v4.0.0-rc.2

TL;DR: A deliberately small, reviewable MCPB Basic edition packages exactly 13 read-only Markdown tools, zero MCP prompts, one user-selected vault, and no write, watcher, persistent-index, embedding-model, PDF, or OCR surface. Its fixed launch contract also blocks discovery of a full edition's existing embedding database and watcher recovery guard, so umbrella search stays on live in-memory TF-IDF in Basic. One canonical Linux-built artifact must be consumed unchanged on Linux, Windows, and macOS, then reused by a resumable release state machine with exact inventory, checksum, SBOM, notices, provenance, npm identity, and GitHub draft checks. The RC proves that bounded distribution profile without claiming desktop signing, directory approval, catalog acceptance, or hybrid/native support.

Method note: implementation and review were intentionally static under D-45. No local install, build, lint, test, coverage, smoke, OIA, package/client runtime, benchmark, or evaluation workload ran on the maintainer MacBook. Positive and negative-control declarations were added to existing test blocks; executable proof is delegated to disposable GitHub-hosted runners on the exact candidate SHA. Final independent replay reviews caught and closed two pre-CI drift classes: stale planned/checkpoint language across agent-facing docs, and a release-integrity assertion that still required an obsolete inline npm-SHA comparison after that check moved into the shared npm-state classifier. The first disposable-runner PR pass then closed five additional evidence classes without weakening a gate: formatter drift, the newly disclosed tmp@0.2.6 bypass (upgraded to patched 0.2.7, not allowlisted), a hyphen-token mismatch in the TF-IDF consumer fixture, macOS /var versus /private/var cache identity, and current-count/scope/landing-page invariant drift. Current security truth is split explicitly: the isolated MCPB graph pins patched @hono/node-server@2.0.11, while the public npm consumer graph still resolves SDK v2 through @hono/node-server ^1.19.9 under the maintainer-approved, removal-tracked RC-only exception for the unreachable serveStatic surface. Stable remains blocked until the official consumer edge is patched.

MCPB Basic boundary

• The package is an explicit capability profile, not a second server implementation. The pinned MCPB v0.3 manifest selects one directory, supplies --no-prompts, --no-embedding-index, diagnostic access to the exact text-search tool, and a strict 13-tool allowlist. Default npm/CLI behavior remains unchanged: all 46 tools and 19 prompts are still available under their existing gates when these restrictions are absent.
• The 13-tool choice keeps both agent and diagnostic search. Basic exposes the recommended obsidian_search umbrella, which lazily uses in-memory TF-IDF without a model or on-disk index, plus obsidian_search_text for exact live lexical diagnostics; note reads, navigation, backlinks/outbound links, recency/staleness, tags, stats, and bounded frontmatter queries complete the surface.
• No hidden full-edition index inheritance. --no-embedding-index is shared by stdio and HTTP, freezes the embedding capability to null, skips the watcher activation guard, and preserves the historical auto-discovery default when omitted. The remote consumer fixture strands an embedding-file/guard sentinel in an isolated cache and requires Basic to start, leave it byte/identity-stable, and create no cache artifacts.
• The host/runtime boundary is explicit. The bundle packages server JavaScript and ordinary JavaScript dependencies; a compatible MCPB host must supply Node.js 22.13 or newer. Native/optional hybrid dependencies are omitted, archive paths are portable across all supported runners, Windows device aliases are rejected, and extension plus magic-byte scans reject executable/native payloads.
• Privacy is bounded, not absolute. The server initiates no outbound calls while serving and the bundle cannot mutate the selected vault, but note content requested by the connected MCP client crosses into that client/model and is governed by its separate privacy terms.

