From cdddfddf495ffd172f62a6a801f7697fe502847e Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Fri, 9 Oct 2026 08:44:47 +0800
Subject: [PATCH 1/2] fix(release): publish reviewed release PR merges

---
 .github/workflows/release.yml                 |  85 +++++++++++--
 CONTRIBUTING.md                               |  18 ++-
 docs/releasing.md                             |  39 +++---
 scripts/lib/release-checkpoint.mjs            |  33 ++++-
 .../filesystem/releaseCheckpoint.test.ts      | 117 ++++++++++++++++--
 .../filesystem/releaseWorkflow.test.ts        | 117 ++++++++++++++++--
 6 files changed, 352 insertions(+), 57 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9d4c6f80bb..77ef188390 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,6 +3,9 @@ name: Release
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
+    types: [closed]
   workflow_dispatch:
     inputs:
       release_branch:
@@ -20,7 +23,7 @@ env:
   HUSKY: "0"
 
 concurrency:
-  group: release-${{ inputs.release_branch || github.ref_name }}
+  group: release-${{ inputs.release_branch || github.event.pull_request.merge_commit_sha || github.ref_name }}
   cancel-in-progress: false
 
 jobs:
@@ -38,6 +41,68 @@ jobs:
           target-branch: main
           skip-github-release: true
 
+  merged-release:
+    name: Release reviewed main merge
+    if: >-
+      github.event_name == 'pull_request' && github.event.pull_request.merged == true &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main--')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      sha: ${{ steps.release.outputs.sha }}
+    steps:
+      - name: Check out reviewed release merge
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+
+      - run: npm ci
+
+      - name: Validate reviewed merge before release creation
+        env:
+          SOURCE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
+        run: |
+          if [[ "${SOURCE_SHA}" != "${GITHUB_SHA}" ]]; then
+            echo "The reviewed merge differs from the workflow source; refusing mismatched publication provenance." >&2
+            exit 1
+          fi
+          node scripts/verify-release-checkpoint.mjs \
+            --phase publish --release-branch main --source-sha "$SOURCE_SHA"
+
+      - uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+          target-branch: main
+          skip-github-release: false
+          skip-github-pull-request: true
+
+      - name: Bind publication to the reviewed merge
+        env:
+          RELEASE_CREATED: ${{ steps.release.outputs.release_created }}
+          RELEASE_SHA: ${{ steps.release.outputs.sha }}
+          SOURCE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
+        run: |
+          if [[ "${RELEASE_CREATED}" != true ]]; then
+            echo "Release Please did not create a release for the reviewed merge. Check its pending label and release metadata; for a partial publication, re-run failed jobs in the original run." >&2
+            exit 1
+          fi
+          if [[ "${RELEASE_SHA}" != "${SOURCE_SHA}" ]]; then
+            echo "The tagged release differs from the reviewed merge; refusing mismatched publication provenance. The GitHub release already exists; do not create another release as a retry." >&2
+            exit 1
+          fi
+
   release-please:
     name: Release Please
     if: github.event_name == 'workflow_dispatch'
@@ -193,8 +258,11 @@ jobs:
 
   publish:
     name: Publish to npm
-    needs: release-please
-    if: inputs.phase == 'publish' && needs.release-please.outputs.release_created == 'true'
+    needs: [merged-release, release-please]
+    if: >-
+      always() && !cancelled() &&
+      ((needs.merged-release.result == 'success' && needs.merged-release.outputs.release_created == 'true') ||
+      (needs.release-please.result == 'success' && inputs.phase == 'publish' && needs.release-please.outputs.release_created == 'true'))
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -202,7 +270,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ needs.release-please.outputs.sha }}
+          ref: ${{ needs.merged-release.outputs.sha || needs.release-please.outputs.sha }}
           persist-credentials: false
 
       - uses: actions/setup-node@v6
@@ -265,8 +333,11 @@ jobs:
 
   publish-mcp:
     name: Publish to MCP Registry
-    needs: [release-please, publish]
-    if: inputs.phase == 'publish' && needs.release-please.outputs.release_created == 'true' && needs.publish.result == 'success'
+    needs: [merged-release, release-please, publish]
+    if: >-
+      always() && !cancelled() && needs.publish.result == 'success' &&
+      ((needs.merged-release.result == 'success' && needs.merged-release.outputs.release_created == 'true') ||
+      (needs.release-please.result == 'success' && inputs.phase == 'publish' && needs.release-please.outputs.release_created == 'true'))
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -274,7 +345,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ needs.release-please.outputs.sha }}
+          ref: ${{ needs.merged-release.outputs.sha || needs.release-please.outputs.sha }}
           persist-credentials: false
 
       - name: Verify package and registry metadata versions
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bd87b8c2f1..937c4cd2cb 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -165,16 +165,14 @@ Describe the behavior change and verification performed in the pull request. Nev
 
 ## Maintainer release checklist
 
-Use the [checkpoint release guide](docs/releasing.md). Main pushes automatically
-refresh a release proposal with the next version and changelog. Keep this preview
-PR unmerged until it is superseded by the published release's metadata sync.
-Publication starts from an explicit `release/VERSION` branch cut at a recorded
-application commit. Manually prepare its bot PR, wait for its exact-head CI and
-review, merge into that frozen branch, and manually publish through the official
-Release workflow. Main pushes cannot publish packages. Both publishers build
-the exact SHA tagged by Release Please.
+Use the [release guide](docs/releasing.md). Main pushes automatically refresh a
+Release Please PR with the next version and changelog. Review its migration
+notes, wait for the current CI checks to pass, and merge it into main to publish.
+The Release workflow validates and tags that merge; both publishers build its
+exact SHA. Ordinary main pushes cannot publish packages. An optional manual
+`release/VERSION` checkpoint retains explicit preparation and publication.
 
 Keep new implementation commits on main for the next release. The workflow
 owns packaged-artifact verification, npm publication, the published CLI/MCP
-canary, and MCP Registry publication. Sync release metadata back to main after
-publication; see the guide for partial-publication recovery and verification.
+canary, and MCP Registry publication. Sync manual checkpoint metadata back to
+main after publication; see the guide for recovery and verification.
diff --git a/docs/releasing.md b/docs/releasing.md
index 9d40b5e37b..c18ea88d05 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -1,25 +1,32 @@
-# Releasing from a checkpoint
+# Releasing REA
 
-Pushes to main automatically open or refresh a Release Please proposal with
-the next version and changelog. This proposal cannot create a GitHub release
-or publish packages. It previews the next release as main continues changing.
+Pushes to main automatically open or refresh a Release Please PR with the next
+version and changelog. Review its migration notes and wait for its current CI
+checks to pass. Merging that PR into main starts publication automatically.
 
-Publication uses an explicit source checkpoint. A maintainer selects a frozen
-release branch and dispatches preparation and publication, so main can keep
-accepting changes without changing the candidate being tested.
+The Release workflow validates the merged release metadata and ancestry before
+creating a tag. npm and MCP Registry publication use the exact reviewed merge
+SHA returned by Release Please. Later main commits cannot change that source.
+Ordinary main pushes and closed, unmerged PRs cannot publish packages. Check
+both publication jobs and the published-package canary; a merged PR or GitHub
+tag alone does not establish that publication finished. Retry failed jobs in
+the original run after a partial publication.
 
-## 1. Select the source
+For a release that needs an independently frozen application checkpoint, use
+the optional manual path below. It retains explicit prepare and publish phases.
+
+## 1. Select a source for a manual checkpoint
 
 Use the next minor version proposed by Release Please, including releases with
 breaking changes. Record the full source SHA and create `release/VERSION` at
 that commit. The selected version and Release Please's proposed version must
 agree before publication.
 
-Use the automatic main proposal to review the suggested version and notes.
-Keep that proposal unmerged: select the application commit from main, create
-the frozen branch, and prepare its own release PR using the steps below.
-Merging the proposal into main would advance the release baseline before
-publication. The reviewed frozen-branch PR is the publication candidate.
+When choosing the manual path, leave the automatic main release PR unmerged.
+Select the application commit from main, create the frozen branch, and prepare
+its own release PR using the steps below. Merging the main release PR starts
+automatic publication instead. Close the superseded main PR after the manual
+release has published and its metadata has been synchronized back to main.
 
 `release/VERSION` also sets the expected version for the workflow. Use an exact
 SemVer such as `release/6.1.0` or `release/6.1.0-rc.1`, without build metadata.
@@ -155,7 +162,7 @@ A GitHub tag alone does not establish npm or MCP Registry publication.
 
