From 655ad68e534def1d4984c64e163c153b61034201 Mon Sep 17 00:00:00 2001 From: Andrei Hasna Date: Sun, 2 Aug 2026 13:16:28 +0300 Subject: [PATCH 1/2] =?UTF-8?q?chore(release):=20instructions=200.4.18=20?= =?UTF-8?q?=E2=80=94=20publish=20the=20source-visibility=20commits?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three commits landed on main after the 0.4.17 release commit 41a1bfa and have no release of their own: d9eaa6a (#50, report every discarded instruction source, todos 0c7ffd33), 04a6f46 (#51, reconcile registered global-* sources against render coverage) and 8c494b8 (#52, the retired-global-source tag mechanism). main still declared "version": "0.4.17" while npm latest is 0.4.17, published 2026-08-02T02:04:23.641Z. Publishing from main as-is therefore returns EPUBLISHCONFLICT, which on this fleet is routinely misdiagnosed as a token or registry failure and sends the publisher to debug the credential instead of the version. Raised as P1 by the pr50-merged-correctness reviewer. This is a version bump plus the changelog entry that documents what ships. No source file is touched and no behaviour changes. Verified in this worktree at base 8c494b8: full suite 565 pass / 0 fail / 2358 expect() calls across 46 files, rc=0, unpiped and redirected to a file; tsc --noEmit rc=0 with empty stdout and stderr. Agent: publius-instructions-0418 --- CHANGELOG.md | 35 +++++++++++++++++++++++++++++++++++ package.json | 2 +- 2 files changed, 36 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5b65abc..8993a46 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,40 @@ # Changelog +## 0.4.18 + +Publishes the three source-visibility commits that landed on `main` after the +0.4.17 release commit and had no release of their own. **No behaviour in the +render itself changes in this release** — the collapse and override rules are +byte-identical; what changes is that a discarded source is now reported instead +of vanishing. + +**`session plan` / `session apply` now name every source the render discards** +(#50, todos `0c7ffd33`). `deduplicateSemanticPolicySources` collapses every +source whose content carries the `` +sentinel down to one, by priority-then-version, and `composeSources` discards +earlier overridable layers ahead of a `merge:"replace"` source. Both were +silent: `manifest.warnings` and `manifest.skippedSources` existed and neither +was ever populated, so a lost source was invisible in the exit code, the +warnings surface and the manifest alike. Both eviction directions now record +the discarded source **and** the source that superseded it. + +The exit status is deliberately still 0. A policy collapse is a legitimate +outcome, and the fleet render runs `session apply` under `set -euo pipefail` +across every profile home — failing hard would abort the sweep mid-flight and +leave a partial render, which is a worse failure than the one being reported. + +**Registered `global-*` sources are reconciled against render coverage** (#51), +so a source that is registered but reaches no rendered home is surfaced rather +than assumed present. + +**`instructions tag --add/--remove `** (#52) ships the mechanism for +the `retired-global-source` tag that #51 introduced and could not set. Exactly +one production row carries it: `global-hasna-deployment-terms`, the owner-ruled +withdrawal of 2026-07-29. The byte-identical `global-agent-rules-standard-1/-2/-3` +rows are deliberately **not** tagged — they are the output of an active +duplicate-minting defect (`43d0c1c0`), and tagging them would mark a live bug's +output as intentional in the one surface built to reveal it. + ## 0.4.16 Closes **relocation**, the third and last credential-destruction route, which diff --git a/package.json b/package.json index 9af2aae..04595c0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@hasna/instructions", - "version": "0.4.17", + "version": "0.4.18", "description": "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.", "type": "module", "main": "dist/index.js", From c93d489249ef9d8e0c0258c5b847cc14623df37b Mon Sep 17 00:00:00 2001 From: Andrei Hasna Date: Sun, 2 Aug 2026 13:30:20 +0300 Subject: [PATCH 2/2] docs(changelog): stop enumerating the duplicate global-agent-rules-standard rows Adversarial review of the 0.4.18 bump (pr53-release-bump, GO) found the entry's claim that the untagged duplicate family is global-agent-rules-standard-1/-2/-3 was already stale when written: the live registry carries eight, and five of those predate the commit that named three. The defect that mints them (43d0c1c0) is still open and unowned, so any list written here goes stale again. Replaces the enumeration with a pointer to the registry and states why the exclusion is content-driven rather than a slug list. The behaviour being described is unchanged and was correct; only the enumeration was wrong. Agent: publius-instructions-0418 --- CHANGELOG.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8993a46..7c4c02e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,11 +30,20 @@ than assumed present. **`instructions tag --add/--remove `** (#52) ships the mechanism for the `retired-global-source` tag that #51 introduced and could not set. Exactly one production row carries it: `global-hasna-deployment-terms`, the owner-ruled -withdrawal of 2026-07-29. The byte-identical `global-agent-rules-standard-1/-2/-3` +withdrawal of 2026-07-29. The byte-identical `global-agent-rules-standard-N` rows are deliberately **not** tagged — they are the output of an active duplicate-minting defect (`43d0c1c0`), and tagging them would mark a live bug's output as intentional in the one surface built to reveal it. +That family is **not finite and this entry deliberately does not enumerate it**: +read the current membership from the registry rather than from this paragraph. +An adversarial review of the 0.4.18 bump found it had already grown past the +three rows an earlier draft named, five of the additions predating that draft. +A count written here acquires the same shelf life the wrong one had, which is +the argument for the tag being content-driven rather than a slug list — a +synthetic member surfaces as a gap with no code change and no slug +special-casing. + ## 0.4.16 Closes **relocation**, the third and last credential-destruction route, which