Artifact transparency and supply chain

• The official packer is pinned and used twice. @anthropic-ai/mcpb@2.1.2 and the MCPB schema commit are exact. A draft inventory is measured before the final pack; the final bundle carries the logical content manifest, CycloneDX 1.5 SBOM, and third-party license/notice inventory. The archive byte stream is not called reproducible because upstream records pack-time metadata.
• The consumer verifies bytes and behavior. It rejects traversal, portable-name collisions, optional/native leakage, incomplete dependency/license/SBOM inventories, mismatched sidecars, a wrong package/runtime identity, and any Hono version other than patched @hono/node-server@2.0.11 plus hono@4.12.31. Its positive inventory calls every Basic tool exactly once, then bounded search/traversal/write negatives prove false-hit refusal and post-refusal liveness; resources and read-only annotations are checked, and vault/canary/cache identities are compared only after client shutdown.
• The newly introduced packer development graph is patched. The root override and lockfile pin tmp@0.2.7, closing both the legacy string path-traversal range and the tmp@0.2.6 non-string type-confusion bypass (GHSA-7c78-jf6q-g5cm). This does not conceal the separate unresolved GHSA-frvp in the public npm consumer graph.

CI and resumable publication

• mcpb-basic becomes the twelfth directly enumerated release-required context. One exact-floor Linux producer emits an attempt-bound candidate; Linux, Windows, and macOS consume those same bytes. The aggregate remains distinct from the producer so reruns can bind the latest successful aggregate to the actual successful producer attempt.
• Release reuses the exact CI artifact instead of rebuilding it. Paginated run/job/artifact discovery is restricted to exact-SHA main push runs, selects a unique successful producer and aggregate, binds artifact id/digest/attempt, downloads by exact id, validates the ZIP digest, and safely extracts exactly four expected files.
• npm/GitHub state is fail-closed and resumable. Repository-wide release concurrency serializes every channel. Pure classifiers cover absent, draft, published, partial, duplicate, divergent, and superseded-prerelease states. Every npm dist-tag must advance under full SemVer precedence before a missing version is published; an exact historical prerelease may resume only when its gitHead matches and its channel is already on a strictly newer version, which must remain unchanged. The structural guard now pins all three source-bound npm-state calls and includes a mutation that redirects one to the wrong SHA.
• GitHub assets are exact and draft-first. Preflight paginates releases/assets before npm, requires an annotated tag peeling to the exact source SHA, prevents stable-channel rollback, and refuses partial published releases. Missing assets upload only after a fresh draft reclassification through the release's exact validated uploads.github.com URL with an encoded name. The draft publishes only after six exact assets are re-downloaded and compared.
• Asset identity rejects SemVer build metadata. GitHub filename normalization could break exact resumability, so MCPB publication fails closed on a package version containing +build metadata.

Compatibility and evidence status

• --no-prompts and --no-embedding-index are additive opt-outs; omitting them preserves the full edition's existing prompts and embedding discovery. MCPB versioning is synchronized across eight published surfaces.
• Public documentation in all 11 languages distinguishes the Basic asset from the full npm edition and states the host-Node, privacy, feature, GUI/signing/directory-approval, and client-boundary caveats.
• A manifest-derived documentation invariant now sweeps every localized README plus QUICKSTART, SECURITY, STABILITY, ROADMAP, llms.txt, and llms-ctx.txt for the exact MCPB version, asset/tag identity where applicable, 13/0 surface, Node floor, and forbidden pre-publication wording; five non-vacuous mutations prove its detection power without increasing the declared source-test count.
• No retrieval benchmark/evaluation result changed. Publication requires the exact remote artifact and all 12 release contexts; it still does not claim real desktop acceptance, signing, or a directory listing.

Tests (1807)

1807 → 1807 source tests. This candidate adds MCPB contract coverage through positive and non-vacuous negative-control declarations inside the existing release and documentation test blocks; it does not increase the source-test total.

Stats

46 tools · 19 prompts · 1807 source tests · MCPB Basic 13 tools / 0 prompts · 12 directly enumerated release-required contexts · 8 synchronized version surfaces.