chore: prepare 1.5.0 release candidate

[jeremymcs]

Intent

The Release workflow run 37684286260 failed at the step 'Create release tag' with 'tag v1.4.0 points to another commit'. Cause: package.json on main still had version 1.4.0, but v1.4.0 is already tagged (7a77292), has a GitHub Release, and is on npm, so main could not be released again as 1.4.0. The owner chose 1.5.0 as the next version (minor, because there are new features since v1.4.0). This branch prepares that candidate with the repository helper 'npm run release:bump -- --bump minor': only the version fields in package.json and package-lock.json change. Deliberate decisions: (1) The seven host receipts for frozen candidate cab24a7 stay in docs/trust-validation/evidence/releases/1.4.0/. They are bound to package version 1.4.0 (directory name and install package_version), so they must not be moved or rewritten; RELEASE.md says a version-only change does not invalidate live evidence, and 'python3 -B scripts/check_trust_evidence.py --repo .' passes on this commit with all seven hosts reused and no required runs. (2) docs/trust-validation/HOST-MATRIX.md is changed to say that release 1.5.0 uses candidate cab24a7, where its receipts are, and that the published 1.4.0 used candidate 6d3e38e. (3) CHANGELOG.md and the README release block are NOT edited here, because the Release workflow generates and overwrites the 1.5.0 entry at publication. (4) No tag, no npm publish, and no Release dispatch are part of this change; the owner does those after merge. Do not credit AI in the PR title or body.

What Changed

• Change the package version from 1.4.0 to 1.5.0 in package.json and in the two version fields of package-lock.json. No other package field changes.
• Update docs/trust-validation/HOST-MATRIX.md to say that release 1.5.0 uses frozen candidate cab24a78d31ba41d9d1b357dd72aeae00775ef2d, that its receipts were recorded as package 1.4.0 and stay in evidence/releases/1.4.0/, and that a version-only change does not invalidate them.
• Record in the same file that the published 1.4.0 used candidate 6d3e38ed525831217cf7d4790674feebd8afc75f and that tag v1.4.0 has its receipts. The reference to the failed Release run 37660774035 is removed.

Risk Assessment

✅ Low: The change is a version-field bump in package.json and package-lock.json plus one HOST-MATRIX.md paragraph whose claims agree with git history and with a passing trust-evidence check; the only open item is a wording mismatch in TRUST-EVIDENCE.md.

Testing

No baseline commands ran before this step. I drove six scenarios live: the trust-evidence check, a packed-tarball install and doctor run in an isolated prefix and HOME, a re-run of the bump helper on the base commit compared with the target commit, the release workflow's version and tag guard logic against the real remote tags, a check of the HOST-MATRIX claims against the receipts at tag v1.4.0 and at HEAD, and a check that CHANGELOG, README, and the receipts are unchanged. All six passed. The actual Release workflow dispatch, tag creation, and npm publish were not run, because the intent reserves them for the owner after merge. The change has no UI surface, so there is no screenshot; evidence is CLI transcripts. The worktree is clean.

• Live validation: ✅ go - 6 of 7 scenarios driven live against the product

Scenario	Result	Live	Evidence
Maintainer runs the trust-evidence check on the 1.5.0 commit and it passes with all seven hosts reused and no required runs	✅ pass	live	trust-evidence.txt: exit=0, version 1.5.0, candidate cab24a7, reused_hosts lists all seven hosts, required_runs is empty, receipts read from evidence/releases/1.4.0/
User installs the packed package and the installer and doctor report v1.5.0	✅ pass	live	packed-install.txt: tarball is opengsd-gsd-path-1.5.0.tgz, installer banner shows v1.5.0, 16 skills installed, VERSION stamps are 1.5.0, doctor reports Healthy (v1.5.0)
Running npm run release:bump -- --bump minor on the base commit changes only package.json and package-lock.json and gives the same files as the target commit	✅ pass	live	bump-reproduction.txt: helper prints 1.5.0, git status shows only the two files modified, both are identical to d089f66
Adversarial: the release tag guard that failed for v1.4.0 does not block the version this commit resolves to	✅ pass	live	release-tag-guard.txt: TAG=v1.4.0 reproduces 'tag v1.4.0 points to another commit'; this commit resolves to tag v1.5.0, which is absent on the remote and on npm, so the step takes the create-tag branc…
Reader of HOST-MATRIX.md finds the stated candidates in the receipts: cab24a7 at HEAD and 6d3e38e at tag v1.4.0	✅ pass	live	host-matrix-facts.txt: receipts at 7a77292 name 6d3e38e and not cab24a7; receipts at HEAD name cab24a7
CHANGELOG.md, the README release block, and the 1.4.0 receipts are not changed, and no v1.5.0 tag or npm version exists	✅ pass	live	host-matrix-facts.txt: diff of CHANGELOG.md, README.md, and the evidence directory is empty; release-tag-guard.txt: remote has no v1.5.0 tag and npm versions end at 1.4.0
Owner dispatches the Release workflow on main and it tags v1.5.0, publishes to npm, and creates the GitHub Release	⏸️ untested	no	The intent forbids tag, npm publish, and Release dispatch in this change; the owner does them after merge. It needs the owner's authority to dispatch release.yml on main with npm Trusted Publishing.

