release: reconcile v0.3.0 packet with npm pack

[AetherAI3]

Contract

Repair only the v0.3.0 release boundary after #96. The operator packet mixed the final candidate header (575 entries / 3,022,168 unpacked bytes) with a stale manifest from the #98-era base (527 / 2,459,474). No feature or runtime code is changed.

Base and current head

• base: 84d8767da341ac7305fd9156bdfb3bdbdde4f614 (main, merged release: cut v0.3.0, and make the package prove it contains what the notes claim #96)
• current head: bea92bba6886db7da61cc0ac59037aa2fd67d534
• superseded head: abe717c06b0f07952846b03f5e3b73e69b1d6ff0
• changed paths: docs/releases/OPERATOR-PACKET-v0.3.0.md, test/release_coherence.test.ts
• dependencies: feat(review): structured repository state, and a verification that knows what it verified #93–fix(cloud): refuse the silent dev-session to chat-stream downgrade (ROUTING_DRIFT, exit 3) #105 are merged into the base; release coverage was re-derived across RELEASE_NOTES.md, docs/releases/2026-08-22.md, and the operator packet

Fail-first and repair

The new regression failed before the packet edit:

• header: 575 entries / 3,022,168 unpacked bytes
• packaged-file manifest: 527 entries / 2,459,474 unpacked bytes
• result: 11 pass / 1 fail

The packet now records the measured 575-entry breakdown. Release coherence asks npm pack --dry-run --json once, requires both packet entry counts to match its portable manifest membership, and requires the packet's two unpacked-byte claims to agree internally.

Linux portability repair

The first pushed assertion also compared the Windows packet's byte totals directly with the current runner. Ordinary CI exposed that this was not portable: Ubuntu packed the same 575 entries but reported 739,767 packed / 3,020,305 unpacked, while the packet records the Windows measurement 739,977 / 3,022,168. Checkout line endings change byte totals, and the packet already states it is one-machine evidence rather than a cross-machine reproducibility claim.

CI run 32614328092 therefore failed only the Ubuntu test; its Windows and supply-chain jobs passed. CodeQL run 32614328112 passed. Commit bea92bb keeps the portable entry-membership check and the internal packet consistency check without misrepresenting platform-specific byte totals. Those earlier checks are superseded. At the current head, CI run 32614905936 passed supply-chain, Ubuntu, and Windows, and CodeQL run 32614905948 passed.

Mutation evidence

• Drop dist/src/commands/skills.js: production manifest/pack validators report no errors at 574 files; release coherence fails the changed packet entry count and the missing promised skills command.
• Add unannounced teleport: validators report no errors at 575 files / 3,022,363 unpacked bytes; release coherence fails the unannounced command. Cross-machine byte identity is intentionally not claimed.
• Both mutations were removed. The restored Windows dry-run returned 575 files / 739,977 packed / 3,022,168 unpacked and shasum f31bfc93ed89e7e17ff2ef64e585befdc7a501cd; release coherence returned 12/12 before the portable assertion was added.

Local gates at exact current head

• npm run typecheck: pass
• build: pass; 18 built-in skill assets copied
• non-install release tests after portability repair: 18/18 pass
• earlier isolated production-hardening: 8/8 pass
• npm run release:candidate: ok:true, commitBound:true, exit 0 against bea92bba6886db7da61cc0ac59037aa2fd67d534
• candidate steps: 15 pass / 0 fail / 1 explicit NOT-RUN
• candidate tarball: aether-agents-0.3.0.tgz, 575 entries, 739,977 packed / 3,022,168 unpacked
• candidate sha256: 70a48aca8baa8b63f551980256eafa42531cd22fc5ca1146829d31f8b4bd2e4d
• audit: 0 vulnerabilities
• release tests, production verify, tarball install, version, help, skills list, capabilities, and handoff demo: pass
• full npm test inside the candidate: NOT-RUN by the repository's default candidate contract; current-head hosted CI is the authority
• Predator: unavailable/not configured in this repository; no verdict is claimed

Release state and holds

No tag, GitHub release, npm publish, deployment, readiness change, or merge was performed. npm still serves only 0.1.0, and the required npm-production environment was absent during reconciliation. After ordinary current-head CI and CodeQL complete, this draft still needs a fresh independent final review. The merge controller owns landing and the post-merge candidate rerun.

Rollback: revert bea92bba6886db7da61cc0ac59037aa2fd67d534 and abe717c06b0f07952846b03f5e3b73e69b1d6ff0; no migration or runtime state exists.

[AetherAI3]

M5 independent final review at frozen head bea92bb: APPROVE, no blocking findings. The two-file docs/test repair now checks portable package entry identity and packet-internal byte consistency without claiming cross-platform byte reproducibility. Exact Ubuntu, Windows, supply-chain, and CodeQL checks passed. Predator is unavailable/not configured and is not required for this docs/test-only release packet. Browser/visual proof is not applicable. Tag, GitHub release, npm publication, and the post-merge commit-bound candidate remain explicitly unrun. Normal squash merge is permitted after controller capacity/readiness checks; branch remains draft/frozen for now.