "Evolith Agent Runtime — decoupled agentic layer that operates Evolith Core through Ports & Adapters (.harness, Core Evaluation, OPA, Tracker, Memory, Scheduler, Hermes). Hexagonal; no runtime/LLM technology is a domain dependency.", "keywords": [ "evolith", @@ -43,7 +43,7 @@ "example:discovery-gate": "node examples/validate-discovery-gate.mjs" }, "dependencies": { - "@beyondnet/evolith-core-domain": "^1.3.0", + "@beyondnet/evolith-core-domain": "^1.4.0", "pg": "8.16.3", "yaml": "2.9.1" }, diff --git a/src/packages/contracts/package.json b/src/packages/contracts/package.json index 680005d06..e92acff0c 100644 --- a/src/packages/contracts/package.json +++ b/src/packages/contracts/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-contracts", - "version": "1.2.0", + "version": "1.3.0", "description": "Versioned SemVer boundary for the Evolith Core public contract: machine-contract/schema set (sha256) and the capability manifest served by GET /api/v1/capabilities", "keywords": [ "evolith", @@ -59,7 +59,7 @@ }, "dependencies": {}, "devDependencies": { - "@beyondnet/evolith-core-domain": "^1.1.0", + "@beyondnet/evolith-core-domain": "^1.4.0", "@types/jest": "30.0.0", "@types/node": "26.6.1", "jest": "30.4.2", diff --git a/src/packages/core-domain/package.json b/src/packages/core-domain/package.json index f3d77e5d3..eb0f42d03 100644 --- a/src/packages/core-domain/package.json +++ b/src/packages/core-domain/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-core-domain", - "version": "1.3.2", + "version": "1.4.0", "description": "Shared Domain and Application logic for Evolith Core", "keywords": [ "evolith", diff --git a/src/packages/core/package.json b/src/packages/core/package.json index e99dd8bdf..cb839e687 100644 --- a/src/packages/core/package.json +++ b/src/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-core", - "version": "1.2.0", + "version": "1.3.0", "description": "Shared business logic layer for Evolith — consumed by CLI, MCP Server, and REST API", "keywords": [ "evolith", @@ -32,7 +32,7 @@ "access": "public" }, "dependencies": { - "@beyondnet/evolith-core-domain": "^1.1.0" + "@beyondnet/evolith-core-domain": "^1.4.0" }, "devDependencies": { "@types/jest": "30.0.0", diff --git a/src/packages/infra-providers/package.json b/src/packages/infra-providers/package.json index 11a7ea61b..b25ae93fc 100644 --- a/src/packages/infra-providers/package.json +++ b/src/packages/infra-providers/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-infra-providers", - "version": "1.2.1", + "version": "1.3.0", "description": "Shared infrastructure providers for Evolith Core", "keywords": [ "evolith", @@ -27,8 +27,8 @@ "test:cov": "jest --coverage" }, "dependencies": { - "@beyondnet/evolith-contracts": "^1.2.0", - "@beyondnet/evolith-core-domain": "^1.2.0", + "@beyondnet/evolith-contracts": "^1.3.0", + "@beyondnet/evolith-core-domain": "^1.4.0", "@nestjs/common": "11.2.1", "ajv": "8.20.0", "ajv-formats": "3.0.1", diff --git a/src/packages/mcp-server/package.json b/src/packages/mcp-server/package.json index 5ad202165..e714b7bc4 100644 --- a/src/packages/mcp-server/package.json +++ b/src/packages/mcp-server/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-mcp", - "version": "1.3.3", + "version": "1.4.0", "mcpName": "io.github.beyondnetcode/evolith", "description": "Evolith MCP Gateway — NestJS-based Model Context Protocol server for AI agents. Supports stdio and SSE transports.", "main": "dist/main.js", @@ -42,10 +42,10 @@ "LICENSE" ], "dependencies": { - "@beyondnet/evolith-agent-runtime": "^1.1.0", - "@beyondnet/evolith-core": "^1.2.0", - "@beyondnet/evolith-core-domain": "^1.3.1", - "@beyondnet/evolith-infra-providers": "^1.2.1", + "@beyondnet/evolith-agent-runtime": "^1.3.0", + "@beyondnet/evolith-core": "^1.3.0", + "@beyondnet/evolith-core-domain": "^1.4.0", + "@beyondnet/evolith-infra-providers": "^1.3.0", "@beyondnet/evolith-sdk": "^2.0.0", "@modelcontextprotocol/sdk": "1.29.0", "@nestjs/cache-manager": "3.1.3", diff --git a/src/packages/mcp-server/server.json b/src/packages/mcp-server/server.json index f88a6f353..0d3638be9 100644 --- a/src/packages/mcp-server/server.json +++ b/src/packages/mcp-server/server.json @@ -3,7 +3,7 @@ "name": "io.github.beyondnetcode/evolith", "title": "Evolith Architecture Governance", "description": "Executable architecture governance: an unevaluated rule is reported as a failure, never a pass.", - "version": "1.3.3", + "version": "1.4.0", "websiteUrl": "https://beyondnetcode.github.io/evolith_arch32/", "repository": { "url": "https://github.com/beyondnetcode/evolith_arch32", @@ -16,7 +16,7 @@ "registryType": "npm", "registryBaseUrl": "https://registry.npmjs.org", "identifier": "@beyondnet/evolith-mcp", - "version": "1.3.3", + "version": "1.4.0", "runtimeHint": "npx", "transport": { "type": "stdio" diff --git a/src/packages/sdk-client/package.json b/src/packages/sdk-client/package.json index 8a2bb526b..22bbb05b9 100644 --- a/src/packages/sdk-client/package.json +++ b/src/packages/sdk-client/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-sdk", - "version": "2.0.0", + "version": "2.0.1", "description": "Typed client library for the Evolith Core REST API and MCP tools", "keywords": [ "evolith", @@ -54,8 +54,8 @@ "testEnvironment": "node" }, "dependencies": { - "@beyondnet/evolith-agent-runtime": "^1.1.0", - "@beyondnet/evolith-core-domain": "^1.1.0" + "@beyondnet/evolith-agent-runtime": "^1.3.0", + "@beyondnet/evolith-core-domain": "^1.4.0" }, "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme", "repository": { diff --git a/src/rulesets/contracts/evolith-machine-contracts.json b/src/rulesets/contracts/evolith-machine-contracts.json index 65028da32..01b4dc825 100644 --- a/src/rulesets/contracts/evolith-machine-contracts.json +++ b/src/rulesets/contracts/evolith-machine-contracts.json @@ -3,7 +3,7 @@ "compatibilityPolicy": "semver-major", "producer": { "package": "@beyondnet/evolith-cli", - "version": "1.3.2" + "version": "1.4.0" }, "schemas": [ { diff --git a/src/sdk/cli/package.json b/src/sdk/cli/package.json index c1202e1e3..9d4ddfe10 100644 --- a/src/sdk/cli/package.json +++ b/src/sdk/cli/package.json @@ -1,6 +1,6 @@ { "name": "@beyondnet/evolith-cli", - "version": "1.3.2", + "version": "1.4.0", "description": "Evolith CLI - Governance, standards validation, and AI agent integration for satellite repositories", "main": "dist/main.js", "bin": { @@ -70,10 +70,10 @@ "LICENSE" ], "dependencies": { - "@beyondnet/evolith-agent-runtime": "1.2.0", - "@beyondnet/evolith-core-domain": "1.3.2", - "@beyondnet/evolith-infra-providers": "1.2.1", - "@beyondnet/evolith-sdk": "2.0.0", + "@beyondnet/evolith-agent-runtime": "1.3.0", + "@beyondnet/evolith-core-domain": "1.4.0", + "@beyondnet/evolith-infra-providers": "1.3.0", + "@beyondnet/evolith-sdk": "2.0.1", "@clack/prompts": "1.8.1", "@hono/node-server": "1.19.15", "@modelcontextprotocol/sdk": "1.29.0", From 6afa7561760a9ffa34ebf8889e499da9744458f6 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Sun, 20 Sep 2026 00:12:04 -0500 Subject: [PATCH 2/2] chore(release): regenerate the version-bearing derived artifacts for 1.4.0 The product inventory and the maturity reconciliation carry the CLI version; guard 11 and 09 --check went red on the bump in CI. Regenerated in order, guard 46 at a fixed point. Co-Authored-By: Claude Opus 5 Signed-off-by: aarroyo --- product/products/smart-cli/product-inventory.es.md | 2 +- product/products/smart-cli/product-inventory.md | 2 +- .../maturity-reports/maturity-reconciliation.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/product/products/smart-cli/product-inventory.es.md b/product/products/smart-cli/product-inventory.es.md index b187c0188..9d72c4ead 100644 --- a/product/products/smart-cli/product-inventory.es.md +++ b/product/products/smart-cli/product-inventory.es.md @@ -7,7 +7,7 @@ Inventario generado de la superficie instalable de Evolith CLI y MCP. No editar | Campo | Valor | |---|---| -| Package | `@beyondnet/evolith-cli@1.3.2` | +| Package | `@beyondnet/evolith-cli@1.4.0` | | Binary | `evolith`, `evolith-cli` | | CLI commands | 38 | | MCP tools | 55 | diff --git a/product/products/smart-cli/product-inventory.md b/product/products/smart-cli/product-inventory.md index dc061ac2d..1356ffcf5 100644 --- a/product/products/smart-cli/product-inventory.md +++ b/product/products/smart-cli/product-inventory.md @@ -7,7 +7,7 @@ Generated inventory of the installable Evolith CLI and MCP surface. Do not edit | Field | Value | |---|---| -| Package | `@beyondnet/evolith-cli@1.3.2` | +| Package | `@beyondnet/evolith-cli@1.4.0` | | Binary | `evolith`, `evolith-cli` | | CLI commands | 38 | | MCP tools | 55 | diff --git a/reference/core/control-center/maturity-reports/maturity-reconciliation.json b/reference/core/control-center/maturity-reports/maturity-reconciliation.json index 716311d01..ea8768024 100644 --- a/reference/core/control-center/maturity-reports/maturity-reconciliation.json +++ b/reference/core/control-center/maturity-reports/maturity-reconciliation.json @@ -11,7 +11,7 @@ }, "evidence": { "closureRecords": 669, - "cliPackage": "@beyondnet/evolith-cli@1.3.2", + "cliPackage": "@beyondnet/evolith-cli@1.4.0", "adrCount": 144, "rulesetCount": 184, "schemaCount": 50