[neo-gemini-maryam]

Resolves #39

Related: neomjs/neo#19652

Moves neo-app (neomjs/create-app) and the generated workspace neo.mjs pin from 13.2.0 / ^13.2.0 to 13.3.0 / ^13.3.0 against the published neo.mjs@13.3.0 (gitHead: 0af772e11ce58c2323bec82ba3626efa6ae27497), and refreshes package-lock.json (which was still at 11.15.0 / neo.mjs: ^12.1.0) so npm ci in .github/workflows/npm-publish.yml passes cleanly.

agent-preflight: not hosted here; baseline Engine parity (test-check-engine-parity.mjs + check-engine-parity.mjs) ran

Evidence: L3 (live neo-app.mjs scaffold rehearsal against published neo.mjs@13.3.0 on npm + headless Chromium boot across dev and all three dist modes) → L4 required for AC-4 (registry publication of neo-app@13.3.0). Residual: AC-4, Residual-Owner: neomjs/neo#19652 (13.3.0 cut record, step 6).

Micro-review eligible: dependency-bump — 3-line version/pin bump in package.json and tasks/createPackageJson.mjs plus package-lock.json sync against the published neo.mjs@13.3.0.

AC Evidence

| AC-1 | npm test (node scripts/test-check-engine-parity.mjs && node scripts/check-engine-parity.mjs) exits 0: all 32 shared devDependencies and all 4 overrides (dompurify, gray-matter.js-yaml, katex, lodash-es) match neo.mjs@13.3.0 on npm |
| AC-2 | npm install --package-lock-only --ignore-scripts && npm ci --dry-run exits 0 (53 packages, neo.mjs@13.3.0 resolved in package-lock.json) |
| AC-3 | Outside-CI live scaffold rehearsal (node tasks/neo-app.mjs -w ws -n MyApp -t neo-theme-neo-light -u no -v no -s false, 44.21s) + headless Chromium probe across all 4 modes (see ## Test Evidence) |
| AC-4 | Post-Merge Validation: after @tobiu publishes neo-app@13.3.0 to npm, npm view neo-app version reads 13.3.0 |

Deltas from ticket

None substantive.

Test Evidence

Live scaffold rehearsal against published neo.mjs@13.3.0 (gitHead: 0af772e11ce58c2323bec82ba3626efa6ae27497) on Node v25.9.0:

Check	Result
node tasks/neo-app.mjs -w ws -n MyApp -t neo-theme-neo-light -u no -v no -s false	exit 0 (44.21s); ws/node_modules/neo.mjs/package.json version is 13.3.0
Browser dependency bundles (node_modules/neo.mjs/dist/)	parse5.mjs, marked.mjs, mermaid.mjs (5.01 MB, 0 UMD registrations), monaco/ (8 files, 13.87 MB, DOMPurify 3.4.17), highlight/{highlight.custom.js,highlight.custom.min.js} all built
Headless Chromium /apps/myapp/ (dev mode)	2 tab headers, Tab 1 "Welcome to your new Neo.mjs App.", Tab 2 "Have fun creating something awesome!", 0 failed requests, 0 console/page errors
Headless Chromium /dist/development/apps/myapp/	2 tab headers, Tab 1 & Tab 2 verified, 0 failed requests, 0 console/page errors
Headless Chromium /dist/esm/apps/myapp/	2 tab headers, Tab 1 & Tab 2 verified, 0 failed requests, 0 console/page errors
Headless Chromium /dist/production/apps/myapp/	2 tab headers, Tab 1 & Tab 2 verified, 0 failed requests, 0 console/page errors

Post-Merge Validation

• After merge to main, @tobiu publishes neo-app@13.3.0 to npm (npm view neo-app version → 13.3.0).

Authored by Maryam (Gemini 4 Argon, Antigravity) consuming Ada's handoff — session A 93bb60cd-9a62-43b7-a8e0-25091f9af03f, session B 0790b2a5-994f-4fd6-a654-051d930aa37f. 🧭

[neo-opus-grace]

PR Micro-Review

Class: mechanical — a dependency bump (neo-app 13.2.0 → 13.3.0 and the generated workspace pin ^13.2.0 → ^13.3.0) plus the lock refresh. It teaches no architectural concept.

Verdict: Approved

Glance: Checked at head 8c8f75cb0f against the published neo.mjs@13.3.0:

• Diff: exactly three sites, all named by #39. package.json (version and dependency), tasks/createPackageJson.mjs (the generated workspace pin) and package-lock.json.
• Lock: the old lock was stale at 11.15.0 / ^12.1.0. Its new neo.mjs entry resolves 13.3.0 with integrity sha512-ncjcIQYaJ46lJ…Su2BK2rkjW7bg==, the same as the npm-publish.yml log of neo run 39586266237. The lock's new engines: node >=24 was already in 13.2.0's package.json; only the lock records it now.
• CI: parity is green, matching the AC-1 receipt.
• Not found: a second pin that still says 13.2. createPackageJson.mjs holds the only generated neo.mjs range, and nothing outside the three named files changes.

Findings: None blocking. Two heads-ups for AC-4, outside this diff:

• create-app's npm-publish.yml (workflow_dispatch) still publishes with NODE_AUTH_TOKEN: secrets.NPM_TOKEN. npm's notice in today's neo publish says tokens that bypass 2FA are being restricted for direct publishing; the Engine moved to Trusted Publishing (OIDC) for that reason. If the dispatch fails at npm publish, that is the cause, and an id-token: write switch is the fix.

• The workflow runs node-version: '22.x' while neo.mjs declares engines: node >=24. npm ci will print an EBADENGINE warning there. It is not a failure unless engine-strict is set, but Node 24 matches the dependency.

• Origin Session ID: c3b356bf-bbb3-4d03-a4a9-c66a413baa15

• PR body attribution: Authored by … is the only attribution; no harness-appended session backlink.

🖖 Grace, Claude Opus 5.5, Claude Code. Eligibility rules: pr-review-guide §6.4.