chore(release): 1.4.0 — every changed package, with the pins that carry the wave

CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [1.4.0] - 2026-09-20
+
+**Which packages this version covers.** All eight, because all eight changed
+since the version each one has on the registry, and the security wave of
+2026-09-19 (#725: CWE-78/22/1321, ReDoS, workflow token permissions) touched
+`agent-runtime` and `infra-providers`, which were still serving pre-wave builds.
+Published in dependency order by `npm-release.yml` with provenance:
+
+| Package | Version | Why |
+| :--- | :--- | :--- |
+| `@beyondnet/evolith-core-domain` | 1.3.2 → **1.4.0** | envelope clock (`startEnvelopeClock`/`measuredMeta`/`elapsedMsSince`, GT-686), per-rule tenant overrides and `enabled` (GT-678), upgrade fingerprints and three-way classification (GT-673), the profile-store reader both surfaces share (GT-682) |
+| `@beyondnet/evolith-contracts` | 1.2.0 → **1.3.0** | `timing` on the deposit contract, handed over never synthesized (GT-686); capability manifest re-pinned for 55 operations |
+| `@beyondnet/evolith-infra-providers` | 1.2.1 → **1.3.0** | loader: a tenant pack's delta attached to ONE rule, Core-vs-Core duplicate ids refused, unknown rule keys rejected by name (GT-678); security fixes from #725 |
+| `@beyondnet/evolith-core` | 1.2.0 → **1.3.0** | the composable surface evaluates or refuses (GT-701) |
+| `@beyondnet/evolith-agent-runtime` | 1.2.0 → **1.3.0** | LLM provider registry and per-call usage (ADR-0128), verifiable approval grants (GT-679), knowledge adapters with `pg` declared as the runtime dependency it always was (GT-685), the dense reader ignoring lexical-only rows; security fixes from #725 |
+| `@beyondnet/evolith-sdk` | 2.0.0 → **2.0.1** | `EVOLITH_API_TIMEOUT_MS` honoured for the REST client timeout |
+| `@beyondnet/evolith-mcp` | 1.3.3 → **1.4.0** | `evolith-history`, `evolith-profile`, `evolith-standards` (GT-682 slices, 55 tools), every inner envelope measured (GT-686), rule overrides on `evolith-validate`/`evolith-evaluate` (GT-678), `evolith-upgrade-*` classification (GT-673) |
+| `@beyondnet/evolith-cli` | 1.3.2 → **1.4.0** | everything above on the reference surface; exact pins moved to the versions that carry it |
+
+The sections below were written under `[Unreleased]` and ship with this
+version.
+
+
 ### Release process — the CLI releases on `cli-vX.Y.Z`, not on the monorepo tag (#707)
 
 `sdk-cli-release.yml` no longer runs on `v*` tags. A `vX.Y.Z` tag names the

product/products/smart-cli/product-inventory.es.md

@@ -7,7 +7,7 @@ Inventario generado de la superficie instalable de Evolith CLI y MCP. No editar
 
 | Campo | Valor |
 |---|---|
-| Package | `@beyondnet/evolith-cli@1.3.2` |
+| Package | `@beyondnet/evolith-cli@1.4.0` |
 | Binary | `evolith`, `evolith-cli` |
 | CLI commands | 38 |
 | MCP tools | 55 |

product/products/smart-cli/product-inventory.md

@@ -7,7 +7,7 @@ Generated inventory of the installable Evolith CLI and MCP surface. Do not edit
 
 | Field | Value |
 |---|---|
-| Package | `@beyondnet/evolith-cli@1.3.2` |
+| Package | `@beyondnet/evolith-cli@1.4.0` |
 | Binary | `evolith`, `evolith-cli` |
 | CLI commands | 38 |
 | MCP tools | 55 |

reference/core/control-center/maturity-reports/maturity-reconciliation.json

@@ -11,7 +11,7 @@
   },
   "evidence": {
     "closureRecords": 669,
-    "cliPackage": "@beyondnet/evolith-cli@1.3.2",
+    "cliPackage": "@beyondnet/evolith-cli@1.4.0",
     "adrCount": 144,
     "rulesetCount": 184,
     "schemaCount": 50

src/packages/agent-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-agent-runtime",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Evolith Agent Runtime — decoupled agentic layer that operates Evolith Core through Ports & Adapters (.harness, Core Evaluation, OPA, Tracker, Memory, Scheduler, Hermes). Hexagonal; no runtime/LLM technology is a domain dependency.",
   "keywords": [
     "evolith",
@@ -43,7 +43,7 @@
     "example:discovery-gate": "node examples/validate-discovery-gate.mjs"
   },
   "dependencies": {
-    "@beyondnet/evolith-core-domain": "^1.3.0",
+    "@beyondnet/evolith-core-domain": "^1.4.0",
     "pg": "8.16.3",
     "yaml": "2.9.1"
   },

