[abruption]

Summary

Prepare the owner-authorized v1.3.1 maintenance release after the Node Control audit repair in #339. The source base is protected main 7cb4d957b7144af941ba5651636109b235d67679; its scheduled Node/Python audits pass.

• Bump the dynamic Python version to 1.3.1 and regenerate the standalone script; no other Python behavior/dependency change.
• Add four-language maintenance notes and current README/runbook/documentation-map links, with the translation manifest and existing version/document-count tests updated.
• Record the source-level Zod 4.6.7 fix (fix(control): refresh Zod to restore runtime dependency audit #338/fix(control): refresh patched Zod runtime dependency #339), previously merged byte-identical skill 0.4.0 snapshot (docs(skill): sync compatibility snapshot with v0.4.0 #334/docs(skill): sync compatibility snapshot with v0.4.0 #335), and README download badges (docs: show cumulative PyPI downloads in README badges #336/docs: show cumulative PyPI downloads in README badges #337).
• Explicitly distinguish the Node source and standalone skill asset from Python wheel/sdist contents. Python publication does not deploy the Control fix or update independently managed skills. Existing v1.3.0 assets remain immutable.

The owner authorized normal merge, tagging and publication; repository protections and the required human PyPI environment approval remain. No operational service rollout or fleet installation is included.

Verification

• Documentation: 65 tests pass; distribution: 41 tests pass (3 PowerShell-only skips).
• Generated standalone and diff checks pass; two builds are byte-reproducible. Exact archive-content/metadata/manifest checks pass; wheel and sdist each install into a separate fresh environment, import from purelib, report 1.3.1 and pass pip check.
• The archived control/ and skills/ payloads are excluded by the existing Python package contract. Published GitHub standalone assets will include the reviewed compatibility skill.
• Node fix validation in fix(control): refresh patched Zod runtime dependency #339: clean install, typecheck/build, 123 Control tests and 11 Node/Python loopback contract tests; runtime/full npm audits report zero vulnerabilities. This is fixture validation, not live OAuth/native-agent or deployed-service acceptance.
• Current preparation-PR CI/reviews and final protected-main CI remain separate gates. No claim of private PyPI account binding verification.

Independent source review

Before PR creation, Claude Code 2.1.310 (response-confirmed claude-opus-5-5) and Codex CLI 0.164.0 (isolated default, backend identity unexposed) independently reviewed frozen source/document evidence in parallel without tool/test/network/write authority; both completed successfully. Input SHA-256 17444e50ab82fa23a130f7c2fb97bfb4ecf7060a5510bf2799a5dcd95da9050f remained unchanged. No mandatory source correction was found. Both required #339 to merge first; that dependency is satisfied in this branch's ancestry.

The coordinator clarified README package/asset scope and Korean independently managed skill wording, restored native-agent qualifiers, and reran documentation/reproducibility/install checks. Those narrow edits are not described as an identical-final-tree second CLI review.

Translation QA

Antigravity CLI 1.4.7 explicitly selected gemini-3.8-flash-medium, medium effort, plan mode/sandbox, fresh noninteractive structured review, no repository access or permission bypass. Initial four-language notes and changed README/runbook/map text: 114.632 seconds, structured success; input SHA-256 743096a1f805da859ebdfaab52dfe15bd279123ffd82bf00c9245d44772d5b62. Codex checked proposals against the English contract, applied qualifier/Korean wording corrections and rejected a claimed mistranslation of standalone script that contradicted the actual distribution context. A final bounded review of the clarified README paragraphs and final release notes completed successfully in 126.418 seconds without further translation corrections; input SHA-256 d8be475a073cea81847951e807e45cb8c1bc75a9b5312e108e2087121d1b5e39. Model selection is recorded; backend identity is not independently exposed. The model's unrelated backend-identity interpretation was not used as technical evidence.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T23:29:56.917928Z	06ae53a	PR opened
🔒 Security Review	✅ Completed 2026-10-26T23:29:29.447867Z	06ae53a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

v1.3.1 publication verified — 2026-10-27 KST

• Final source: 5391365c4896cd7eefa1ba2bbe20b9bed2075d8c; annotated tag object 44d47bf2e9ca5f1524985242bd19a9797ab51ab6, peeled to that source.
• fix(control): refresh patched Zod runtime dependency #339 and this preparation PR passed all 28 checks and automatic Codex code/security reviews with no findings before normal protected merges. Final main CI and CodeQL succeeded. The previously failing scheduled audit passed after the fix: 40419409906.
• Preparation run 40420622723, attempt 2 succeeded through attachment. Attempt 1 remains a recorded failure: upload returned SKILL.md already exists despite all seven actual files being byte-identical to its build artifact. Those files were preserved locally, the unpublished draft was recreated without moving the tag, and the full preparation was rerun. No published release asset was overwritten. Payload and manifest bytes stayed identical; provenance correctly records attempt 2. This recovery does not establish the cause of the first upload-response failure.
• All seven downloaded assets passed GitHub attestation checks constrained to the repository, prepare workflow, main source ref, exact source digest, GitHub OIDC issuer and hosted runners. Manifest, standalone, provenance fields and fresh remote asset digests also matched before publication.
• GitHub Release published 2026-10-26T23:40:08Z: stable Latest, immutable, release ID 424882825.
• Required pypi environment wait was directly observed before upload. Owner abruption approved it; the environment approval API confirms approved. No private PyPI login/binding recheck is claimed.
• Publisher and post-publication verification completed successfully at the exact source. PyPI v1.3.1 contains exactly the expected two non-yanked files: wheel uploaded 2026-10-26T23:42:25.294755Z, sdist 2026-10-26T23:42:27.332394Z.

Downloaded registry files independently match the immutable GitHub candidates:

File	SHA-256
session_peer-1.3.1-py3-none-any.whl	5297b432803ddb2645f44e01318d03be8b0dd9cad18dbb3bdc175a631f52bfd2
session_peer-1.3.1.tar.gz	e0d12960133d25399a43efedf0dbcfcfb5835fd8e5816b5282d1da37d02fb4fe

Each downloaded PyPI file was installed separately in a fresh local environment. Isolated purelib import, CLI version 1.3.1/help, pip check and JSON list against its own empty initialized Codex home passed. No native messages, production accounts, global installations, Control service deployment/restart or fleet update were performed. The Node source dependency fix requires a separately authorized operational rollout; publishing the Python package alone does not deploy it.

Bundled compatibility skill remains v0.4.0 SHA-256 debedd472e3b0c0c6844fb63f7fb2f17cb6c6cc8c3e981e9afd2531a35327af7. Existing v1.3.0 assets and frozen handoff contract/fixture were preserved.