[abruption]

Summary

Prepares v1.4.2, an unpublished maintenance candidate based on integrated main c265861d5251f8bab65229521444168e23bc13a9, after merged PR #372 and #374. The previous stable version is v1.4.1.

• Bump the core and generated standalone version to 1.4.2, align current README notices and version guards, add four-language maintenance notes/runbook checkpoints, and refresh the 56-source translation manifest.
• Include the already-merged bounded watch-test pipe observations and POSIX test-matrix/core-step ceilings from test(handoff): bound missing pipe output and CI execution #372, plus operator terminology and documentation-verifier maintenance from docs: align localized operator terminology with English contracts #374.
• Product runtime changes only in the version value. No runtime-defect or original-CI-stall-cause claim, new feature, native/SSH/ACK acceptance or platform promotion.
• Skill support copy remains 0.5.1 / min 0.9.1 / documented full coverage 1.4.0, receiver codexBin floor 1.0.1, source 95cf5e1dd92654775b2f0ea86c1cb4b6107f49c3, 31688 bytes, SHA-256 922512869577cc3d8b9d305641479e2dd659f0e669298584ca06f1ca15de1d31. Skill/plugin/Control versions are independent.

Issue references

Refs #370, #373. Merged source work: #372, #374. Separate work remains open: #316 monitoring, #367 aggregate discovery and Long-term native/storage/generation/handoff research.

Type

• docs
• chore / refactor / test / perf

Validation

Python 3.13.7, macOS arm64, task-private environment with MCP 1.30.0, websockets 17.4, cryptography 50.0.2. Build tooling: build 1.6.1, packaging 26.3, isolated hatchling 1.32.4. Node 24.22.1, npm 11.19.1.

Area	Result and limit
Docs / source	92 tests pass; generator --check and git diff --check pass. Historical runbook suffixes are byte-preserved. Frozen English handoff contract and golden JSON fixture are unchanged.
Full local suite	1872 run, 5 failures, 32 errors, 22 skipped with TMPDIR on a macOS external volume whose ownership enforcement is disabled and whose volume ancestor is group-writable (0775). Failures are secure preset/SSH-config storage checks; two representative tests also fail at exact base c265861 in that environment. This run is not represented as fully passing.
Authorized permission rerun	The owner separately allowed internal /tmp for these tests. 71 affected-module tests run: OK, 3 platform skips in a new 0700, current-user/current-group directory. An initial internal attempt exposed kernel-cleared setgid under inherited wheel group; a read-only-mode probe confirmed the requested 02600 had become 0600 before the reader. Only the new test directory's group was set to the user's primary group, then the real mode assertions passed. No security guard/assertion or host membership/volume setting was changed. Created internal folders were removed; logs stayed on the approved external root.
Rehearsal artifacts	Two final-source builds are byte-reproducible with SOURCE_DATE_EPOCH fixed to the base commit timestamp; archive metadata, standalone and local SHA256SUMS checks pass. Distribution suite: 41 run, OK with 3 PowerShell skips. These local artifacts are not workflow-attested publication assets.
Fresh installs	Independent wheel/sdist environments validate isolated site-packages import, version 1.4.2, help, pip check and empty listing using an explicitly isolated Claude config. The final wheel is byte-identical to the independently installed rehearsal wheel; the revised final sdist was installed separately again. No user session inventory or live message submission.
Dependencies	Python audit: 59 records, no known vulnerabilities in auditable dependencies; unpublished session-peer 1.4.2 itself is skipped because it has no PyPI advisory record. Node production audit: 0 vulnerabilities. Node runtime tests were not run locally; current-base/current-PR CI provide their own evidence.

Independent CLI review before PR

Technical review: Claude Code 2.1.314 / requested and modelUsage-confirmed claude-opus-5-5 and Antigravity CLI 1.5.1 / init-confirmed gemini-4-argon-medium, independent fresh non-interactive read-only calls on the identical 39412-byte frozen input, SHA-256 883ae438faaf091dbffda3ae299e896fcb6c54b00644070f04469b2edbe43c37. Claude: 110.340s, Argon: 69.867s, exit 0 and valid substantive results. Claude tools disabled/plan/no session persistence; Argon plan+sandbox/medium, 600-second timeout. No permission bypass or reviewer tool execution. Tests/builds did not overlap these calls.

Claude's fixture ambiguity was addressed by linking the unchanged English contract and its exact golden fixture separately from the modified watch-test helper. Asset count now explicitly includes SHA256SUMS/provenance; fatal-signal faulthandler and POSIX job/step limits are scoped precisely. Argon found no blocking implementation/contract correction. Its suggestion about docs/releasing.md was checked against the actual root RELEASING.md and valid root-relative links. Current-head CI, real tagged-main verification and genuine attestations remain distinct future gates. Supplemental evidence includes the baseline reproduction, authorized 71-test rerun, current pypi reviewer policy, unchanged component-version scan, skill hash and exclusion from both archives.