src/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-contracts",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Versioned SemVer boundary for the Evolith Core public contract: machine-contract/schema set (sha256) and the capability manifest served by GET /api/v1/capabilities",
   "keywords": [
     "evolith",
@@ -59,7 +59,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@beyondnet/evolith-core-domain": "^1.1.0",
+    "@beyondnet/evolith-core-domain": "^1.4.0",
     "@types/jest": "30.0.0",
     "@types/node": "26.6.1",
     "jest": "30.4.2",

src/packages/core-domain/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-core-domain",
-  "version": "1.3.2",
+  "version": "1.4.0",
   "description": "Shared Domain and Application logic for Evolith Core",
   "keywords": [
     "evolith",

src/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-core",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Shared business logic layer for Evolith — consumed by CLI, MCP Server, and REST API",
   "keywords": [
     "evolith",
@@ -32,7 +32,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@beyondnet/evolith-core-domain": "^1.1.0"
+    "@beyondnet/evolith-core-domain": "^1.4.0"
   },
   "devDependencies": {
     "@types/jest": "30.0.0",

src/packages/infra-providers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-infra-providers",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Shared infrastructure providers for Evolith Core",
   "keywords": [
     "evolith",
@@ -27,8 +27,8 @@
     "test:cov": "jest --coverage"
   },
   "dependencies": {
-    "@beyondnet/evolith-contracts": "^1.2.0",
-    "@beyondnet/evolith-core-domain": "^1.2.0",
+    "@beyondnet/evolith-contracts": "^1.3.0",
+    "@beyondnet/evolith-core-domain": "^1.4.0",
     "@nestjs/common": "11.2.1",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

src/packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-mcp",
-  "version": "1.3.3",
+  "version": "1.4.0",
   "mcpName": "io.github.beyondnetcode/evolith",
   "description": "Evolith MCP Gateway — NestJS-based Model Context Protocol server for AI agents. Supports stdio and SSE transports.",
   "main": "dist/main.js",
@@ -42,10 +42,10 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@beyondnet/evolith-agent-runtime": "^1.1.0",
-    "@beyondnet/evolith-core": "^1.2.0",
-    "@beyondnet/evolith-core-domain": "^1.3.1",
-    "@beyondnet/evolith-infra-providers": "^1.2.1",
+    "@beyondnet/evolith-agent-runtime": "^1.3.0",
+    "@beyondnet/evolith-core": "^1.3.0",
+    "@beyondnet/evolith-core-domain": "^1.4.0",
+    "@beyondnet/evolith-infra-providers": "^1.3.0",
     "@beyondnet/evolith-sdk": "^2.0.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@nestjs/cache-manager": "3.1.3",

src/packages/mcp-server/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.beyondnetcode/evolith",
   "title": "Evolith Architecture Governance",
   "description": "Executable architecture governance: an unevaluated rule is reported as a failure, never a pass.",
-  "version": "1.3.3",
+  "version": "1.4.0",
   "websiteUrl": "https://beyondnetcode.github.io/evolith_arch32/",
   "repository": {
     "url": "https://github.com/beyondnetcode/evolith_arch32",
@@ -16,7 +16,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@beyondnet/evolith-mcp",
-      "version": "1.3.3",
+      "version": "1.4.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

src/packages/sdk-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-sdk",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Typed client library for the Evolith Core REST API and MCP tools",
   "keywords": [
     "evolith",
@@ -54,8 +54,8 @@
     "testEnvironment": "node"
   },
   "dependencies": {
-    "@beyondnet/evolith-agent-runtime": "^1.1.0",
-    "@beyondnet/evolith-core-domain": "^1.1.0"
+    "@beyondnet/evolith-agent-runtime": "^1.3.0",
+    "@beyondnet/evolith-core-domain": "^1.4.0"
   },
   "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme",
   "repository": {

src/rulesets/contracts/evolith-machine-contracts.json

@@ -3,7 +3,7 @@
   "compatibilityPolicy": "semver-major",
   "producer": {
     "package": "@beyondnet/evolith-cli",
-    "version": "1.3.2"
+    "version": "1.4.0"
   },
   "schemas": [
     {

src/sdk/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-cli",
-  "version": "1.3.2",
+  "version": "1.4.0",
   "description": "Evolith CLI - Governance, standards validation, and AI agent integration for satellite repositories",
   "main": "dist/main.js",
   "bin": {
@@ -70,10 +70,10 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@beyondnet/evolith-agent-runtime": "1.2.0",
-    "@beyondnet/evolith-core-domain": "1.3.2",
-    "@beyondnet/evolith-infra-providers": "1.2.1",
-    "@beyondnet/evolith-sdk": "2.0.0",
+    "@beyondnet/evolith-agent-runtime": "1.3.0",
+    "@beyondnet/evolith-core-domain": "1.4.0",
+    "@beyondnet/evolith-infra-providers": "1.3.0",
+    "@beyondnet/evolith-sdk": "2.0.1",
     "@clack/prompts": "1.8.1",
     "@hono/node-server": "1.19.15",
     "@modelcontextprotocol/sdk": "1.29.0",