[abruption]

Release preparation

Closes #170. Prepare session-peer@0.5.2 from merged main 1b9e762c154e1050b04f98d5c36cee0d332cf484 after #169 and #160.

• Update package/lock/banner and the registered current-version fields across four languages using the scoped updater. Preserve dated history, the ordinary Python oracle and independent skill/native pins.
• Add only the finite 0.5.2 runtime row carrying the same four exact skill profiles accepted by 0.5.1. Keep every historical row, profile, metadata grammar and bounded reader unchanged. Compiled/default/undefined/outer inspection and future/malformed identities are covered.
• Move the protected release helper's baseline to public 0.5.1 and its verified integrity, retaining preview 0.1.0-preview.1 and all source/registry/protection gates.
• Document the released source scope, correct one stale Korean guide claim that 0.4 was unpublished, and clarify Windows test coverage. Current SSH fixtures use the compiled VERSION; explicit previous-version refusal remains tested.

Behavior and availability

Ordinary Codex sends now refuse signed-in file-auth/keyring/auto or other cloud-unclassifiable contexts without reading credentials. Windows Codex send/dry-run also refuse while local storage classification is unqualified. Existing ordinary Claude paths are separate. See the storage contract and release notes before selecting a route.

Source-reviewed loaders 0.160.1 / 0.162.1 / 0.165.0 are not new native/platform/MDM/ACK qualification. Existing owned-stdio binding, exact observation profiles, operator-confirmed receipt and unknown/no-resend boundaries remain limited. Both SSH endpoints must use exactly 0.5.2.

The #160 static reporter and its two design documents remain repository-only and excluded from npm, with no installed CLI/SDK operation or deployment/recovery authority. Deferred #155 and research #82/#142 remain excluded. Runtime publication does not publish/install or repin the companion skill.

Validation and candidate artifact

• Local Node 24.22.1 / npm 11.19.1 full suite: 503 tests, 491 pass, 0 fail, 11 platform skips, 1 existing TODO on the 0.5.2 release working copy before committing; subsequent changes only restore package JSON formatting without semantic change and correct the two reviewed prose statements. Final exact-head CI is separate.
• Types, scoped version check, repository structure/four-language links/anchors, PR-title policy and diff checks pass; npm audit reports 0 vulnerabilities.
• Real package smoke (types/native binding/shorthand lifecycle/isolated install/removal) passes. Release helper packs twice reproducibly and validates/install-removes the exact candidate tarball. No lifecycle scripts, publication or global install.
• Final source: be2a4ed67656a9fb67346aa9437714de5887d561. Archive: session-peer-0.5.2.tgz, 79 files.
• Candidate SHA-256: c799e4f7ed96794928e5780732f8d230e6eac8502301a75f44c0d55393c85d8b.
• Candidate SHA-512 integrity: sha512-4cgqyU7AaSVUnTZvsFeP5Ocyri9XNqUQCxV+WDZOhHK0aJ8c/CkeMiv7isVtZns3RYu58TyU0sAoz4oBbQLhAA==.
• All 79 archive files match the reviewed source byte-for-byte, including all 18 packaged Markdown files. Reporter/source-only tool exclusions are verified. Two read-only document reviewers covered all 18 packaged documents; the Korean stale-release sentence was corrected and rechecked against English, and the Windows coverage wording was narrowed. The final archive differs from the first full-reviewed candidate only in those two document corrections; new source/manifest/hash comparisons were performed.
• The merged implementation baseline's exact main CI and CodeQL passed. Final release-PR head be2a4ed67656a9fb67346aa9437714de5887d561 passes 12/12 checks in CLI run 40982918959 and CodeQL run 40982915968, including all six OS/Node jobs, package/release artifact checks and release gate. Ubuntu Node 24 CI produced the same candidate SHA-256/SHA-512; its temporary PR merge commit has a byte-identical Git tree to this preparation head. That synthetic commit is not a publication source approval.
• Automatic code/security reviews completed on this exact head; code metadata reports no findings and no unresolved findings. Security metadata reports completed with a null structured findings value, so it is not presented as an independently verified zero-findings audit. No inline findings are present; no manual review mention was posted.

Registry baseline and publication gates

Preparation read: latest=0.5.1, preview=0.1.0-preview.1, target 0.5.2 absent. Public 0.5.1 raw SHA-256 and registry SHA-512 match its recorded release. GitHub's npm environment still requires a reviewer and a main-only deployment policy.

Authenticated npm ownership/pending-stage reads returned E401; pending-stage state remains unknown, not empty. Login was requested. Trusted Publisher/package-MFA settings have not been freshly audited for this release. Historical user exceptions are not reused. After human merge, verify exact-main checks and new exact-source/artifact binding, then obtain separate approval naming the merged SHA, session-peer@0.5.2, stable-stage and latest promotion. Protected environment and final npm stage 2FA approvals remain separate.

This PR prepares the release only. No merge, staging dispatch, tag/GitHub Release, npm publication, user-session/native experiment or fleet/global installation was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T00:58:53.113279Z	be2a4ed	PR opened
🔒 Security Review	✅ Completed 2026-10-30T01:01:15.904508Z	be2a4ed	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.