 ## 4. Sync metadata back to main
 
-Post-release synchronization is part of completing the release. Finish it
+Manual checkpoint synchronization is part of completing that release. Finish it
 before cutting the next checkpoint; otherwise main retains the previous
 release baseline and can propose an already-published version again.
 
@@ -179,8 +186,8 @@ git merge-base --is-ancestor rea-agents-5.0.0 origin/main
 
 Close the superseded main proposal before merging the synchronization PR.
 That merge's main push opens a proposal for the following release using the
-updated baseline. Future publication repeats the checkpoint procedure;
-automatic proposals do not move frozen branches.
+updated baseline. Future releases can use the automatic main PR or repeat the
+manual checkpoint procedure; automatic proposals do not move frozen branches.
 Preparation generates and validates the catalog, portable conformance
 projections, and packaged skill from the candidate checkout without committing
 them. The checkpoint validator binds tracked version authority to the source
diff --git a/scripts/lib/release-checkpoint.mjs b/scripts/lib/release-checkpoint.mjs
index a8c8831dfd..82ebc6ae47 100644
--- a/scripts/lib/release-checkpoint.mjs
+++ b/scripts/lib/release-checkpoint.mjs
@@ -73,6 +73,14 @@ function readCommits(text) {
       breaking:
         /^[a-z]+(?:\([^)]*\))?!: /u.test(title) ||
         /^BREAKING(?: CHANGE|-CHANGE):\s*\S/mu.test(body),
+      breakingNotes: Array.from(
+        body
+          .replace(/\r\n/gu, "\n")
+          .matchAll(
+            /^BREAKING(?: CHANGE|-CHANGE):[ \t]*(\S[^\n]*(?:\n(?!\n|[A-Za-z-]+: )[^\n]+)*)/gmu,
+          ),
+        (match) => match[1].replace(/\s+/gu, " ").trim(),
+      ),
     });
   }
   return commits;
@@ -207,8 +215,15 @@ async function validateCandidate(git, sha, version, commits) {
     version,
   );
   const breakingNotes = breakingSection(notes);
+  const normalizedBreakingNotes = breakingNotes.replace(/\s+/gu, " ");
   const missingBreaking = commits.filter(
-    (commit) => commit.breaking && !referencesCommit(breakingNotes, commit),
+    (commit) =>
+      commit.breaking &&
+      !referencesCommit(breakingNotes, commit) &&
+      (commit.breakingNotes.length === 0 ||
+        commit.breakingNotes.some(
+          (note) => !normalizedBreakingNotes.includes(note),
+        )),
   );
   if (missingBreaking.length > 0) {
     throw new Error(
@@ -224,14 +239,24 @@ export async function inspectReleaseCheckpoint(git, options) {
     .object({
       phase: z.enum(["prepare", "publish"]),
       stage: z.enum(["source", "candidate"]),
-      releaseBranch: z.string().startsWith("release/"),
+      releaseBranch: z.union([
+        z.literal("main"),
+        z.string().startsWith("release/"),
+      ]),
       sourceSha: shaSchema,
       candidateSha: shaSchema.optional(),
     })
     .parse(options);
+  if (releaseBranch === "main" && (phase !== "publish" || stage !== "source")) {
+    throw new Error(
+      "Main publication validates its reviewed merged source SHA.",
+    );
+  }
   const expectedVersion = releaseVersion(
-    releaseBranch.slice("release/".length),
-    "release/VERSION",
+    releaseBranch === "main"
+      ? (await readJson(git, sourceSha, "package.json", versionSchema)).version
+      : releaseBranch.slice("release/".length),
+    releaseBranch === "main" ? "reviewed main release" : "release/VERSION",
   );
   if (phase === "publish" && stage === "candidate") {
     throw new Error(
diff --git a/tests/boundary/filesystem/releaseCheckpoint.test.ts b/tests/boundary/filesystem/releaseCheckpoint.test.ts
index 8f720a22e9..e7dc61e419 100644
--- a/tests/boundary/filesystem/releaseCheckpoint.test.ts
+++ b/tests/boundary/filesystem/releaseCheckpoint.test.ts
@@ -177,7 +177,7 @@ function verify(
       "--stage",
       stage,
       "--release-branch",
-      `release/${version}`,
+      version === "main" ? "main" : `release/${version}`,
       "--source-sha",
       f.sourceSha,
     ],
@@ -295,6 +295,90 @@ it("still requires migration notes for breaking minor releases", async () => {
   });
 });
 
+it.each([
+  {
+    notes:
+      "### ⚠ BREAKING CHANGES\n\n* **contracts:** Use absolute MCP paths. Relative paths are rejected.",
+    accepted: true,
+  },
+  {
+    notes:
+      "### ⚠ BREAKING CHANGES\n\n* **contracts:** Use absolute MCP paths.\n  Relative paths are rejected.",
+    accepted: true,
+  },
+  {
+    notes: "### ⚠ BREAKING CHANGES\n\n* Use absolute MCP paths.",
+    accepted: false,
+  },
+  {
+    notes:
+      "### Bug Fixes\n\n* Use absolute MCP paths. Relative paths are rejected.",
+    accepted: false,
+  },
+  {
+    notes:
+      "### ⚠ BREAKING CHANGES\n\n* Use absolute MCP paths. Relative paths are rejected.",
+    footer:
+      "BREAKING CHANGE: Use absolute MCP paths. Relative paths are rejected.\n\nBREAKING CHANGE: Rename the old CLI option.",
+    accepted: false,
+  },
+  {
+    notes:
+      "### ⚠ BREAKING CHANGES\n\n* Use absolute MCP paths. Relative paths are rejected.\n* Rename the old CLI option.",
+    footer:
+      "BREAKING CHANGE: Use absolute MCP paths.\r\nRelative paths are rejected.\r\n\r\nBREAKING CHANGE: Rename the old CLI option.",
+    accepted: true,
+  },
+])(
+  "validates generated migration text on a main release merge ($accepted): $notes",
+  async ({ notes, accepted, footer }) => {
+    const f = await fixture(
+      "fix(contracts)!: change path inputs",
+      footer ??
+        "BREAKING CHANGE: Use absolute MCP paths.\nRelative paths are rejected.",
+      { versioning: "always-bump-minor" },
+    );
+    const sourceSha = await candidate(f, "5.1.0", notes);
+    const result = verify({ ...f, sourceSha }, "main", "publish", "source");
+    if (!accepted) {
+      await expect(result).rejects.toMatchObject({
+        code: 1,
+        stderr: expect.stringContaining(
+          "migration notes omit unreleased breaking changes",
+        ),
+      });
+      return;
+    }
+    const original = JSON.parse((await result).stdout);
+    const report = reportSchema.parse(original);
+    expect(report).toMatchObject({
+      expectedVersion: "5.1.0",
+      baselineVersion: "5.0.0",
+      applicationSha: f.sourceSha,
+    });
+    await writeFile(join(f.directory, "later-work.txt"), "Later main change\n");
+    await git(f.directory, ["add", "."]);
+    await git(f.directory, ["commit", "-m", "fix: unrelated later work"]);
+    // A moved checkout does not change the selected reviewed merge.
+    expect(
+      JSON.parse(
+        (await verify({ ...f, sourceSha }, "main", "publish", "source")).stdout,
+      ),
+    ).toEqual(original);
+    await expect(
+      verify(
+        { ...f, sourceSha: await git(f.directory, ["rev-parse", "HEAD"]) },
+        "main",
+        "publish",
+        "source",
+      ),
+    ).rejects.toMatchObject({
+      code: 1,
+      stderr: expect.stringContaining("must advance published baseline"),
+    });
+  },
+);
+
 it("rejects a minor when a GitHub merge commit carries its bang marker in the PR title", async () => {
   const f = await fixture("fix(contracts)!: require absolute paths", "", {
     mergePullRequest: true,
@@ -528,15 +612,21 @@ it("rejects a candidate from a different source even when versions and notes mat
   });
 });
 
