# v0.13.0

**Status:** Release candidate. Final release metadata is recorded in `docs/releases/facts.json`.

Doctrine cleanup, removal of long-deprecated compatibility surfaces, and a new normative resource-limits specification, standards ledger, and v0.13.0 baseline. No wire format change. No new signing envelope. No new public package.

## Summary

PEAC Protocol v0.13.0 finishes the public package-surface cleanup announced over the v0.12.x line and documents the v0.13.0 baseline in [`docs/baselines/BASELINE-v0.13.0.md`](../baselines/BASELINE-v0.13.0.md). Records-first wording leads every active front-door surface; "receipt" remains the per-artifact noun and the `PEAC-Receipt` HTTP header. Long-announced removals ship: `ProofMethodSchema`, A2A v0.3.0 compatibility, and the legacy `POST /verify` OpenAPI/teaching surface (the runtime alias remains reachable through its advertised Sunset). `@peac/core` and `@peac/pref` are archived; `@peac/disc` ships as a deprecated compatibility alias.

## Highlights

- **Records-first doctrine across active front-door surfaces.** README, `docs/START_HERE.md`, and the first 80 lines of every published `packages/*/README.md` lead with portable signed records framing. The per-artifact noun "receipt" and the `PEAC-Receipt` HTTP header are unchanged. A new doctrine-enforcement test (`tests/tooling/records-first-doctrine.test.ts`) keeps front-door framing stable.
- **Scheduled removals shipped.** `ProofMethodSchema` and the `PROOF_METHODS` constant removed from `@peac/schema`; the four transport-binding values are inlined on `AgentProofSchema.method`. A2A v0.3.0 compatibility removed from `@peac/mappings-a2a` (v1.0.0 `supportedInterfaces[]` is required; the legacy `/.well-known/agent.json` discovery path is no longer consulted). The `packages/sdk-js/` workspace stub is deleted.
- **`@peac/core` archived.** Source moved to `archive/0.9.0-0.9.14/packages-core/`. `@peac/core` is not in the v0.13.0 active publish manifest. Historical npm versions `<=0.9.14` remain installable for verify-only use of historical `peac.receipt/0.9` records. `apps/api` no longer depends on `@peac/core`.
- **`@peac/pref` archived.** Source moved to `archive/pref/`. `@peac/pref` is not in the v0.13.0 active publish manifest. Historical npm versions `<=0.12.14` remain installable. Migration target: `@peac/mappings-content-signals`.
- **Legacy `POST /verify` rewired.** The route is removed from the active public OpenAPI contract (`packages/schema/openapi/verify.yaml`, `apps/api/openapi.yaml`). At runtime, `POST /verify` and `POST /api/v1/verify` continue to delegate in-process to `POST /v1/verify` and stamp `Deprecation: true` (RFC 9745), `Sunset: Sat, 01 Nov 2026 00:00:00 GMT` (RFC 8594), and `Link: <https://www.peacprotocol.org/docs/migration>; rel="deprecation"` (RFC 8288) on every response. Two regression tests (`apps/api/tests/legacy-verify-alias-headers.test.ts`, `apps/api/tests/legacy-verify-alias-pre-sunset.test.ts`) pin the alias contract.
- **`@peac/disc` is a deprecated compatibility alias.** The barrel emits a one-shot `PEAC_DISC_DEPRECATED` structured `DeprecationWarning` on import; `parse` / `emit` / `validate` / `discover` and the related constants are preserved. Canonical replacement: `@peac/policy-kit` (`parsePolicyDocument`, `loadPolicyDocument`, `validatePolicy`, `serializePolicyYaml`).
- **Empty Layer-6 pillar stubs archived.** Five empty stubs (`packages/{access, compliance, consent, intelligence, provenance}/`) moved to `archive/pillars/`. None were ever on npm `latest`.
- **Normative resource-limits specification.** New [`docs/specs/RESOURCE-LIMITS.md`](../specs/RESOURCE-LIMITS.md) consolidates every kernel JSON limit, HTTP-surface cap (verifier body, RFC 9457 errors, alias deprecation headers), carrier-embed limit (A2A, MCP, `PEAC-Receipt`, `receipt_url`), network-bearing limit (timeouts, redirects, JWKS cache TTL and key count, `peac.txt` fetch caps), the SSRF policy (RFC 1918 / RFC 4193 / RFC 6890 ranges), and cache-isolation rules. Each row cites the constant in source and a test that exercises it.
- **Standards ledger.** New [`docs/STANDARDS_LEDGER.md`](../STANDARDS_LEDGER.md) catalogues every external standard PEAC cites or implements, organized by category, labeled by status (Standards Track / Informational / IRTF Informational / BCP / FIPS / W3C Recommendation / International Standard / Regulatory / Draft / Watchlist). RFC 8032 labeled IRTF Informational; FIPS 186-5 named as the NIST FIPS reference for EdDSA parameters; RFC 8785 (JCS) labeled Informational with a normative-reliance note; RFC 9745 / 8594 labeled Informational operational signaling.
- **v0.13.0 baseline snapshot.** New [`docs/baselines/BASELINE-v0.13.0.md`](../baselines/BASELINE-v0.13.0.md) records the released-package surface, wire-format invariants, resource-limit invariants, error-taxonomy inventory (186 codes), public TypeScript / CLI / verifier surface, and the v0.12.14 -> v0.13.0 delta.
- **Error-emission audit.** New `scripts/audit-error-emissions.mjs` and the matching reports under `docs/baselines/ERROR-EMISSION-AUDIT-v0.13.0.{md,json}` classify every code in `specs/kernel/errors.json` (186 total) by production emission status. Informational; no code is renumbered or removed.
- **Mutation-testing posture.** `stryker.conf.json` and [`docs/baselines/MUTATION-BASELINE-v0.13.0.md`](../baselines/MUTATION-BASELINE-v0.13.0.md) commit a runnable Stryker configuration against `@peac/kernel`, `@peac/schema`, `@peac/crypto`, `@peac/protocol`, and `@peac/policy-kit`. Advisory only; not CI-wired; no mutation score is recorded in this release.

