0.2.10

Apr 29, 2026 · 20 packages · 4 unique changes · 2 release entries

appsbundlesintegrationslibsmodules

Release summaries

builder-next-wave-hardening
Harden the Builder rollout with canonical bootstrap presets, channel-heavy mobile review flows, local-daemon runtime registration, and richer operator status surfaces.
maintainer
Builder bootstrap presets, local-daemon registration, and mobile/operator status views now move together as one governed rollout surface.
integrator
Integrators can adopt canonical bootstrap presets, register trusted local daemons, and consume richer snapshot-backed mobile review and operator posture data.
customer
Builder operators get clearer local runtime trust, lease, and channel-action status when reviewing rollouts away from the desktop workbench.
release-provenance-metadata-fix
Restore npm provenance-safe publishing for the public integration packages by declaring repository metadata and failing release discovery before publish when it is missing.
maintainer
Release discovery now blocks publishable manifests that omit repository metadata, and the affected integration packages declare the canonical GitHub repository URL and directory before npm provenance is requested.
integrator
Integrator release automation can republish the affected integration packages with npm provenance enabled without hitting the empty repository URL validation failure.
customer
This patch only corrects publish metadata for the affected integration packages; their runtime APIs and behavior are unchanged.

Upgrade steps

Verify hardened Builder bootstrap and local-daemon flows
manual
Confirm the new preset, mobile-review, and local runtime registration surfaces are wired through the workbench snapshot.
Packages: @contractspec/lib.builder-spec, @contractspec/lib.builder-runtime, @contractspec/lib.mobile-control, @contractspec/lib.provider-runtime, @contractspec/module.builder-workbench, @contractspec/module.mobile-review, @contractspec/integration.runtime.local, @contractspec/integration.provider.gemini, @contractspec/app.cli-contractspec, @contractspec/bundle.library
1. Update any bootstrap orchestration to use the managed, local-daemon, or hybrid preset values exposed by the Builder contracts.
2. Register a local daemon through the runtime integration and confirm the resulting trust and lease details appear in the Builder snapshot surfaces.
3. Review the mobile-review and operator status cards to verify channel-native actions and comparison posture are rendered from the shared snapshot model.
Republish the affected integration packages with provenance enabled
manual
Pull the patch releases for the affected integration packages or rerun the release job after the metadata fix lands.
Packages: @contractspec/integration.builder-telegram, @contractspec/integration.builder-voice, @contractspec/integration.builder-whatsapp, @contractspec/integration.provider.claude-code, @contractspec/integration.provider.codex, @contractspec/integration.provider.copilot, @contractspec/integration.provider.gemini, @contractspec/integration.provider.local-model, @contractspec/integration.provider.stt, @contractspec/integration.runtime.hybrid, @contractspec/integration.runtime.local, @contractspec/integration.runtime.managed
1. Upgrade the affected integration packages to the patched versions once they are published.
2. Re-run the release workflow with npm provenance enabled and verify release discovery completes before the publish step starts.

Unique release changes

- Pull the patch releases for the affected integration packages or rerun the release job after the metadata fix lands.
12 packages · 12 occurrences
- Restore npm provenance-safe publishing for the public integration packages by declaring repository metadata and failing release discovery before publish when it is missing.
12 packages · 12 occurrences
- Confirm the new preset, mobile-review, and local runtime registration surfaces are wired through the workbench snapshot.
10 packages · 10 occurrences
- Harden the Builder rollout with canonical bootstrap presets, channel-heavy mobile review flows, local-daemon runtime registration, and richer operator status surfaces.
10 packages · 10 occurrences

Impacted packages

@contractspec/app.cli-contractspec
Layer: apps · 2 changes
@contractspec/bundle.library
Layer: bundles · 2 changes
@contractspec/integration.builder-telegram
Layer: integrations · 2 changes
@contractspec/integration.builder-voice
Layer: integrations · 2 changes
@contractspec/integration.builder-whatsapp
Layer: integrations · 2 changes
@contractspec/integration.provider.claude-code
Layer: integrations · 2 changes
@contractspec/integration.provider.codex
Layer: integrations · 2 changes
@contractspec/integration.provider.copilot
Layer: integrations · 2 changes
@contractspec/integration.provider.gemini
Layer: integrations · 2 changes
@contractspec/integration.provider.local-model
Layer: integrations · 2 changes
@contractspec/integration.provider.stt
Layer: integrations · 2 changes
@contractspec/integration.runtime.hybrid
Layer: integrations · 2 changes
@contractspec/integration.runtime.local
Layer: integrations · 2 changes
@contractspec/integration.runtime.managed
Layer: integrations · 2 changes
@contractspec/lib.builder-runtime
Layer: libs · 2 changes
@contractspec/lib.builder-spec
Layer: libs · 2 changes
@contractspec/lib.mobile-control
Layer: libs · 2 changes
@contractspec/lib.provider-runtime
Layer: libs · 2 changes
@contractspec/module.builder-workbench
Layer: modules · 2 changes
@contractspec/module.mobile-review
Layer: modules · 2 changes