Evidence: Trust-evidence check on the 1.5.0 commit

$ python3 -B scripts/check_trust_evidence.py --repo .
{"affected_hosts": ["codex", "claude", "grok", "opencode", "antigravity", "cursor", "kimi"], "baseline": null, "candidate": "cab24a78d31ba41d9d1b357dd72aeae00775ef2d", "hosts": ["codex", "claude", "grok", "opencode", "antigravity", "cursor", "kimi"], "live_changes": ["no complete release baseline"], "reasons": {}, "receipts": {"antigravity": {"candidate": "cab24a78d31ba41d9d1b357dd72aeae00775ef2d", "path": "docs/trust-validation/evidence/releases/1.4.0/antigravity.md", "version": "1.4.0"}, "claude": {"candidate": "cab24a78d31ba41d9d1b357dd72aeae00775ef2d", "path": "docs/trust-validation/evidence/releases/1.4.0/claude.md", "version": "1.4.0"}, "codex": {"candidate": "cab24a78d31ba41d9d1b357dd72aeae00775ef2d", "path": "docs/trust-validation/evidence/releases/1.4.0/codex.md", "version": "1.4.0"}, "cursor": {"candidate": "cab24a78d31ba41d9d1b357dd72aeae00775ef2d", "path": "docs/trust-validation/evidence/releases/1.4.0/cursor.md", "version": "1.4.0"}, "grok": {"candidate": "cab24a78d31ba41d9d1b357dd72aeae00775ef2d", "path": "docs/trust-validation/evidence/releases/1.4.0/grok.md", "version": "1.4.0"}, "kimi": {"candidate": "cab24a78d31ba41d9d1b357dd72aeae00775ef2d", "path": "docs/trust-validation/evidence/releases/1.4.0/kimi.md", "version": "1.4.0"}, "opencode": {"candidate": "cab24a78d31ba41d9d1b357dd72aeae00775ef2d", "path": "docs/trust-validation/evidence/releases/1.4.0/opencode.md", "version": "1.4.0"}}, "required_runs": [], "reused_hosts": ["codex", "claude", "grok", "opencode", "antigravity", "cursor", "kimi"], "version": "1.5.0"}
exit=0

Evidence: Packed 1.5.0 install and doctor transcript

opengsd-gsd-path-1.5.0.tgz ✦ GSD Path installer v1.5.0 ✓ claude: installed 16 skills to <tmp>/skills skills/gsd-path/VERSION: 1.5.0 skills/path/VERSION: 1.5.0 ✓ claude: 16 skills at <tmp>/skills (v1.5.0) Healthy.

$ npm pack (target commit d089f66f) into temp dir
opengsd-gsd-path-1.5.0.tgz
opengsd-gsd-path-1.5.0.tgz
$ npm install <tarball> into isolated prefix
$ node -p installed package.json version
1.5.0
$ HOME=<tmp> gsd-path --claude --claude-root <tmp>/skills

  ✦ GSD Path installer v1.5.0
  global install

  ✓ claude: installed 16 skills to <tmp>/skills

  Done. Restart active agent sessions, then invoke the router explicitly.

$ VERSION stamps written by the installer
skills/gsd-path/VERSION: 1.5.0
skills/path/VERSION: 1.5.0
$ HOME=<tmp> gsd-path --doctor --claude --claude-root <tmp>/skills

  ✦ GSD Path installer v1.5.0
  doctor · global installs

  ✓ claude: 16 skills at <tmp>/skills (v1.5.0)

  Healthy.

Evidence: Bump helper reproduction from base commit

$ npm run release:bump -- --bump minor 1.5.0 M package-lock.json M package.json package.json: identical to target commit package-lock.json: identical to target commit

$ git archive dc5ab65c (base) | tar -x into temp dir; git init + tag v1.4.0 there (helper reads the latest v* tag)
$ npm run release:bump -- --bump minor

> @opengsd/gsd-path@1.4.0 release:bump
> node scripts/bump_version.mjs --bump auto --bump minor

v1.5.0
1.5.0
$ git status --short (files the helper changed)
 M package-lock.json
 M package.json
$ diff helper output against target commit d089f66f
package.json: identical to target commit
package-lock.json: identical to target commit

Evidence: Release tag guard: v1.4.0 fails, v1.5.0 is free

version=1.5.0 tag=v1.5.0 TAG=v1.4.0 -> tag v1.4.0 points to another commit (exit 1) TAG=v1.5.0 -> tag absent; step would create it (not created here) npm versions: ["1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.4.0"]

$ git ls-remote --tags origin (v1.4.0 / v1.5.0)
f511fd1591854557f08333fd7dd32aed8df9445e	refs/tags/v1.4.0
7a7729275424b40cc0f22d3da8f025b25388fefc	refs/tags/v1.4.0^{}
$ release.yml "Resolve release version" logic on this commit (workflow_dispatch, no input)
version=1.5.0
tag=v1.5.0
$ release.yml "Create release tag" guard, read-only, against a clone with the remote tags
TAG=v1.4.0 -> tag v1.4.0 points to another commit (exit 1)
TAG=v1.5.0 -> tag absent; step would create it (not created here)
$ npm view @opengsd/gsd-path versions
["1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.4.0"]

