[#986] 2.5.0

[realproject7]

Fixes #986

EPIC Alignment

• Parent: [EPIC] QuadWork v2.4.0 hardening & quality pass — audit remediation #967 — QuadWork v2.4.0 hardening & quality pass
• Epic goal: Ship the hardening EPIC's fixes to users.
• This PR's role: Version bump 2.4.0 → 2.5.0 so all 9 merged fix tickets reach users via npm/auto-reseed.
• Contracts consumed/exposed: version fields only; minor bump per standing convention
• Fits with merged siblings: the release payload for [#S1] CI on PRs + release test-gate + pack-smoke extension #976·[#S3] Fix QueueManager markdown XSS — switch to react-markdown #969·[#S4] activity/log path traversal + bridge reserved-sender + reviewer-token-path scoping #970·[#S2] WS/PTY auth + Origin allowlist (tailnet keystroke-injection) #968·[#S6] shutdown() cleanup + fix quadwork stop PID handling #972·[#S5] Atomic config writes + field-scoped flag endpoints (kill whole-config races) #971·[#S7] Frontend correctness bundle (chat auth banner, project-switch race, rename-clobber, confirms) #973·[#S8] Setup hardening (stale-branch reuse, seed hard-fail, reviewer-token, EADDRINUSE) #974·[#S9] De-block the event loop (file-chat busy-wait, butler/setup execFileSync) #975 (all merged since v2.4.0)

Self-Verification

• Bump: npm version minor --no-git-tag-version → v2.5.0; diff = package.json + package-lock.json only (+3/−3)
• Tests: node --test server/pack-smoke.test.js → pass 1, fail 0 (full suite gated by CI)
• Kill-list scan: clean (version fields only)

Deviations

none

🤖 Generated with Claude Code

[realproject7]

APPROVE at 8bb55d0d57a9540e2affa484b291f9621351889e

Review of the operator-authored release-prep PR #987 (issue #986, 2.4.0 → 2.5.0 minor bump shipping all 9 merged EPIC #967 fixes). Comment-based approval (shared reviewer GH identity blocks a formal Approve).

Checked (evidence)

• Scope is exactly 2 files, nothing else — gh pr view 987 --json files: package.json (+1/-1), package-lock.json (+2/-2). No source/test/config drift.
• Diff is purely the version bump — package.json:3 2.4.0 → 2.5.0; package-lock.json:3 (root) and package-lock.json:9 (packages[""].version) both 2.4.0 → 2.5.0. No dependency or lockfile-tree changes.
• Versions in sync — at head all three version fields read 2.5.0 (package.json + both package-lock.json occurrences).
• Semver — 2.4.0 → 2.5.0 is a correct minor bump for the shipped feature/fix set; base is main.
• CI (pack-smoke + full suite) — test: COMPLETED SUCCESS at head 8bb55d0d.

Verification

Head re-checked as 8bb55d0d57a9540e2affa484b291f9621351889e immediately before this verdict; CI green. No findings.

[project7-interns]

Verdict: APPROVE

Epic Alignment: PASS

#986 releases the completed #967 hardening fixes via a version-only 2.4.0 -> 2.5.0 bump, matching the ticket contract: package files only, no code changes.

Checked (evidence)

• Structural gate: PR body contains Fixes #986, filled ## EPIC Alignment, and filled ## Self-Verification.
• Context: gh issue view 986 and gh api repos/realproject7/quadwork/issues/967 read live; #967 shows all 9 fix tickets #976/#968/#969/#970/#971/#972/#973/#974/#975 complete.
• Diff scope: gh pr diff 987 --name-only -> exactly package.json, package-lock.json.
• Version sync: package.json:3 is 2.5.0; package-lock.json:3 and package-lock.json:8 are 2.5.0.
• Full diff: only the three version fields change from 2.4.0 to 2.5.0.
• Riskiest part of this diff: release metadata drift; acceptable because package and lockfile root versions are synchronized and no other diff exists.
• Kill-list: scanned all items — clean; version fields only, no code/runtime path touched.
• CI: gh pr checks 987 -> test pass, 58s.

Findings

None.

Decision

Approved. PR #987 satisfies #986 acceptance criteria: synchronized 2.5.0 versions, no other diff, and live CI passing on current head 8bb55d0d57a9540e2affa484b291f9621351889e.