-it.skipIf(process.platform === "win32").each([true, false])(
-  "the actual publish preflight admits the next action only for valid metadata (%s)",
-  async (valid) => {
+it.skipIf(process.platform === "win32").each([
+  { job: "release-please", valid: true },
+  { job: "release-please", valid: false },
+  { job: "merged-release", valid: true },
+  { job: "merged-release", valid: false },
+])(
+  "the actual $job preflight admits the next action only for valid metadata ($valid)",
+  async ({ job, valid }) => {
     const f = await fixture();
     const sourceSha = await candidate(f, valid ? "6.0.0" : "5.1.0");
     const workflow = z
       .object({
-        jobs: z.object({
-          "release-please": z.object({
+        jobs: z.record(
+          z.string(),
+          z.object({
             steps: z.array(
               z.object({
                 name: z.string().optional(),
@@ -544,7 +634,7 @@ it.skipIf(process.platform === "win32").each([true, false])(
               }),
             ),
           }),
-        }),
+        ),
       })
       .parse(
         parse(
@@ -557,10 +647,12 @@ it.skipIf(process.platform === "win32").each([true, false])(
     const command = z
       .string()
       .parse(
-        workflow.jobs["release-please"].steps.find(
+        workflow.jobs[job]?.steps.find(
           (step) =>
             step.name ===
-            "Validate checkpoint version and ancestry before release creation",
+            (job === "merged-release"
+              ? "Validate reviewed merge before release creation"
+              : "Validate checkpoint version and ancestry before release creation"),
         )?.run,
       );
     const marker = join(f.directory, "next-release-action");
@@ -582,6 +674,7 @@ it.skipIf(process.platform === "win32").each([true, false])(
           RELEASE_PHASE: "publish",
           RELEASE_BRANCH: "release/6.0.0",
           SOURCE_SHA: sourceSha,
+          GITHUB_SHA: sourceSha,
           NEXT_RELEASE_ACTION_MARKER: marker,
         },
       },
@@ -592,7 +685,11 @@ it.skipIf(process.platform === "win32").each([true, false])(
     } else {
       await expect(execution).rejects.toMatchObject({
         code: 1,
-        stderr: expect.stringContaining("release branch requires 6.0.0"),
+        stderr: expect.stringContaining(
+          job === "merged-release"
+            ? "contains unreleased breaking markers"
+            : "release branch requires 6.0.0",
+        ),
       });
       await expect(readFile(marker)).rejects.toMatchObject({ code: "ENOENT" });
     }
diff --git a/tests/boundary/filesystem/releaseWorkflow.test.ts b/tests/boundary/filesystem/releaseWorkflow.test.ts
index aff2fbb7be..faf65ff35a 100644
--- a/tests/boundary/filesystem/releaseWorkflow.test.ts
+++ b/tests/boundary/filesystem/releaseWorkflow.test.ts
@@ -10,6 +10,7 @@ import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
 
 const execFileAsync = promisify(execFile);
 const stepSchema = z.object({
+  id: z.string().optional(),
   name: z.string().optional(),
   uses: z.string().optional(),
   run: z.string().optional(),
@@ -19,6 +20,7 @@ const stepSchema = z.object({
 });
 const jobSchema = z.object({
   if: z.string().optional(),
+  needs: z.union([z.string(), z.array(z.string())]).optional(),
   outputs: z.record(z.string(), z.string()).optional(),
   steps: z.array(stepSchema),
 });
@@ -31,6 +33,7 @@ async function readReleaseWorkflow() {
       jobs: z.object({
         "release-proposal": jobSchema,
         "release-please": jobSchema,
+        "merged-release": jobSchema,
         publish: jobSchema,
         "publish-mcp": jobSchema,
       }),
@@ -82,9 +85,13 @@ it("validates the source before release creation and the prepared candidate befo
   }
 });
 
-it("refreshes a release proposal on main pushes without creating or publishing a release", async () => {
+it("keeps main pushes proposal-only and gates merged-release automation", async () => {
   const workflow = await readReleaseWorkflow();
   expect(workflow.on.push).toEqual({ branches: ["main"] });
+  expect(workflow.on.pull_request).toMatchObject({
+    types: ["closed"],
+    branches: ["main"],
+  });
   const proposal = workflow.jobs["release-proposal"];
   expect(proposal.if).toBe("github.event_name == 'push'");
   const action = proposal.steps.find((step) =>
@@ -96,17 +103,52 @@ it("refreshes a release proposal on main pushes without creating or publishing a
     "skip-github-release": true,
   });
   expect(action?.with?.["skip-github-pull-request"]).not.toBe(true);
+  const merged = workflow.jobs["merged-release"];
+  expect(merged.if).toContain("github.event.pull_request.merged == true");
+  expect(merged.if).toContain("github.repository");
+  expect(merged.if).toContain("release-please--branches--main--");
+  expect(merged.outputs).toEqual({
+    release_created: "${{ steps.release.outputs.release_created }}",
+    sha: "${{ steps.release.outputs.sha }}",
+  });
   expect(workflow.jobs["release-please"].if).toBe(
     "github.event_name == 'workflow_dispatch'",
   );
-  for (const job of [workflow.jobs.publish, workflow.jobs["publish-mcp"]]) {
-    expect(job.if).toContain("inputs.phase == 'publish'");
-  }
   expect(workflow.concurrency.group).toBe(
-    "release-${{ inputs.release_branch || github.ref_name }}",
+    "release-${{ inputs.release_branch || github.event.pull_request.merge_commit_sha || github.ref_name }}",
   );
 });
 
+it("validates the reviewed merge before creating its release", async () => {
+  const workflow = await readReleaseWorkflow();
+  const steps = workflow.jobs["merged-release"].steps;
+  const checkout = steps.find((step) =>
+    step.uses?.startsWith("actions/checkout@"),
+  );
+  expect(checkout?.with).toMatchObject({
+    ref: "${{ github.event.pull_request.merge_commit_sha }}",
+    "fetch-depth": 0,
+  });
+  const checkpoint = steps.find((step) =>
+    step.run?.includes("verify-release-checkpoint.mjs"),
+  );
+  expect(checkpoint?.run).toContain("--phase publish --release-branch main");
+  expect(checkpoint?.run).toContain('--source-sha "$SOURCE_SHA"');
+  const release = steps.find((step) => step.id === "release");
+  expect(release?.with).toMatchObject({
+    "target-branch": "main",
+    "skip-github-release": false,
+    "skip-github-pull-request": true,
+  });
+  const bind = steps.find(
+    (step) => step.name === "Bind publication to the reviewed merge",
+  );
+  expect(bind?.env).toMatchObject({
+    SOURCE_SHA: "${{ github.event.pull_request.merge_commit_sha }}",
+    RELEASE_SHA: "${{ steps.release.outputs.sha }}",
+  });
+});
+
 it("keeps frozen candidate preparation and publication explicit", async () => {
   const workflow = await readReleaseWorkflow();
   expect(workflow.on.workflow_dispatch).toMatchObject({
@@ -209,18 +251,21 @@ it("binds npm and MCP publication to the same immutable release SHA", async () =
     release_created: "${{ steps.release.outputs.release_created }}",
     sha: "${{ steps.release.outputs.sha }}",
   });
-  expect(workflow.jobs.publish.if).toBe(
-    "inputs.phase == 'publish' && needs.release-please.outputs.release_created == 'true'",
+  expect(workflow.jobs.publish.if).toContain("inputs.phase == 'publish'");
+  expect(workflow.jobs.publish.if).toContain(
+    "needs.release-please.outputs.release_created",
   );
-  expect(workflow.jobs["publish-mcp"].if).toBe(
-    "inputs.phase == 'publish' && needs.release-please.outputs.release_created == 'true' && needs.publish.result == 'success'",
+  expect(workflow.jobs["publish-mcp"].if).toContain(
+    "needs.publish.result == 'success'",
   );
+  expect(workflow.jobs.publish.needs).toContain("merged-release");
+  expect(workflow.jobs["publish-mcp"].needs).toContain("merged-release");
   for (const job of [workflow.jobs.publish, workflow.jobs["publish-mcp"]]) {
     const checkout = job.steps.find((step) =>
       step.uses?.startsWith("actions/checkout@"),
     );
     expect(checkout?.with).toMatchObject({
-      ref: "${{ needs.release-please.outputs.sha }}",
+      ref: "${{ needs.merged-release.outputs.sha || needs.release-please.outputs.sha }}",
       "persist-credentials": false,
     });
   }
@@ -262,6 +307,58 @@ it("binds npm and MCP publication to the same immutable release SHA", async () =
   }
 });
 