## API additions (additive)

`@peac/api` exports two new symbols used by the legacy alias and by tests:

- `LEGACY_VERIFY_DEPRECATION_HEADERS`
- `createLegacyVerifyAliasHandler`

`@peac/policy-kit` exports `loadPolicyDocument` (alias over `parsePolicyDocument`) so callers can move off `@peac/disc.parse` without a behavior change.

## Removals

- `@peac/schema`: `ProofMethodSchema` schema export, `ProofMethod` type, and `PROOF_METHODS` constant.
- `@peac/mappings-a2a`: `TASK_STATE_V03_TO_V1` map, `normalizeTaskState` function, `_resetDeprecationWarning` test hook, and `NormalizedAgentCard.version` discriminant.
- `apps/api`: `apps/api/src/verifier.ts`, `apps/api/src/routes.ts`, `apps/api/src/peac-core.d.ts`; `@peac/core` runtime dependency removed from `apps/api/package.json`.
- Active public OpenAPI contract: legacy `POST /verify` operation. The runtime alias is preserved through the advertised Sunset.
- Workspace: `packages/sdk-js/`. (Source archived in `archive/sdk-js/` from prior releases.)

## Archives (no new publication; historical npm versions remain installable)

- `packages/core/` -> `archive/0.9.0-0.9.14/packages-core/`. `@peac/core@<=0.9.14` remains installable on npm.
- `packages/aipref/` -> `archive/pref/`. `@peac/pref@<=0.12.14` remains installable on npm.
- `packages/{access,compliance,consent,intelligence,provenance}/` -> `archive/pillars/<name>/`. None were ever on npm `latest`.

## Compatibility

- Wire format `interaction-record+jwt` (Wire 0.2) is the taught default and the only format documented in the active public OpenAPI contract; `peac-receipt/0.1` (Wire 0.1) remains a frozen verify-only path.
- The signing envelope is unchanged: JWS Compact Serialization (RFC 7515) with Ed25519 (RFC 8032). No algorithm negotiation.
- Public TypeScript APIs (`@peac/protocol.{issue, verifyLocal, verify}`) are unchanged.
- The reference verifier `POST /v1/verify` request and response shapes are unchanged. The `application/json` success body is byte-stable; the RFC 9457 error body is byte-stable.

## Migration

See [`docs/MIGRATION_CURRENT.md`](../MIGRATION_CURRENT.md) for per-export migration guidance. See [`docs/PACKAGE_STATUS_V0.13.0_PARITY.md`](../PACKAGE_STATUS_V0.13.0_PARITY.md) for the per-export parity audit covering `@peac/disc`, `@peac/core`, and `@peac/pref`. See [`docs/baselines/BASELINE-v0.13.0.md`](../baselines/BASELINE-v0.13.0.md) for the descriptive snapshot of the v0.13.0 tagged tree.

## What this release does not promise

- Specific p50 / p95 / p99 latencies. Operator-facing service-level objectives live in [`docs/SLO.md`](../SLO.md).
- Certification against any external standard. The standards ledger lists what PEAC cites or implements; it is not a certification claim.
- An SLA on the open-source reference verifier.
