PauseMesh 0.2.0-alpha.1

Experimental protocol-conformance prerelease.

Highlights

• MCP 2025-11-25 elicitation with negotiated capabilities, strict form schemas, trusted URL policy, and immutable request receipts
• A2A 1.0 task interruption with explicit server-owned task/context bindings and out-of-band authorization
• AG-UI whole-cohort interrupts with immutable receipts, deterministic idempotency, schema policy, bounded input, and CAS cancellation
• streaming HTTP payload caps before JSON parsing
• Node.js 24 built-in SQLite storage with no native database build step
• clean ESM package, migration guide, changelog, ADR, and real consumer-install smoke

Verification

• 164 tests
• 84.24% statement and 80.80% branch coverage
• Linux, macOS, and Windows CI: https://github.com/aantenore/pausemesh/actions/runs/29578302843
• CodeQL and GitGuardian green
• production dependency audit found no known vulnerabilities
• two independent P0-P2 audits found no residual issues

Compatibility

Requires Node.js 24+ and pnpm 11. The package is ESM-only. Adapter callers upgrading from 0.1 must supply explicit protocol-owned bindings; see the README migration table.

SHA-256 for the npm tarball: 7284c6560c9dd569435b1bf84aca16c1bfeb951c93b263e0f27afc7bd59d0858.