# v0.13.2

**Status:** Pre-release. Final release metadata is recorded in `docs/releases/facts.json`.

Internal foundations release. No public API change. No wire format change. No new public package. No publish-manifest change.

## Summary

PEAC Protocol v0.13.2 lands the next layer of internal infrastructure on top of the v0.13.1 foundation. Every change in this release is observation-only, dev-only, or workspace-private; the canonical Zod-based validator, the existing JWS codec, and the published Hosted Verify contract remain authoritative and byte-stable from v0.13.1. The release publishes to npm `next` only and ships as a GitHub prerelease; no `latest` promotion.

## Highlights

- **Workspace-private resolver composition layer.** A workspace-private package was added that composes existing published primitives (`@peac/net-node`, `@peac/jwks-cache`, `@peac/kernel`, `@peac/crypto`) behind a verifier-oriented interface. The package is absent from the publish manifest and from every public surface; no published package depends on it at runtime.
- **Shadow-mode pointer-fetch foundation in `apps/api`.** A workspace-private foundation exposes a lazy-import boundary, bounded normalization shapes, a redaction-safe in-memory ring-buffer mismatch sink with a progressive-degradation cap, a pure-function parity verdict computer, and a factory-injected execution wrapper. Default OFF. Internal-only flags (`PEAC_INTERNAL_SHADOW_RESOLVER`, `PEAC_INTERNAL_SHADOW_BUFFER_SIZE`) are documented in `docs/STABILITY-CONTRACT.md`. Live route shadowing is intentionally not wired in this release; Hosted Verify accepts inline compact JWS receipts today, not pointer URLs.
- **Hosted Verify body-size boundary coverage.** Exact-byte boundary tests assert that requests at exactly `MAX_BODY_SIZE` (256 KiB) on `/v1/verify` and `/v1/issue` do not return `E_PAYLOAD_TOO_LARGE`, while requests at `MAX_BODY_SIZE + 1` do. Other receipt-content invariants (nesting depth, array length, object keys, string length, total nodes) were already covered upstream by `packages/protocol/__tests__/_internal/resource-limits.test.ts` and the schema constraint tests; this release closes the remaining app-level gap.
- **Workspace-private compat reader / writer / validator finalized.** `serializeArchivalBundle` returns deterministic JSON with stable key order at every level; the writer validates first and never emits malformed output. `parseArchivalBundle` parses and validates with throwing semantics. `validateArchivalBundle` returns a discriminated-union result. Cyclic payloads and sparse arrays are rejected as `archival_invalid_payload`. Version-mismatch error messages state the constraint without echoing caller input.
- **Release validation diagnostics.** `docs/diagnostics/SHADOW-MISMATCHES.md` and `docs/diagnostics/RELEASE-EXERCISE-v0.13.2.md` record what v0.13.2 validated and what it explicitly did not validate (no third-party external party exercise; no live Hosted Verify route shadow exercise).
- **Dependabot alert closure.** All 16 open Dependabot alerts present at the start of the v0.13.2 window were closed: `handlebars` family (1 critical, 3 high, 2 medium, 1 low; all dev-only via `ts-jest` upgrade); `hono` (1 medium runtime; reachability audit confirmed `hono/jsx` is not imported, upgraded for hygiene anyway); 8 dev-only alerts via range-scoped `pnpm.overrides` (`defu`, `vite` ×2, `esbuild`, `next`, `postcss`, `undici` ×2). 0 open alerts on the release commit.

## Compatibility

- `@peac/protocol.{issue, verifyLocal}` signatures and serialized output: byte-identical to v0.13.1.
- Wire format (`peac-receipt/0.1` envelope, `interaction-record+jwt` JWS `typ`): unchanged.
- `@peac/kernel` public TypeScript surface: byte-stable from v0.13.1 (no new exports, no removed exports, no deprecation markers added).
- OpenAPI verify contract: unchanged.
- Error code count: 186 (unchanged); no new emitted-on-primary-path codes.
- Extension group count: 12 (unchanged).
- Active publish-manifest count: 36 (unchanged from v0.13.1).
- Workspace-private packages remain workspace-private; absent from `pnpm publish --dry-run --recursive`.

## Release posture

- npm dist-tag: `next` only. **No `latest` promotion in this release.**
- GitHub Release: prerelease, authored manually under the maintainer GitHub account.
- Strict closeout: `verify:release-closeout --stage publish` (publish stage only; no promote stage).
- Workspace-private packages are not published; they remain workspace-only and never appear on npm.

## Migration

No migration is required. Every public symbol from v0.13.1 continues to behave identically.

## Verification

```bash
pnpm install
pnpm build
pnpm test
pnpm verify:release
node scripts/verify-no-semantic-widening.mjs
node scripts/verify-dist-private-leaks.mjs
```

All gates green on the merge commit.
