# v0.13.1

**Status:** Pre-release. Final release metadata is recorded in `docs/releases/facts.json`.

Internal foundations release. No public API change. No wire format change. No new public package.

## Summary

PEAC Protocol v0.13.1 lands the next layer of internal infrastructure that the v0.13.x reboot sequencing depends on. The work is observation-only on every public surface: the canonical Zod-based validator and the existing JWS codec remain authoritative; the new internal modules execute alongside them under an internal-only flag and surface divergence into a bounded in-memory log. The release publishes to npm `next` only and ships as a GitHub prerelease; no `latest` promotion.

## Highlights

- **Internal validator parity foundation continues.** The PR-C-shipped bounded validator pipeline is now exercised through an observation-only scheduler in `@peac/protocol` so divergence from the canonical Zod path becomes visible during nightly CI without changing any public-call return value.
- **Adversarial redaction coverage.** Every secret class registered in the internal redaction module has a paired adversarial test vector (compact JWS / PEM block variants / long base64 / Bearer / generic Authorization / Cookie / Set-Cookie / X-Auth-Token / URL query token / API key / AWS access key ID / email / phone) and a benign control vector that proves the patterns do not over-match.
- **Mutation, resource-limit, and fuzz tests.** A deterministic mutation oracle suite asserts that every byte-level mutation of a valid Wire 0.2 JWS is rejected with a registered `E_*` error code. Receipt-content invariants from `docs/specs/RESOURCE-LIMITS.md` are pinned with at-bound-pass and at-bound-plus-one-fail vectors. A `fast-check`-driven property suite runs 200 inputs per property against `verifyLocal`.
- **Local CI parity.** A new pre-push strict gate runs `scripts/ci/forbid-strings.sh`, `gofmt -l`, and `go vet ./...` so contributors catch CI-only failures before pushing.
- **Linguist hygiene.** `archive/` is marked `linguist-vendored` so the repository language statistics reflect active source rather than preserved historical material.
- **Stability contract update.** `docs/STABILITY-CONTRACT.md` adds an Internal-only flags section and a Shadow-mode timeout guarantee class section so the cooperative-timeout shape and the internal flag's allowed locations are documented for maintainers and security researchers.
- **Discovery package retirement carries forward.** `@peac/disc` remains absent from the active publish manifest (count holds at 36). Historical npm versions remain installable with the deprecation messages dispatched at the prior release.

## Compatibility

- `@peac/protocol.{issue, verifyLocal}` signatures and serialized output: byte-identical to v0.13.0 for every conformance fixture and every example.
- Wire format (`peac-receipt/0.1` envelope and `interaction-record+jwt` JWS `typ`): unchanged.
- `@peac/kernel` public TypeScript surface: byte-stable from v0.13.0 (no new exports, no removed exports, no deprecation markers added).
- OpenAPI verify contract: unchanged.
- Error code count: 186 (unchanged); no new emitted-on-primary-path codes.
- Extension group count: 12 (unchanged).
- Active publish-manifest count: 36 (unchanged from v0.13.0).

## Release posture

- npm dist-tag: `next` only. **No `latest` promotion in this release.**
- GitHub Release: prerelease, authored manually under the maintainer GitHub account.
- Strict closeout: `verify:release-closeout --stage publish` (publish stage only; no promote stage).
- Internal workspace-private packages are not published; they remain workspace-only and never appear on npm.

## Migration

No migration is required for consumers of `@peac/protocol`, `@peac/kernel`, `@peac/schema`, `@peac/crypto`, or any other published package. Every public symbol from v0.13.0 continues to behave identically.

The discovery-package migration shipped at v0.13.0 still applies to anyone moving off `@peac/disc`:

- `import { parse } from '@peac/disc'` → `import { parsePolicyDocument } from '@peac/policy-kit'`
- `import { discover } from '@peac/disc'` → inline using `@peac/net-node.safeFetch` followed by `@peac/policy-kit.parsePolicyDocument`. The `peac discover <url>` CLI command continues to work via this composition; see `packages/cli/src/commands/discover.ts` for the reference wiring.

## Verification

```bash
pnpm install
pnpm build
pnpm test
pnpm verify:release
node scripts/verify-no-semantic-widening.mjs
node scripts/verify-dist-private-leaks.mjs
```

All gates green on the merge commit.