User-selected translation QA: Antigravity CLI 1.5.1 / gemini-3.8-flash-medium / medium, fresh plan+sandbox read-only calls over all four candidate README paragraphs, new runbook sections and complete v1.4.2 notes (12 files). Initial 29226-byte input SHA-256 f1614c4b43d96e7b601b657fd06e39a089303c455c41ff02ff71bc219721342b, 85.222s. Codex compared feedback with source: clarified test-code context and documented workflow coverage, preserved correct protocol confirmation wording and declined universal/full-support claims. Final 30823-byte input SHA-256 770fe9f1506d2841e6769e21d28380c47d678602d0038524c6df84d70f19096e, 122.247s, exit 0/SUCCESS, 0 concrete errors reported. Final source text did not change after that translation pass. No retry/fallback. These are document/source reviews, not new live agent/platform qualifications; technical reviewers were not rerun after the small source-checked document clarifications.

Verified baseline / remaining publication gates

• Exact integrated-base CI 41996309015 SUCCESS and main Push 41996309005 SUCCESS; these do not replace this PR head or the future merged-main CI.
• GitHub stable immutable v1.4.1/source 6e9efda7588e1df638748eeb7ad1b2707e0a3bf4 and non-yanked PyPI wheel/sdist were independently checked; PyPI hashes match GitHub asset digests. v1.4.2 remote tag/release/PyPI were absent at the dated read-only preflight, not reserved.

Read-only prior publication evidence: GitHub v1.4.1 published 2026-11-03T00:31:17Z; source 6e9efda7588e1df638748eeb7ad1b2707e0a3bf4. This PR preserves existing dated preparation notes rather than rewriting them as publication evidence.

Previous PyPI file	Uploaded UTC	SHA-256
session_peer-1.4.1-py3-none-any.whl	2026-11-03T00:33:24.925576Z	b6e4bb1f7cb7f3e4a8bf1bc8a8d4e91906a19fa735b68ffb30ecba1f8e88732f
session_peer-1.4.1.tar.gz	2026-11-03T00:33:26.451298Z	b0d5e6e74fa5c94a8ed977093742cf45a92d940abd7479c3adeaf623f9b4f00c

• Current GitHub pypi environment has required reviewer abruption. Private PyPI Trusted Publisher binding was not newly verified. Normal human environment approval remains mandatory; bypass capability was not used and no protection was changed.
• This request authorizes preparation only. No merge, tag, draft release, workflow dispatch, publication, global installation, service restart or deployment. Actual verify-source, seven workflow-built assets, authenticated attestations and release-provenance.json require the later separately authorized exact tagged protected-main source. No fake project tag, run ID or provenance is used to pass those gates. Old immutable assets/history remain untouched.

Checklist

• CLI version/help checked in independently installed packages
• Generated standalone checked
• Conventional commit
• User documentation/translations and canonical manifest aligned
• No secrets, tokens or session keys added

Current-head remote result

Head b741067b6e7b4e9270f7f56e47613f73641759e5: 43/43 checks SUCCESS, including CI 42000988756, release gate, CodeQL and GitGuardian. Automatic code review completed at this head with has_any_findings=false / has_unresolved_findings=false; no inline review comments. Automatic security review also completed at this head; its finding flags are null rather than an asserted false/security certification. No manual Codex mention was sent on PR creation.

Post-merge checkpoint — 2026-11-05

The owner merged PR #375 at 27b088735f065b6785dc6f3892cf132926657bdf. Its tree 6ac3e76bd7604bd578007b9731350aa47dbb7434 is identical to reviewed head b741067. Exact merged-main CI 42002500456 completed SUCCESS with 37/37 jobs successful; CodeQL / Push on main 42002500081 also succeeded.

Authorized publication checkpoint — 2026-11-05

After merge, the owner separately authorized tag/draft/workflow preparation and actual GitHub/PyPI publication. Lightweight v1.4.2 points to 27b088735f065b6785dc6f3892cf132926657bdf. Preparation run 42004210137 succeeded in all five jobs, including fresh installs, dependency audits and attachment of all seven assets. All seven cryptographic attestations passed exact source/ref/signer/OIDC/hosted-runner policy; independent asset/manifest/provenance checks also passed.

GitHub v1.4.2 was published at 2026-11-05T09:45:30Z, stable/Latest, immutable=true. The canonical locked-release downloader passed, and all seven locked files remain byte-identical to the verified draft.

Publish run 42005013865 completed SUCCESS in all 6 jobs, including locked-asset revalidation, fresh wheel/sdist installs, dependency audits, Trusted Publishing and post-upload PyPI verification. The pypi gate was directly observed pending, then actual review history confirmed abruption approved pypi; the owner also confirmed completion in chat. The review API exposes no exact decision timestamp, so none is inferred.

PyPI uploaded the non-yanked wheel at 2026-11-05T09:47:52.170326Z, SHA-256 fb9a409603daeca922c325a65c7c1d164d41f517b68af9244d4fd6d806fb9317, and sdist at 2026-11-05T09:47:54.295391Z, SHA-256 98a227a6cd9e72f801ba677a453edca8b81317648af456bc6e3bd9845bb0add8. Exact filenames, downloaded bytes and hashes match the immutable attested GitHub candidates. Additional fresh wheel/sdist environments passed isolated site-packages import/version/help/pip check/private-empty-list smoke. Normal read-only GitHub update selection and the public pip index select 1.4.2.

Publication is complete and independently verified. No protection bypass, asset replacement, global installation or service rollout. Post-publication documentation PR #376 appends actual records and refreshes current source status while preserving all frozen preparation records and assets; it is separate from the published source27.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T09:17:49.008682Z	b741067	PR opened
🔒 Security Review	✅ Completed 2026-11-05T09:19:31.739340Z	b741067	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.