# v0.14.5 — Public Verification Readiness

PEAC v0.14.5 is a documentation-alignment release. It brings public
verification, security, stability, compatibility, and machine-readable
documentation up to the v0.14.4 release state. It records measured
local SLO baselines for `issue()` and `verifyLocal()`, clarifies the
supported-version table, classifies retired compatibility packages
consistently, refreshes the LLM-facing surface, and removes wording
that could imply PEAC controls, governs, or enforces runtime behavior.

Wire format unchanged. Signing envelope unchanged. Public schema
unchanged. Public API unchanged. CLI surface unchanged. Registered
extension groups (19), receipt types (61), conformance sections (32),
conformance requirement IDs (290), parity-corpus families (11), and
published package count (36) are all unchanged. No new package, no new
type URI, no new conformance ID, no runtime behavior change.

## Highlights

- Measured local SLO baselines stamped against the v0.14.4 machine
  profile in `docs/SLO.md` for `issue()` and `verifyLocal()`;
  reference verifier and MCP round-trip rows are marked explicitly as
  not included in this measured baseline.
- Supported-version table in `SECURITY.md` updated to list `v0.14.x`
  as Active (current), with concrete maintenance windows for
  `v0.13.x`, `v0.12.x`, and `v0.11.x` and an unchanged archival receipt
  format row.
- `@peac/disc` and `@peac/pref` are now formally `archived` in
  `docs/STABILITY-CONTRACT.md` and `docs/COMPATIBILITY_MATRIX.md`,
  consistent with the workspace state (source under `archive/`,
  absent from the publish manifest).
- `docs/TRUST-ARTIFACTS.md` no longer claims CLI execution carriers
  and lifecycle observation records are forthcoming; both shipped in
  v0.14.1 and are classified `stable`.
- `llms.txt` updated to records-first wording, canonical
  `npx -y @peac/mcp-server` install command, and vendor-neutral
  MCP-client phrasing.

## Documentation alignment

The changes target documents used by external reviewers, integrators,
and language models:

- **`docs/SLO.md`** — captures local protocol baselines (`issue()`
  p50/p95/p99 and `verifyLocal()` p50/p95/p99 against the documented
  machine profile), refreshes the version header to v0.14.4, points the
  capture command at the repo-root perf test
  (`tests/perf/wire02-slo.test.ts`), marks reference verifier and MCP
  rows as outside the measured baseline, clarifies regression policy,
  and switches generic "receipt size" wording to "record size".
- **`SECURITY.md`** — Active `v0.14.x` row added, Maintenance
  `v0.13.x` row added, `v0.12.x` demoted to Maintenance (critical
  security fixes only) with a concrete six-months-after-`v0.14.0`
  window, `v0.11.x` concrete six-months-after-`v0.13.0` window,
  archival receipt format row unchanged, "Last reviewed" refreshed. The carrier security section is rewritten to
  describe execution, lifecycle, and provisioning carriers as
  shipped, with the security posture restated explicitly and the
  carrier specs cited. External-review wording rewritten to state
  current coverage (CodeQL, dependency review, provenance
  attestations, audit gating, threat-model coverage, release
  verification) and the policy for listing completed third-party
  reviews with scope and date.
- **`docs/STABILITY-CONTRACT.md`** — classification table gains an
  `archived` row, `@peac/disc` reclassified `archived`, `@peac/pref`
  split out of the supporting-packages group and reclassified
  `archived`, the resolver-helper row uses neutral
  documented-verification-flows wording, unshipped experimental
  entries use current-boundary wording rather than forward-looking
  release language, the codec-flag row uses release-decision wording,
  the AbortSignal trailing paragraph rewritten to current-stability
  framing, and body prose uses "record-content invariants".
- **`docs/COMPATIBILITY_MATRIX.md`** — Deprecation Schedule rows added
  for `@peac/disc` and `@peac/pref`, mirroring the existing
  `@peac/core` and `@peac/sdk` archive rows and naming the canonical
  replacement packages.
- **`docs/TRUST-ARTIFACTS.md`** — the prior forward-looking
  carrier subsection is replaced with pointers to the shipped specs
  (`docs/specs/CLI-CARRIER-PROFILE.md`,
  `docs/specs/LIFECYCLE-OBSERVATION-PROFILE.md`,
  `docs/specs/PROVISIONING-LIFECYCLE-PROFILE.md`), and the
  classification list includes `archived`.
- **`llms.txt`** — "Last reviewed" date refreshed, install command
  switched to `npx -y @peac/mcp-server`, "What is PEAC" paragraph
  leads with interaction records, quick-start bullets use record
  verbs, package descriptions cite interaction records, named
  MCP-client examples removed for vendor-neutral phrasing, OpenAI
  adapter description switched from "inference receipts" to
  "inference records". `PEAC-Receipt`, `receipt_jws`, and
  `peac-receipt/0.1` are preserved as frozen identifiers.
- **`docs/specs/RESOURCE-LIMITS.md`** — kernel-invariant heading is
  "Record-content invariants", verifier-scoped wording for the
  256 KiB body limit, release-decision phrasing for the tightening
  and loosening rules.
- **`docs/specs/DISPUTE.md`** — verifier-scoped wording for the
  UPPERCASE canonical form rule.
- **`docs/compatibility/commerce-protocol-coverage.md`** —
  mapper-boundary-scoped wording for the explicit-finality rule.
- **`docs/SOLUTIONS/runtime-evidence-export.md`** — outcome audience
  block uses neutral "managed agent runtime or custom harness"
  phrasing instead of named-vendor enumeration, the related-surfaces
  bullet points at shipped CLI execution and lifecycle observation
  records, and the compatibility-matrix link label is corrected.