+it.skipIf(process.platform === "win32").each([
+  {
+    created: "false",
+    releaseSha: "1111111111111111111111111111111111111111",
+    succeeds: false,
+    reason: "did not create a release",
+  },
+  {
+    created: "true",
+    releaseSha: "1111111111111111111111111111111111111111",
+    succeeds: true,
+  },
+  {
+    created: "true",
+    releaseSha: "2222222222222222222222222222222222222222",
+    succeeds: false,
+    reason: "refusing mismatched publication provenance",
+  },
+])(
+  "publishes a merged release only when Release Please creates it at the reviewed SHA: $created/$releaseSha",
+  async ({ created, releaseSha, succeeds, reason }) => {
+    const workflow = await readReleaseWorkflow();
+    const command = z
+      .string()
+      .parse(
+        workflow.jobs["merged-release"].steps.find(
+          (step) => step.name === "Bind publication to the reviewed merge",
+        )?.run,
+      );
+    const result = execFileAsync(
+      "bash",
+      ["-e", "-o", "pipefail", "-c", command],
+      {
+        env: {
+          ...process.env,
+          SOURCE_SHA: "1111111111111111111111111111111111111111",
+          RELEASE_CREATED: created,
+          RELEASE_SHA: releaseSha,
+        },
+      },
+    );
+    if (succeeds) {
+      await expect(result).resolves.toMatchObject({ stderr: "" });
+    } else {
+      await expect(result).rejects.toMatchObject({
+        code: 1,
+        stderr: expect.stringContaining(z.string().parse(reason)),
+      });
+    }
+  },
+);
+
 it
   .skipIf(process.platform === "win32")
   .each(["main", "feature/new-work", "release/", "release/../main"])(

From ae9aaee16b9c738d761d3938a3b34fdf37e581b5 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 9 Oct 2026 08:51:58 +0800
Subject: [PATCH 2/2] chore(release/6.1.0): release rea-agents 6.1.0 (#1144)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .release-please-manifest.json   |   2 +-
 CHANGELOG.md                    | 222 ++++++++++++++++++++++++++++++++
 docs/installation.md            |   2 +-
 package-lock.json               |   4 +-
 package.json                    |   2 +-
 server.json                     |   4 +-
 src/generatedPackageMetadata.ts |   2 +-
 7 files changed, 230 insertions(+), 8 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index a3a12f4948..8ace91523d 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "6.0.0"
+  ".": "6.1.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28266af873..450d349ca7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,227 @@
 # Changelog
 
