v0.6.3

Highlights

• Upgrades the workflow runtime to @c4a/agent-graph 0.2.4. Two thin Skills now dynamically disclose 25 Action contracts and 57 referenced instruction, view, schema, and diagnostic resources through verifiable read receipts.
• Adds clean, reproducible CI across Node.js 20 and 24.
• Adds GitHub Release-triggered npm publishing with OIDC provenance and no long-lived npm token.
• Adds deterministic release preparation and npm tarball audits for every public package.
• Removes an unused native Tree-sitter development dependency so clean installs stay portable.

Published packages

• @c4a/core@0.6.3
• @c4a/context@0.6.3
• @c4a/extract@0.6.3
• @c4a/extract-ts@0.6.3
• @c4a/context-cli@0.6.3

Verification

• Clean GitHub Actions verification passed on Node.js 20 and 24.
• Typecheck and lint passed with no errors.
• 476 Context CLI/SDK tests and the current E2E suite passed.
• All five npm tarballs passed dry-run audits.