## Stability and archive classification

`@peac/disc` and `@peac/pref` are now formally `archived` in
`docs/STABILITY-CONTRACT.md` and `docs/COMPATIBILITY_MATRIX.md`. The
classification matches the existing workspace state: both packages'
source already lives under `archive/discovery/` and `archive/pref/`
respectively, neither is present in `scripts/publish-manifest.json`,
and `REPO_SURFACE_STATUS.json` plus `docs/SURFACE_STATUS.md` already
list both with `archived` state. Replacement paths:

- `@peac/disc` → `@peac/policy-kit` for `peac.txt` policy-document
  loading.
- `@peac/pref` → `@peac/mappings-content-signals` for AIPREF /
  robots.txt / tdmrep parsing.

Historical npm versions of both packages remain installable; new
integrations MUST NOT depend on either.

## Stable identifiers

No protocol identifier change. The reference identifiers below remain
frozen and unchanged from v0.14.4:

- Wire format `interaction-record+jwt` (Wire 0.2) and the archival
  receipt format path.
- `PEAC-Receipt` HTTP header.
- `receipt_jws` and `receipt_ref` MCP `_meta` keys
  (`org.peacprotocol/receipt_jws`, `org.peacprotocol/receipt_ref`).
- `peac-receipt/0.1` (Wire 0.1 archival identifier).
- All 19 extension-group namespaces and all 61 receipt-type URIs.
- The `@peac/protocol` `issue()`, `verify()`, `verifyLocal()` public
  API.

## Compatibility

- Wire 0.2 (`interaction-record+jwt`) issuance and verification:
  unchanged.
- Wire 0.1 (`peac-receipt/0.1`) verify-only compatibility: unchanged.
- Node minimum version: `>=22.0.0` (canonical 24.14.1).
- MCP SDK pin: `~1.28.0`.
- Counting model: 19 extension groups / 61 receipt types /
  290 conformance requirement IDs / 32 sections / 11 parity-corpus
  families / 36 published packages / 27 API contract `allKeys`.
- Test surface: 10,838 tests across 445 test files.
- Build targets: 107.

## Migration

No migration is required for existing integrations. Consumers of
`@peac/disc` and `@peac/pref` should plan migration to
`@peac/policy-kit` and `@peac/mappings-content-signals` respectively;
both archived packages remain installable from historical npm
versions for backward compatibility with existing deployments.

## Validation

This release was validated against the local gates:

- `node reference/scripts/verify-local-doc-truth.mjs` — clean.
- `node reference/scripts/verify-final-hygiene.mjs` — 7/7 PASS.
- `node reference/scripts/verify-private-wording-local.mjs` — clean.
- `bash scripts/ci/forbid-strings.sh` — clean.
- `pnpm format:check` — clean.
- `pnpm verify:release` — 25 PASS / 0 FAIL / 1 SKIP (skip is the
  release-tag gate report, generated during tag-push).
- `node scripts/find-invisible-unicode.mjs` over the changed surface —
  no dangerous Unicode characters.
- `pnpm test` — 10,838 / 10,838 tests pass across 445 files.

## Boundary

PEAC v0.14.5 does not change the protocol's boundary. PEAC continues
to record portable signed interaction records across organizational,
vendor, and runtime boundaries. It does not orchestrate, settle,
authorize, enforce policy, score trust, manage workflows, or host
runtime infrastructure. The release aligns public
documentation with what has shipped, what is current, what is
archived, and what the verifier actually does.