+## [6.1.0](https://github.com/morluto/rea/compare/rea-agents-6.0.0...rea-agents-6.1.0) (2026-10-09)
+
+
+### ⚠ BREAKING CHANGES
+
+* **hopper:** Hopper regex mode uses ECMAScript Unicode syntax instead of Python re. Matching runs in a cancellable worker with a five-second deadline; literal mode keeps Unicode casefold matching.
+* **hopper:** remove set_current_document. Use open_binary to switch targets; document arguments are scoped to the active target.
+
+### Features
+
+* **clients:** register Grok Build and Grok Bot during setup ([#1134](https://github.com/morluto/rea/issues/1134)) ([08561e0](https://github.com/morluto/rea/commit/08561e0eb7a4a01a256f3693a97061fbea7fb8fa))
+* **ghidra:** make the startup deadline configurable ([#974](https://github.com/morluto/rea/issues/974)) ([d84bc8f](https://github.com/morluto/rea/commit/d84bc8f11abd6cbf5612daf5c8f7e1805d23c16e))
+* **website:** add GitHub link with live star count ([2f59287](https://github.com/morluto/rea/commit/2f59287f1a1794a68102a45c61cc657659fa5de6))
+
+
+### Bug Fixes
+
+* **analysis:** bind overview document identity to the active target ([#1094](https://github.com/morluto/rea/issues/1094)) ([81b5104](https://github.com/morluto/rea/commit/81b51042767ad75310bad1a7a9faf954339841c0))
+* **analysis:** resolve procedure identities and preserve literal queries ([d830cb7](https://github.com/morluto/rea/commit/d830cb79b305e6d4d255f8080de69ca668cbe0af))
+* **android:** report actual provider readiness ([c715af8](https://github.com/morluto/rea/commit/c715af80587f808de816d3add6a6f989437ab66a))
+* **android:** report startup and selector failure causes ([6c13fc8](https://github.com/morluto/rea/commit/6c13fc8e0a318ebe7be6b038089b350d99f8e286))
+* **apple:** account for repeated archive projections ([e1df5e8](https://github.com/morluto/rea/commit/e1df5e85551125b27ef0debb7573de5507b149e1))
+* **apple:** budget Interface Builder decoding and projection ([dbcf8c3](https://github.com/morluto/rea/commit/dbcf8c33915d924fdbc881bf2cf9676587f3b96f))
+* **apple:** classify empty dyld settings by consumer semantics ([#1110](https://github.com/morluto/rea/issues/1110)) ([fe297e5](https://github.com/morluto/rea/commit/fe297e56e804130dd49cc0a95fcf2d115c183ae3))
+* **apple:** decode bundle plist bytes before executable lookup ([d575a73](https://github.com/morluto/rea/commit/d575a7340bb19b84733c79b14de9f4df7181c6b3))
+* **apple:** decode Interface Builder XML byte encodings ([#1095](https://github.com/morluto/rea/issues/1095)) ([f8e143a](https://github.com/morluto/rea/commit/f8e143a3bcd20ddcc0d76d90e73e238d456fe5a3))
+* **apple:** derive dispatch coverage from located decode facts ([488f448](https://github.com/morluto/rea/commit/488f448ae27fd62904967ec1e0ab072e834a9822))
+* **apple:** keep skipped catalog entries from reading as absence ([a079af2](https://github.com/morluto/rea/commit/a079af297bb454417dfd3d89b0037397554ad83e))
+* **apple:** report apps without asset catalogs as empty inventories ([e2f0378](https://github.com/morluto/rea/commit/e2f03786f496ed742572acd87f47270c958171ec))
+* **apple:** report apps without asset catalogs as empty inventories ([79e5a39](https://github.com/morluto/rea/commit/79e5a3923db896323c0491e31004214856529b74))
+* **apple:** report missing keyed archive hierarchy references ([#1104](https://github.com/morluto/rea/issues/1104)) ([3b2ec69](https://github.com/morluto/rea/commit/3b2ec69c54fc9cf65bf8441edbb96e9619c3a37e))
+* **apple:** validate dylib candidates and preserve search uncertainty ([#1100](https://github.com/morluto/rea/issues/1100)) ([7914e36](https://github.com/morluto/rea/commit/7914e36ab9adbbf591a6e1f3fafcb2e17f55d667))
+* **apple:** validate physical slices and dylib platform compatibility ([15f92f2](https://github.com/morluto/rea/commit/15f92f298891c8b16d7d13c78cb6ca66cb90cd85))
+* **application:** budget bridge candidate projection by bytes ([3d450a2](https://github.com/morluto/rea/commit/3d450a29fc91cef3e06ffce9a925ac70dcb24272))
+* **artifacts:** preserve keyed archive integer precision ([4034883](https://github.com/morluto/rea/commit/4034883e9860a97edee03260fab59f9229debfa6))
+* **artifacts:** report keyed-archive selection mistakes as invalid input ([5a55d5b](https://github.com/morluto/rea/commit/5a55d5b1c6aefb4a4e5df63ec43b7e2fc0a7d385))
+* **artifacts:** report keyed-archive selection mistakes as invalid input ([25fb6d3](https://github.com/morluto/rea/commit/25fb6d32a325d88bb0f4e05e16f5f82e4f91c5ca))
+* **artifacts:** retain failed DMG cleanup state and diagnostics ([#1103](https://github.com/morluto/rea/issues/1103)) ([4bb056b](https://github.com/morluto/rea/commit/4bb056bbb5b735e214ed8d725aa3de1c06fb0dc9))
+* **browser:** advertise zero-based units for runtime source coordinates ([#1085](https://github.com/morluto/rea/issues/1085)) ([6218d28](https://github.com/morluto/rea/commit/6218d289e241715d0868004caafe15b5c4758450))
+* **browser:** bind correlated replies to their selected session ([96d3caf](https://github.com/morluto/rea/commit/96d3cafb0725881b6cdab0e2185104957dc69f71))
+* **browser:** bound aggregate source-map decoding before expansion ([f983c71](https://github.com/morluto/rea/commit/f983c718c33789ee40aec43f84315f6b53e95bde))
+* **browser:** bound script metadata and preserve omissions ([faf209e](https://github.com/morluto/rea/commit/faf209e50d9faab03a185c1f044de3582552d11e))
+* **browser:** bound source-map fetches and retain predecessor requests ([eaf5734](https://github.com/morluto/rea/commit/eaf57340831a753faec58246290f9502d159b6b1))
+* **browser:** compose nested source-map column offsets ([#1109](https://github.com/morluto/rea/issues/1109)) ([8b08ec0](https://github.com/morluto/rea/commit/8b08ec0af936405fd20db25f941e2ae6318c5145))
+* **browser:** keep initiator callsites out of script coordinate guidance ([#1096](https://github.com/morluto/rea/issues/1096)) ([3c157b4](https://github.com/morluto/rea/commit/3c157b4ec6297e6737bd3c2ec3dc520c7403402f))
+* **browser:** normalize selected script manifest roots on Windows ([#1078](https://github.com/morluto/rea/issues/1078)) ([b49beb4](https://github.com/morluto/rea/commit/b49beb42d7a97f73d052a27fb99673b1bd0d3d39))
+* **browser:** preserve captures when response bodies are unavailable ([96af2fa](https://github.com/morluto/rea/commit/96af2fa7444a3777d51ff46202ef563146929dbd))
+* **browser:** preserve command failures and reject malformed replies ([6b92002](https://github.com/morluto/rea/commit/6b92002597d34555c32ebf24b9db6e4c17c0a08d))
+* **browser:** treat module-import initiator positions as script positions ([ae0630a](https://github.com/morluto/rea/commit/ae0630a619ee2c98a68e65ca44bf0b93424e2f8e))
+* **browser:** treat module-import initiator positions as script positions ([99d31ee](https://github.com/morluto/rea/commit/99d31ee24ad060babace9eca3325858418e0f55a))
+* **browser:** validate and bound source-map evidence ([0a0174b](https://github.com/morluto/rea/commit/0a0174b9ac8a73b61094e857a2950f4e5a06f544))
+* **build:** exclude the test-only generated catalog from packages ([#1116](https://github.com/morluto/rea/issues/1116)) ([d1c904b](https://github.com/morluto/rea/commit/d1c904bac7977d44b06bf2f823587baedcc88b9e))
+* **build:** make catalogs and packaged skills generated outputs ([#1086](https://github.com/morluto/rea/issues/1086)) ([e613405](https://github.com/morluto/rea/commit/e6134056cf519410160a196363f8a04f0729324e))
+* **capture:** retain Electron observations and HAR resource failures ([44fd183](https://github.com/morluto/rea/commit/44fd18305fa5a8893ebb5b952099fdf45dbd6e55))
+* **ci:** align diagnostic regressions and format merged changes ([67756da](https://github.com/morluto/rea/commit/67756dacc0d435a61d2d0c403412151769da028f))
+* **ci:** restore generated shard inputs and cleanup assertions ([5f93b4b](https://github.com/morluto/rea/commit/5f93b4b125e78f088a2349a178e60f8c0af3e1a2))
+* **cli:** accept exact native names through explicit selectors ([c313606](https://github.com/morluto/rea/commit/c3136064c7f8f72b2f6c6799ec41ea6424111bb7))
+* **cli:** drive mcp doctor help from a single option schema ([b7d803d](https://github.com/morluto/rea/commit/b7d803dd10c7ef8bb73f81f5e893168af8ea86e6))
+* **cli:** preserve blank JSON paths for input validation ([#1068](https://github.com/morluto/rea/issues/1068)) ([3dcb732](https://github.com/morluto/rea/commit/3dcb732da33f6ceef597506b14a4536f1c9aff96))
+* **cli:** preserve web cancellation exit status ([1d9b96a](https://github.com/morluto/rea/commit/1d9b96a9c497694592137cf95bea2af0a190abe7))
+* **cli:** support MCP doctor help ([a69b833](https://github.com/morluto/rea/commit/a69b8337ab38707aaad2ac2fedb652f05afeb71c))
+* **contracts:** preserve local inputs and comparison uncertainty ([70e8a8f](https://github.com/morluto/rea/commit/70e8a8f86060496452ccbc1a49b39822efef4113))
+* **docs:** validate translated links to canonical product facts ([34f7c4f](https://github.com/morluto/rea/commit/34f7c4fd661e07db66c560a4d54272b0163a52b6))
+* **domain:** order canonical paths by code point, not UTF-16 unit ([#1034](https://github.com/morluto/rea/issues/1034)) ([b5c2954](https://github.com/morluto/rea/commit/b5c2954ad67f0280732df043d5d9702f3d202819))
+* **domain:** preserve prototype-named JSON members through Evidence boundaries ([#1049](https://github.com/morluto/rea/issues/1049)) ([40e18b2](https://github.com/morluto/rea/commit/40e18b2e37f2be11f452606c2d875981b03ad03e))
+* **domain:** reject excessive JSON depth with actionable diagnostics ([#1029](https://github.com/morluto/rea/issues/1029)) ([bfbfc73](https://github.com/morluto/rea/commit/bfbfc7330aa7175018de04f1d099b8d4aeec3bd1))
+* **electron:** bound hook retention and report dropped coverage ([02d0702](https://github.com/morluto/rea/commit/02d07027617a5df014f92a351aa9418aade6f06f))
+* **evidence:** name the failed constraint when a bundle is rejected ([82a1a52](https://github.com/morluto/rea/commit/82a1a525d7aa725d939926ba953434fbf5db0ab0))
+* **evidence:** name the failed constraint when a bundle is rejected ([cf96ceb](https://github.com/morluto/rea/commit/cf96ceb2119f52f61a621d2a790b7c8804c65595))
+* **evidence:** report missing evidence files instead of permission advice ([e8b92a4](https://github.com/morluto/rea/commit/e8b92a40c003a5e6ce3cefe4ad18392d39759653))
+* **evidence:** report missing evidence files instead of permission advice ([89252f1](https://github.com/morluto/rea/commit/89252f1f35de91494bd49460b1645d8c09cc6d33))
+* **evidence:** require a complete record before the single-record hint ([38bbb65](https://github.com/morluto/rea/commit/38bbb656da2659088e30a1ca3e4434b2f65bab32))
+* **firmware:** reject malformed UTF-8 producer reports ([4a45c14](https://github.com/morluto/rea/commit/4a45c14742e6868f687cead2ddf736c3f7c49acd))
