Skip to content

v0.4.5

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 17:19
· 83 commits to main since this release
v0.4.5
35e6c41

v0.4.5: corrective release verification budget

Semctx 0.4.5 prepares the npm CLI and both host plugins together. Bun >=1.4.0,
Codex 0.147.0 and Claude Code 2.1.229 remain the declared host baseline.

Release correction

The immutable v0.4.4 tag exhausted the release-source verification job's 30-minute budget
before publication. npm publication, two-host delivery and stable promotion did not run.
v0.4.5 gives that same canonical verification job 60 minutes. Its gates, job ordering,
artifact identity checks and OIDC permissions remain unchanged; v0.4.4 is not retagged.

The product changes below carry PRs #339,
#340, #341
and #344. PRs #349 and #350 are outside this release.

What changes

  • Workspace discovery honors configured exclusions. Excluded manifest copies cannot contest an
    in-scope identity. V2 exact-file globs and recursive subtree globs retain their file-selection
    semantics; duplicate identities inside the selected scope remain ambiguous.
  • A declared workspace: dependency can resolve an uninstalled member's shared TypeScript
    configuration. Installed packages keep precedence; unrelated registry dependencies, ambiguous
    members and paths outside the repository do not gain a synthetic link. Configuration links
    and inherited paths refuse symlink escapes; spaced semver comparators retain their meaning.
  • Ordinary v2 TypeScript and JavaScript freshness bind the manifests, workspace declaration and inherited
    configuration actually consumed by those links, including failed attempts. LF/CRLF differences
    remain equivalent. Legacy analysis and retained qualified snapshots keep their existing
    identity and resolution contracts.
  • Verification accepts an unchanged CRLF Git blob in an autocrlf checkout while still rejecting
    hidden content changes and mid-capture drift.
  • Recursive exclusions cover workspace links and nested unreadable directories. Discovery
    tolerates an unreadable directory only when its complete subtree is excluded. Other
    unreadable directories retain an explicit failure.
  • Deferred Codex cleanup hides its child console windows on Windows.
  • A pure, opt-in library policy rejects expired or already-consumed authorization capsules
    against an explicit clock and caller-owned consumption state. Age bounds retain fractional
    timestamp precision. Storage, atomic state/effect coordination and rollback remain the
    caller's responsibility; existing CLI/MCP replay does not activate this policy.
  • Capsule production, schema validation and independent replay share exact timestamp ordering
    for the observation and expiry bounds of assertions and evidence providers. Their authorization
    decision rules remain separate.
  • Shared validation rejects invalid timezone offsets and executable Array subclasses while
    preserving ordinary JSON replay.

The opt-in JavaScript qualification and negative-completeness boundaries are unchanged. Static
analysis does not establish runtime or business correctness.

Install or upgrade

After publication:

bunx semctx@0.4.5 install

Open a new Codex task, or run /reload-plugins in Claude Code (restart if reload fails).
Consumer rollback uses the previously published 0.4.3 through the native host mechanism, then
reopens or reloads the host. It does not replace an immutable npm version or move stable manually.

Evidence and limits

Source checks, CI, npm publication, two-host delivery and active-session loading remain separate.
The annotated tag must pass the canonical gate; npm must identify that exact commit; immutable
Codex and Claude payloads must pass delivery before the stable channel advances.

Publication targets:

The declared host baseline comes from delivery run 34664142432,
not a claim that this version is already delivered. Other host versions remain UNKNOWN, as does
loading inside an existing session. Oh My Pi remains experimental and outside the two-host
delivery proof. Adoption, retention and human contribution time remain NOT_MEASURED.

The public packaged demo uses a synthetic TypeScript
fixture. After publication it must be rerun from the exact downloaded 0.4.5 artifact before
release-phase Pages evidence is published. Candidate bytes and older observations retain their
original identities and cannot establish released-artifact evidence.

Assets 2
Loading