# v0.13.4 — Validation Readiness and Runtime Invariants

**Status:** Pre-release. Final release metadata is recorded in `docs/releases/facts.json`.

This release is behavior-preserving. It strengthens runtime-invariant
verification coverage, internal validation parity coverage, and
release-gate checks.

There is no public API change, wire-format change, package-surface
change, extension-key change, or default-path behavior change.

## Highlights

- **Resource-limit reference verifier.** `scripts/verify-trust-artifacts.mjs`
  gains a fourth check covering `docs/specs/RESOURCE-LIMITS.md`
  invariant tables; every Constant + Test column markdown link must
  resolve to a tracked file. Locks the existing 23 invariant rows
  against future drift. A stale MCP mapping test path is corrected
  to a current source location.
- **Internal-only flag documented.** `docs/STABILITY-CONTRACT.md`
  internal-only flags table gains a row for the internal rollback
  flag plumbed in v0.13.3. Operator guidance continues at
  `docs/diagnostics/ROLLBACK-PATH.md`.
- **Rollback-path matrix is a release gate.** The protocol
  rollback-path matrix is promoted to a release-class gate covering
  Node 22 and Node 24 LTS across both rollback-path modes (4 cells).
  `publish.yml` runs the same matrix as a preflight at the tagged
  SHA; `publish_dry_run` and `publish_prod` declare it as a `needs:`
  dependency, hard-blocking publish on any failure. Advisory
  Current-Node lane runs with `continue-on-error: true`.
- **Internal validation parity coverage expanded.** Seven canonical-
  composed validators (schema-parse, jose-typ-strictness,
  iat-not-yet-valid, policy-binding, unknown-extension-grammar,
  type-extension-enforcement, signature). The first six are wired
  into `runBoundedValidatorShadow` as optional-input layers; the
  signature wrapper is exported standalone. A canonical-vs-candidate
  differential test runs against 230 fixtures from the existing
  manifest and asserts byte-equality of the candidate verdict with
  the canonical verdict.

## Compatibility

- `@peac/protocol.{issue, verifyLocal, verify}`: public TypeScript
  signatures unchanged. Wire-format behavior and default-path
  behavior unchanged.
- Wire format (`peac-receipt/0.1` envelope, `interaction-record+jwt`
  JWS `typ`): unchanged.
- Active publish-manifest count: 36 (unchanged).
- Extension group count: 12 (unchanged).
- Error code count: 186 (unchanged); no new emitted-on-primary-path
  codes.
- OpenAPI verify contract: unchanged. OpenAPI 3.1.x unchanged.
- Workspace-private packages remain workspace-private; absent from
  `pnpm publish --dry-run --recursive`.
- No new emitted error code on primary paths. No new public extension
  key. No new typ.

## Release posture

- npm dist-tag: `next` only. **No `latest` promotion in this release.**
- GitHub Release: prerelease, authored manually under the maintainer
  GitHub account.
- Strict closeout: `verify:release-closeout --stage publish` (publish
  stage only; no promote stage).
- Workspace-private packages are not published; they remain
  workspace-only and never appear on npm.

## Migration

No migration is required. Every public symbol from v0.13.3 continues
to behave identically.

## Verification

```bash
pnpm install
pnpm build
pnpm test
pnpm verify:release
node scripts/verify-no-semantic-widening.mjs
node scripts/verify-dist-private-leaks.mjs
node scripts/verify-trust-artifacts.mjs
```

All gates green on the merge commit. Operators investigating the
internal rollback flag should consult
[docs/diagnostics/ROLLBACK-PATH.md](../diagnostics/ROLLBACK-PATH.md).
Operators reviewing invariant coverage should consult
[docs/specs/RESOURCE-LIMITS.md](../specs/RESOURCE-LIMITS.md).