+* **ghidra:** admit Linux arm64 with matching native tools ([3e598b2](https://github.com/morluto/rea/commit/3e598b2d38a728cd9fd4a359741500a021ba9d3a))
+* **ghidra:** harden location resolution and provider lifecycle ([1f5be75](https://github.com/morluto/rea/commit/1f5be750bced759339183945488cea352b18f28b))
+* **ghidra:** make qualified function renames idempotent ([4458128](https://github.com/morluto/rea/commit/4458128a845c1448140b44d6e62d6ccfe611d37c))
+* **ghidra:** parse long procedure selectors without recursion ([480b16b](https://github.com/morluto/rea/commit/480b16b9c151e1d4bfbca8b49a0668d74ceaa400))
+* **ghidra:** preserve function references and snapshot boundaries ([84a17d5](https://github.com/morluto/rea/commit/84a17d55199b1b46493aea6bf4e41029a3b200fc))
+* **ghidra:** preserve POSIX runtime paths with spaces ([80c3d36](https://github.com/morluto/rea/commit/80c3d36dfa2597f34fdeb69e0ba75277ee50c85c))
+* **ghidra:** preserve source failures and snapshot ownership ([704fa76](https://github.com/morluto/rea/commit/704fa7699ca183d5d5e0518a6fcdbb953ec35a10))
+* **ghidra:** preserve Unicode boundaries without breaking sessions ([bef234d](https://github.com/morluto/rea/commit/bef234d6ce63cd296a654400443fcdbbcd44d7de))
+* **ghidra:** recover regex stack exhaustion without losing annotations ([bc4aa46](https://github.com/morluto/rea/commit/bc4aa46d7c3960a1f325523e48aed2089b176e84))
+* **ghidra:** reject address truncation before reads and edits ([dcae3c6](https://github.com/morluto/rea/commit/dcae3c6c148582d235f5650aace6f9744eeb153c))
+* **ghidra:** resolve exact external function entries ([549effa](https://github.com/morluto/rea/commit/549effa056729e5f9239d9ed7864537a9c49e421))
+* **hopper:** bind analysis to the active target and correct boundary contracts ([2f71375](https://github.com/morluto/rea/commit/2f71375efc517bb9e6f9800f8e8a6849766bc893))
+* **hopper:** bind file mappings to verified source bytes ([82626c4](https://github.com/morluto/rea/commit/82626c4499a53c227187575d40a845fadd5318e2))
+* **hopper:** diagnose MCP provider failures with stage, state, and request context ([#1044](https://github.com/morluto/rea/issues/1044)) ([5a67c7f](https://github.com/morluto/rea/commit/5a67c7fc540c494371de76dcdf353923656993d3))
+* **hopper:** enforce caller-supplied request deadlines ([#1119](https://github.com/morluto/rea/issues/1119)) ([e8939ca](https://github.com/morluto/rea/commit/e8939ca2208bc41454b73b90a32418714e6a2969))
+* **hopper:** isolate regex matching from the native API thread ([f201b04](https://github.com/morluto/rea/commit/f201b04fbbb29591b0d2bb3f3b24636526e4ec4e))
+* **hopper:** load verified FAT64 slices with native Mach-O semantics ([0a49d5b](https://github.com/morluto/rea/commit/0a49d5bfb931124d3d398dfbd64e9f6ae8a01405))
+* **hopper:** normalize native block endpoints and retain terminal evidence ([2847311](https://github.com/morluto/rea/commit/2847311a579ce2da4c8ded4d89fcdd01545e6da5))
+* **hopper:** preserve launcher evidence on readiness timeout ([458771c](https://github.com/morluto/rea/commit/458771cb583e38b848b3d8c58595d163143ff50a))
+* **hopper:** preserve native navigation and annotation semantics ([f2e22e1](https://github.com/morluto/rea/commit/f2e22e13a6956985bd65a2d75e4db7e3128cce81))
+* **hopper:** preserve owned basic-block endpoint instructions ([#1118](https://github.com/morluto/rea/issues/1118)) ([329cf20](https://github.com/morluto/rea/commit/329cf206d1111c051733c7115cabff4b46722deb))
+* **hopper:** preserve partial native call and string evidence ([2461702](https://github.com/morluto/rea/commit/246170238ebb8669a20b57b559b03cfc26ee1b8c))
+* **hopper:** preserve typed string values and verify real searches ([7d7b3f9](https://github.com/morluto/rea/commit/7d7b3f961af2dc9b7572e91aaec29e6c4eccf9d5))
+* **hopper:** report launcher failures before bridge timeout ([#1105](https://github.com/morluto/rea/issues/1105)) ([cd756b0](https://github.com/morluto/rea/commit/cd756b07d5b9c06e085d778e9f1c4fc9bd403219))
+* **hopper:** resolve FAT loaders and original file coordinates ([35f1ddd](https://github.com/morluto/rea/commit/35f1ddd6bc77588b9971961cd70968a815aae266))
+* **hopper:** validate annotation destinations and symbol extents ([b2d5bc1](https://github.com/morluto/rea/commit/b2d5bc110914f2ad42d17bc739d5f37c1b0f0a4d))
+* **hopper:** verify lease cleanup and repair the macOS test lane ([#1111](https://github.com/morluto/rea/issues/1111)) ([b743bd2](https://github.com/morluto/rea/commit/b743bd20a0cbc39728e2e822fa75c013d87e1730))
+* **inspector:** bound retained metadata and preserve cancellation ([e714fb0](https://github.com/morluto/rea/commit/e714fb027afdf11bfbb0838722523d3fa9ebf244))
+* **install:** guard empty prefix_args expansion on macOS Bash 3.2 under set -u ([#1061](https://github.com/morluto/rea/issues/1061)) ([68b9fa4](https://github.com/morluto/rea/commit/68b9fa489b0c07f580633785ec61c17fa20b5083))
+* **javascript:** bound primitive string growth and repeated evaluation ([4a1837d](https://github.com/morluto/rea/commit/4a1837d9d52b1a6454469e2dc63eeb8d716fb296))
+* **javascript:** bound semantic expansion and resolve lexical receivers ([16f4609](https://github.com/morluto/rea/commit/16f4609d689445c05a0befc744fce7e72f7047ec))
+* **javascript:** classify direct defaults and argv elements ([6495171](https://github.com/morluto/rea/commit/649517181268a0b729970b7cbbda15e04b199e32))
+* **javascript:** honor cancellation before evidence publication ([#1098](https://github.com/morluto/rea/issues/1098)) ([cc0ee2e](https://github.com/morluto/rea/commit/cc0ee2edc60dda42d7b7cfb2c08e39b0b736b5e9))
+* **javascript:** omit self-referential import edges with disclosure ([#1130](https://github.com/morluto/rea/issues/1130)) ([1d7115b](https://github.com/morluto/rea/commit/1d7115b7b470719a32e477ca3cbb681f0ad408b8))
+* **javascript:** parse plain TypeScript artifact dialects ([#1102](https://github.com/morluto/rea/issues/1102)) ([3db4681](https://github.com/morluto/rea/commit/3db46813f80f84504c5b87c73a4bece82a8fdc5e))
+* **javascript:** preserve HTML carriage return source ranges ([#1092](https://github.com/morluto/rea/issues/1092)) ([23862af](https://github.com/morluto/rea/commit/23862af1b57413e09abf394f6e4f8369f6355d5a))
+* **javascript:** preserve lexical open and exact template semantics ([d6cc9ca](https://github.com/morluto/rea/commit/d6cc9ca3a6e92604c837f61c193baf5abedaabc8))
+* **javascript:** preserve original BOM source coordinates ([#1093](https://github.com/morluto/rea/issues/1093)) ([83defc0](https://github.com/morluto/rea/commit/83defc054b69e94da888d70bb3b05d835e1bf74d))
+* **javascript:** retain NodeNext artifact source facts ([#1087](https://github.com/morluto/rea/issues/1087)) ([c1b370c](https://github.com/morluto/rea/commit/c1b370ce0dfcbd5725cf6aebe23b022dfc75ac84))
+* **javascript:** use Node legacy package entry fields ([1706005](https://github.com/morluto/rea/commit/170600541bf44f2a63731e8b3d42aae3cbb8d6b3))
+* **managed:** bind inspection evidence to artifact identity ([73b09f4](https://github.com/morluto/rea/commit/73b09f4c5c511ce80baa0c89717181bbe0ecba8f))
+* **managed:** match exact method bytes without decoded signatures ([17809ca](https://github.com/morluto/rea/commit/17809caacd0f44fcc7c1af42932ea655489d64ae))
+* **mcp:** flatten root union input schemas ([#1062](https://github.com/morluto/rea/issues/1062)) ([6a7650e](https://github.com/morluto/rea/commit/6a7650e93cba9169baad95d2c52b11351ae39d0e))
+* **mcp:** preserve retained evidence on oversized delivery ([0639a54](https://github.com/morluto/rea/commit/0639a541a3b712940119f59e8189bc962b267726))
+* **mcp:** retain complete application results across response limits ([a1ed423](https://github.com/morluto/rea/commit/a1ed4232de635d4acc0dd9eb293e309a29d03e80))
+* **mcp:** retain oversized errors before transport delivery ([b3f1b4e](https://github.com/morluto/rea/commit/b3f1b4e822aec5626d1952a88f50c7520dc265d3))
+* **metadata:** stop schema changes churning generated skill evidence ([#1075](https://github.com/morluto/rea/issues/1075)) ([d52f66d](https://github.com/morluto/rea/commit/d52f66d62a93ec09cccdf53e64e3ccd24d16e520))
+* **native:** bind signature observations to registered target versions ([#1099](https://github.com/morluto/rea/issues/1099)) ([c789af0](https://github.com/morluto/rea/commit/c789af04b76c0e76a522a5dece34f461288f5ecd))
+* **native:** bound retained observations and preserve failure evidence ([7c32387](https://github.com/morluto/rea/commit/7c323870c2dcab78654ee7a80128b06affdf2bbe))
+* **native:** preserve bridge failure types during cleanup ([1d0baa3](https://github.com/morluto/rea/commit/1d0baa352fc76d1760abbe29a3cc80fa17296916))
+* **native:** resample tool identity for each invocation ([14b19a0](https://github.com/morluto/rea/commit/14b19a0b8a5af401212c552173e761eac53bfe46))
+* **native:** share command supervision and retain failure output ([f2e9c49](https://github.com/morluto/rea/commit/f2e9c491ea00bf79d5665102d95a3339b63cfe4f))
+* **native:** supervise LLDB and preserve bounded capture uncertainty ([915855e](https://github.com/morluto/rea/commit/915855e75ca3fe3b1b54978ace6bbe10d1973f64))
+* **process:** avoid cold ownership helper deadline exhaustion ([#1139](https://github.com/morluto/rea/issues/1139)) ([65a809a](https://github.com/morluto/rea/commit/65a809a0da0555aa8eeafbc2ec2559517471be02))
+* **process:** derive executable names from the capture host ([#1108](https://github.com/morluto/rea/issues/1108)) ([34cc925](https://github.com/morluto/rea/commit/34cc9259c1076a0d9575a87679befca692ec86c2))
+* **process:** identify unknown live processes in cleanup diagnostics ([eb89a16](https://github.com/morluto/rea/commit/eb89a16d9bc51b65dcc75e05f8492de894320753))
+* **process:** name the reason two captures cannot be compared ([#1080](https://github.com/morluto/rea/issues/1080)) ([eb69763](https://github.com/morluto/rea/commit/eb69763d27e29fe3247c008925016e4c73cb6abe))
+* **process:** preserve observations after successful cleanup ([2af12a1](https://github.com/morluto/rea/commit/2af12a18a36bb80fb7d91ef4c8009212750daa0a))
+* **process:** retain ownership after incomplete cleanup ([e2fc249](https://github.com/morluto/rea/commit/e2fc2493b6a59f0663495d277c0cfec1aeb25a7a))
+* **process:** stabilize native capture and ownership prerequisites ([2b27515](https://github.com/morluto/rea/commit/2b2751547662f8cb142f96d91eff50388a1ecb31))
+* **process:** stop failing captures on tokens macOS cannot expose ([#1057](https://github.com/morluto/rea/issues/1057)) ([5547c1e](https://github.com/morluto/rea/commit/5547c1e697af8c2e1c771abe5344d10b7c1cd340))
+* **providers:** validate ELF versions and preserve probe cancellation ([8b01e0c](https://github.com/morluto/rea/commit/8b01e0cc8904b512b517b4471ef2150f40c98f0d))
+* **release:** always bump minor for releases ([be783ef](https://github.com/morluto/rea/commit/be783efaba62dc76c5d8d42229869a32afdb302a))
