# v0.14.1 — Execution Surfaces + Observational Lifecycle Records

**Status:** Pre-release. Final release metadata is recorded in `docs/releases/facts.json`.

PEAC gives APIs, agents, MCP tools, A2A handoffs, and CLI workflows a
portable signed record that can be verified outside the system that
produced it.

This release adds three new record surfaces (A2A handoff observation
records, CLI command execution records, and observational lifecycle
records) plus a small set of cleanup and consistency improvements.

## Highlights

- Three new record surfaces: A2A handoff observations, CLI command
  execution records, and observational lifecycle records.
- Sandbox issuer now issues current Wire records via the validated
  protocol path.
- Seven canonical examples migrated to current-Wire issuance and
  verification; two examples remain Wire 0.1 with explicit legacy
  markers.
- Public-docs and adapter wording aligned to records-layer scope.
- npm `next` channel only. No `latest` promotion in this release.

## New record surfaces

### A2A handoff observation records

New `org.peacprotocol/a2a-handoff` extension namespace with 10
receipt-type URIs covering A2A v1.0 task, message, and artifact
handoffs. New normative spec `docs/specs/A2A-HANDOFF-RECORDS.md`.
Conformance Section 28 `A2A-HOBS-001..010`. The signature-observation
field shape is caller-reported; the helper does not import
signature-verification APIs.

### CLI command execution records

New `peac observe command` (unsigned JSON observation) and
`peac record command` (compact JWS, signed) verb-group surfaces in
`@peac/cli`. New `org.peacprotocol/cli-execution` extension namespace
plus `org.peacprotocol/cli-command-execution` receipt-type URI. New
normative spec `docs/specs/CLI-CARRIER-PROFILE.md`. Conformance
Section 29 `CLI-EXEC-001..006`. Hard security defaults are locked:
double opt-in for raw capture and raw env modes; secret-scan on by
default; shell-binary detected without `--shell-mode` is a hard fail.

### Observational lifecycle records

New `peac emit lifecycle` CLI surface for signed lifecycle observation
records. New `org.peacprotocol/lifecycle-observation` extension
namespace with 9 receipt-type URIs covering approval, evaluation,
experiment, workflow-transition, and mode-observed events.
Grammar-based no-inline-value invariant (20 forbidden top-level keys;
opaque-reference grammar covering `ref:`, `urn:`, `did:`, `sha256:`,
`peac:`, `https:` prefixes). New normative spec
`docs/specs/LIFECYCLE-OBSERVATION-PROFILE.md`. Conformance Section 30
`LIFE-OBS-001..010`. OBSERVER scope; vendor-neutral orchestrator
boundary; OTel composition split into normative and informative
subsections.

## Developer and operator updates

### Sandbox issuer current-Wire issuance

The sandbox issuer now issues current Wire records via the validated
`@peac/protocol.issue()` path. The request body uses `sub` (subject
URL) instead of legacy `aud`; legacy `expires_in` is rejected with a
stable detail message. Discovery advertises the current Wire only.

### Current-Wire examples and legacy markers

Seven canonical examples (`mcp-tool-call`, `pay-per-crawl`,
`pay-per-inference`, `stripe-x402-crypto`, `telemetry-otel`,
`workflow-correlation`, `x402-node-server`) now demonstrate current
Wire issuance and verification. Two examples (`rsl-collective`,
`erc8004-feedback`) remain Wire 0.1 with explicit legacy-comment
markers preserving their conformance binding intent.

### Architecture and interoperability guidance

New architectural guidance documents the generic-core, profile,
adapter, and example boundary doctrine for OSS-neutral protocol
abstraction.

### Public-docs and adapter wording

Aligned the Go floor to `Go 1.26+` across all public docs. Aligned
the active paymentauth draft revision
(`draft-ryan-httpauth-payment-01`) in the integrator-kit README.
Refined adapter and mapping wording away from PEAC-control-plane
verbs toward records-layer and adapter-scoped wording.
`@deprecated` JSDoc on `issueWire01()` for new code paths. Wire 0.1
envelope, schemas, and internal `verifyLocalWire01()` remain
available for backward compatibility; new issuance is discouraged.

## Compatibility

- Wire format: unchanged.
- Public API: additive only.
- Package surface: unchanged published-package count (36).
- Extension keys: 12 → 15 extension groups; 10 → 30 receipt types
  (additive).
- Default observable behavior for existing surfaces: unchanged.
- Wire 0.1 issuance is retained for backward compatibility but
  discouraged for new applications.

## Validation

- Conformance Sections 28, 29, and 30 carry the new requirement IDs.
- The bounded validation gate continues to route Wire 0.2 issuance
  and local verification on the primary internal path.
- Existing Wire 0.2 verification, issuance, and carrier flows are
  unchanged.

## Distribution

This release is published to the npm `next` channel only. The
`latest` channel is unchanged. The publish workflow authors the
GitHub Release as a prerelease after the maintainer authorizes
tagging.

## References

- `specs/kernel/registries.json` — extension namespaces and
  receipt-type URIs.
- `specs/conformance/requirement-ids.json` — conformance
  requirement IDs by section.
- `docs/STABILITY-CONTRACT.md` — public-API and Wire-format
  stability contract.
- `docs/HOW-IT-WORKS.md` — operator-facing introduction.
- `docs/SOLUTIONS/` — operator recipes by use case.