+* **release:** publish prereleases under the next npm tag ([bfb7776](https://github.com/morluto/rea/commit/bfb7776006303c6164dba2f22b8e81fdb7c20beb))
+* **release:** publish reviewed release PR merges ([cdddfdd](https://github.com/morluto/rea/commit/cdddfddf495ffd172f62a6a801f7697fe502847e))
+* **release:** recognize conventional titles in GitHub merge commits ([f5009ed](https://github.com/morluto/rea/commit/f5009ed55f081939409808870458162991f836ca))
+* **release:** restore automatic release proposals on main ([acb3e0f](https://github.com/morluto/rea/commit/acb3e0f2e5b38a9c97df7ed78c8e6e5f38bfa08f))
+* **release:** validate frozen checkpoint versions and breaking notes ([8a31508](https://github.com/morluto/rea/commit/8a31508c8958800364e255540ded1586298d7008))
+* **release:** validate frozen checkpoint versions and breaking notes ([60825fb](https://github.com/morluto/rea/commit/60825fb44751c9482bdf4cafdac3599da7c82d45)), closes [#1063](https://github.com/morluto/rea/issues/1063)
+* select Node legacy package entry fields for import and require ([#1035](https://github.com/morluto/rea/issues/1035)) ([1706005](https://github.com/morluto/rea/commit/170600541bf44f2a63731e8b3d42aae3cbb8d6b3))
+* **session:** serialize snapshot lifecycle with admitted requests ([e44cb45](https://github.com/morluto/rea/commit/e44cb45908af8d3902e0db044e0cf7b86cdd7ed0))
+* **setup:** launch Windows npx registrations through cmd.exe ([#1072](https://github.com/morluto/rea/issues/1072)) ([ef30343](https://github.com/morluto/rea/commit/ef30343154d64d78b620d41c37457eee5d99fc71))
+* **setup:** treat empty client config files as new documents ([#1117](https://github.com/morluto/rea/issues/1117)) ([9fd65ce](https://github.com/morluto/rea/commit/9fd65ce0711ce9257aee15e62a5ecf9832960035))
+* **snapshot:** retain MCP workflow replay bindings ([5e1afe4](https://github.com/morluto/rea/commit/5e1afe454f2f283eeeea4532d07a9bdbea8bd51e))
+* **target:** preserve app bundle filesystem failure reasons ([d4c2c3c](https://github.com/morluto/rea/commit/d4c2c3c18f691d04526fe38867347faa2530861d))
+* **update:** accept npm 12 release metadata ([#1138](https://github.com/morluto/rea/issues/1138)) ([567a82f](https://github.com/morluto/rea/commit/567a82f8d4feb629a7c10d2cc9180377eb1f6f66))
+* **verify:** close both sides of the browser proxy ([f7366a5](https://github.com/morluto/rea/commit/f7366a517ff0545f01df6202b1ed3231d9dd3b4a))
+* **verify:** isolate package archives and published canary caches ([3eb7dbd](https://github.com/morluto/rea/commit/3eb7dbdc1689737b44cc4ff044bcb1a311511969))
+* **verify:** remove stale mocked bridge package probe ([826583d](https://github.com/morluto/rea/commit/826583dd43fc918c70a87dfe148c2fdbc8612f3b))
+* **verify:** report final success only after resource cleanup ([ee043e2](https://github.com/morluto/rea/commit/ee043e2cbf30152c60b403fff050a0fc848a3286))
+* **workflows:** keep caller-input details in workflow input errors ([#1089](https://github.com/morluto/rea/issues/1089)) ([289aef6](https://github.com/morluto/rea/commit/289aef6838e424c14f331a9905020079e6b7539b))
+* **workflows:** retain residual unknowns through CLI and MCP ([0136ee8](https://github.com/morluto/rea/commit/0136ee8c22300ed351af5eab6329ab4d271b5bb6))
+
+
+### Performance Improvements
+
+* **build:** avoid duplicate documentation generation ([c701376](https://github.com/morluto/rea/commit/c701376777212ec9acfd10c97f45b1eaf0c885c6))
+* **javascript:** index configuration and module lookups ([67252b2](https://github.com/morluto/rea/commit/67252b23b9e35e9526fed7842dab47a2c7c9fe5f))
+* **javascript:** reuse validated immutable graphs ([#1112](https://github.com/morluto/rea/issues/1112)) ([ec6db0f](https://github.com/morluto/rea/commit/ec6db0f0630c4b0b35f0db84c0030784c1aa58a6))
+
+
+### Code Refactoring
+
+* **artifacts:** centralize stable inventory identities ([135d102](https://github.com/morluto/rea/commit/135d102f9df844d70d352870afce80f67c0ae96f))
+* **browser:** charge source-map records before retention ([e762e32](https://github.com/morluto/rea/commit/e762e32afbba3fd32532fd42a3f4fdcd05252ad3))
+* **config:** prune unused format wrappers and launcher export ([81ae838](https://github.com/morluto/rea/commit/81ae8385679ef10b95d34d0f0b5ba11732ac86b5))
+* **input:** share schema issue error construction ([65a6288](https://github.com/morluto/rea/commit/65a6288257e4c3cab9adb53b0f9123ef567b61bd))
+* **setup:** validate formats through canonical configuration ([4b10665](https://github.com/morluto/rea/commit/4b1066501b379107b2375e270f386fc9855a85c1))
+
+
+### Documentation
+
+* add Persian README translation with full language navigation ([7a7460f](https://github.com/morluto/rea/commit/7a7460f04f3cfd7e365d70ff891bdd0c474901b6))
+* add ten README translations and expand language navigation ([a61491a](https://github.com/morluto/rea/commit/a61491ad00b21e912e16f68bff829927aed6e16f))
+* align translated READMEs and website links with English ([d83f098](https://github.com/morluto/rea/commit/d83f0983d5aa18d29d95d24c4ccb3928be6f29f5))
+* celebrate 20,000 GitHub stars 🎉 ([#1079](https://github.com/morluto/rea/issues/1079)) ([9455e7c](https://github.com/morluto/rea/commit/9455e7c8bc9d5c4a9a1fc9077aa15007ad80997e))
+* check surrounding cases when changing boundaries ([46d195e](https://github.com/morluto/rea/commit/46d195e8a48b710fc355e84cb6b79461b9c39005))
+* clarify contribution scope and cosmetic suggestions ([1f79002](https://github.com/morluto/rea/commit/1f7900249783956070af49c10f86002a0dfdc42b))
+* clarify evidence ownership and verification guidance ([a9e00b8](https://github.com/morluto/rea/commit/a9e00b83f37651a8dd241375615b248062e04227))
+* move Portuguese toward the end of language navigation ([2a4979b](https://github.com/morluto/rea/commit/2a4979b7cdc1a517865573d6c36654c022347d0a))
+* move star milestone into history sections across readmes ([6e6ff7b](https://github.com/morluto/rea/commit/6e6ff7bd2eabb668602258ad5e31eb758b31f823))
+* require partial native facts at provider boundaries ([2b86ea9](https://github.com/morluto/rea/commit/2b86ea9c7cd3cfc2141a021f8b531dbc84395c81))
+* require surrounding boundary checks for review fixes ([9833c94](https://github.com/morluto/rea/commit/9833c94656e1d54e7711dc483bf8091ced14234f))
+* **testing:** prioritize real workflows and distinct regressions ([9588482](https://github.com/morluto/rea/commit/9588482bfeeea869d7274d27fb96bac70278dd42))
+* **website:** add a CTF showcase and FAQ ([#1077](https://github.com/morluto/rea/issues/1077)) ([a4d77f0](https://github.com/morluto/rea/commit/a4d77f0ff0242b7ab891030d2ffa09a4b4bc1c3c))
+
+
+### Tests
+
+* **acceptance:** add application workflow MCP parity harness and scenarios ([5ac3dc9](https://github.com/morluto/rea/commit/5ac3dc96f064e691b357aeddc11fa76b7b4d66d1))
+* **artifacts:** retire simulated mounts after detach failures ([f591e37](https://github.com/morluto/rea/commit/f591e37a1e45d9b7179ed788c4e7ee77a708c6b0))
+* **artifacts:** verify native directory identity on supported Windows runtimes ([#1069](https://github.com/morluto/rea/issues/1069)) ([e94be95](https://github.com/morluto/rea/commit/e94be95c66515fa6fba2a46e4b29850d34141fef))
+* **browser:** pin DOM and source-map URL policy classifications ([#1120](https://github.com/morluto/rea/issues/1120)) ([c1d0002](https://github.com/morluto/rea/commit/c1d0002470dc2b6bde73e4ffe438e734dbb24d8d))
+* **browser:** reject unmodeled CDP commands in protocol fixtures ([017297c](https://github.com/morluto/rea/commit/017297c40c0c38b9d9c17f5194f0f4c51748f0c3))
+* classify application scenarios by their actual boundaries ([0e0b386](https://github.com/morluto/rea/commit/0e0b386dc35bdee1174df9a2d718e0f3e5793666))
+* **cli:** verify self-import parity and cleanup ([55c9ce2](https://github.com/morluto/rea/commit/55c9ce26d1b52f359a21512103088048f9aa7492))
+* consolidate failure guards and trim unused fixture APIs ([ffd9611](https://github.com/morluto/rea/commit/ffd9611308c91b894a7b0d27f331238f5117dacf))
+* **hopper:** cover real boundary failures and CLI parity ([64717ad](https://github.com/morluto/rea/commit/64717ad7daa3152eeb718b4eb5fdcc77f1d76542))
+* **hopper:** verify real boundaries and prune redundant happy paths ([7005166](https://github.com/morluto/rea/commit/7005166f5878737fb7b3c7ec4e3d2ee5f4dcce30))
+* **mcp:** serialize real process capture and report unavailable authority ([8f9da25](https://github.com/morluto/rea/commit/8f9da251647beb530f6851c9dad5040b19a50a35))
+* **process:** cover argv rewrites in native ownership inspection ([09d7b9b](https://github.com/morluto/rea/commit/09d7b9bab53ae968502fd6e19df694cca8cab817))
+* **process:** distinguish native startup from producer verification ([9a70fb4](https://github.com/morluto/rea/commit/9a70fb482c974658088167c9d279bd70159e5dc8))
+* **process:** expose unavailable capture and unexpected teardown failures ([90b06db](https://github.com/morluto/rea/commit/90b06db6c0b2c5863f292f63a226a5c5678a86ac))
+* **process:** report the cause of terminal capture failures ([8a4c4b6](https://github.com/morluto/rea/commit/8a4c4b657fe3b0c249dd2e2147f6960361684c59))
+* **process:** retain cancellation checks under unverified host cleanup ([9a5b077](https://github.com/morluto/rea/commit/9a5b0778993102460e333de6cad3ba85383c10be))
+* **process:** retire native caches at worker teardown ([a0784c0](https://github.com/morluto/rea/commit/a0784c0d2cb70c48ecfeb0be23c6d68de5ee5be1))
+* **process:** serialize real CLI capture boundaries ([82560eb](https://github.com/morluto/rea/commit/82560ebf593a7dfc704698ee312e4d8f1629be8f))
+* prune redundant cases and promote configuration lifecycle coverage ([5945915](https://github.com/morluto/rea/commit/5945915f91adf85de91e16b69534bc3ed1d1b69a))
+* prune resource-recovery wording assertions ([ae06dcf](https://github.com/morluto/rea/commit/ae06dcf83f65b06abb390d2e0b0ea33543278d6e))
+* remove duplicate result assertions before throwing guards ([a1b7d40](https://github.com/morluto/rea/commit/a1b7d40bb0212cdfdddd770a1bccbed097601e0a))
+* **session:** preserve live binding after cancelled switches ([1136ea8](https://github.com/morluto/rea/commit/1136ea881029eab59ffb0834149e86a6aff69e3b))
+* **setup:** scope removal regression to its fixture client ([fe48e77](https://github.com/morluto/rea/commit/fe48e779c264745d28b5a819e51c06e6b5bd2776))
+* **workflows:** verify residual questions in CLI snapshots ([770d2f6](https://github.com/morluto/rea/commit/770d2f60aa948cfdb61c71304be2f3e35f673840))
+
+
+### Continuous Integration
+
+* run signature target binding regressions on native macOS ([#1107](https://github.com/morluto/rea/issues/1107)) ([1e63144](https://github.com/morluto/rea/commit/1e63144390070f569998271fafd1459788ef3265))
+
 ## [6.0.0](https://github.com/morluto/rea/compare/rea-agents-5.0.0...rea-agents-6.0.0) (2026-10-08)
 
 
diff --git a/docs/installation.md b/docs/installation.md
index 2985c12f4e..b8bff07d3d 100644
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -582,7 +582,7 @@ For a client that requires manual configuration, use:
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@6.0.0", "mcp"]
+      "args": ["-y", "rea-agents@6.1.0", "mcp"]
     }
   }
 }
diff --git a/package-lock.json b/package-lock.json
index efa3ef62a9..84a8cee630 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "rea-agents",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "rea-agents",
-      "version": "6.0.0",
+      "version": "6.1.0",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "8.0.4",
diff --git a/package.json b/package.json
index 68d6b5bb7f..537a0396a0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "rea-agents",
   "mcpName": "io.github.morluto/rea",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.",
   "license": "MIT",
   "repository": {
diff --git a/server.json b/server.json
index a26aea8b0e..71634f80c3 100644
--- a/server.json
+++ b/server.json
@@ -8,13 +8,13 @@
     "url": "https://github.com/morluto/rea",
     "source": "github"
   },
-  "version": "6.0.0",
+  "version": "6.1.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "rea-agents",
-      "version": "6.0.0",
+      "version": "6.1.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
diff --git a/src/generatedPackageMetadata.ts b/src/generatedPackageMetadata.ts
index 538a2f0ab2..cbb8670a0f 100644
--- a/src/generatedPackageMetadata.ts
+++ b/src/generatedPackageMetadata.ts
@@ -1,7 +1,7 @@
 /** Generated from package.json and package-lock.json; do not edit. */
 export const PACKAGE_METADATA = {
   name: "rea-agents",
-  version: "6.0.0", // x-release-please-version
+  version: "6.1.0", // x-release-please-version
   serverSdkVersion: "2.3.1",
   clientSdkVersion: "2.3.1",
   coreSdkVersion: "2.3.1",