Evidence: HOST-MATRIX claims checked against receipts; CHANGELOG, README, receipts untouched

$ candidate SHAs named in docs/trust-validation/evidence/releases/1.4.0/*.md at 7a772927 (count of receipt files)
6d3e38ed525831217cf7d4790674feebd8afc75f: 15
cab24a78d31ba41d9d1b357dd72aeae00775ef2d: 0
$ candidate SHAs named in docs/trust-validation/evidence/releases/1.4.0/*.md at HEAD (count of receipt files)
6d3e38ed525831217cf7d4790674feebd8afc75f: 1
cab24a78d31ba41d9d1b357dd72aeae00775ef2d: 15
$ git diff --stat dc5ab65c d089f66f -- CHANGELOG.md README.md docs/trust-validation/evidence  (empty = untouched)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 2 infos

• ℹ️ docs/trust-validation/TRUST-EVIDENCE.md:3 - HOST-MATRIX.md now says release 1.5.0 uses candidate cab24a7, but TRUST-EVIDENCE.md still calls the same evidence the "1.4.0 candidate" (line 3: "Current release evidence: [1.4.0 candidate]", and the section heading at line 313: "Release evidence (2026-10-07 — 1.4.0)"). A reader who goes from HOST-MATRIX.md to TRUST-EVIDENCE.md sees two release numbers for one candidate. The intent names only HOST-MATRIX.md for this wording change, so this edit is outside the stated scope and needs the owner's decision. Possible remedy: one sentence at line 3 that says the cab24a7 receipts were recorded as package 1.4.0 and are reused for release 1.5.0. Do not rename the heading: line 3 links to its anchor.
• ℹ️ package.json:3 - Commit d089f66 has the trailer "Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>". The intent forbids AI credit only in the PR title and body, so the commit does not contradict it. But a single-commit PR body is often filled from the commit message. The PR step must write the body without this trailer.

✅ **Test** - passed

✅ No issues found.

• Live validation: ✅ go - 6 of 7 scenarios driven live against the product

Scenario	Result	Live	Evidence
Maintainer runs the trust-evidence check on the 1.5.0 commit and it passes with all seven hosts reused and no required runs	✅ pass	live	trust-evidence.txt: exit=0, version 1.5.0, candidate cab24a7, reused_hosts lists all seven hosts, required_runs is empty, receipts read from evidence/releases/1.4.0/
User installs the packed package and the installer and doctor report v1.5.0	✅ pass	live	packed-install.txt: tarball is opengsd-gsd-path-1.5.0.tgz, installer banner shows v1.5.0, 16 skills installed, VERSION stamps are 1.5.0, doctor reports Healthy (v1.5.0)
Running npm run release:bump -- --bump minor on the base commit changes only package.json and package-lock.json and gives the same files as the target commit	✅ pass	live	bump-reproduction.txt: helper prints 1.5.0, git status shows only the two files modified, both are identical to d089f66
Adversarial: the release tag guard that failed for v1.4.0 does not block the version this commit resolves to	✅ pass	live	release-tag-guard.txt: TAG=v1.4.0 reproduces 'tag v1.4.0 points to another commit'; this commit resolves to tag v1.5.0, which is absent on the remote and on npm, so the step takes the create-tag branc…
Reader of HOST-MATRIX.md finds the stated candidates in the receipts: cab24a7 at HEAD and 6d3e38e at tag v1.4.0	✅ pass	live	host-matrix-facts.txt: receipts at 7a77292 name 6d3e38e and not cab24a7; receipts at HEAD name cab24a7
CHANGELOG.md, the README release block, and the 1.4.0 receipts are not changed, and no v1.5.0 tag or npm version exists	✅ pass	live	host-matrix-facts.txt: diff of CHANGELOG.md, README.md, and the evidence directory is empty; release-tag-guard.txt: remote has no v1.5.0 tag and npm versions end at 1.4.0
Owner dispatches the Release workflow on main and it tags v1.5.0, publishes to npm, and creates the GitHub Release	⏸️ untested	no	The intent forbids tag, npm publish, and Release dispatch in this change; the owner does them after merge. It needs the owner's authority to dispatch release.yml on main with npm Trusted Publishing.

• python3 -B scripts/check_trust_evidence.py --repo .
• npm pack --pack-destination <tmp> then npm install <tmp>/opengsd-gsd-path-1.5.0.tgz in an isolated prefix
• HOME=<tmp> gsd-path --claude --claude-root <tmp>/skills and read the VERSION stamps it wrote
• HOME=<tmp> gsd-path --doctor --claude --claude-root <tmp>/skills
• git archive dc5ab65c | tar -x into a temp repo tagged v1.4.0, then npm run release:bump -- --bump minor, then diff of package.json and package-lock.json against d089f66f
• git ls-remote --tags origin for v1.4.0 and v1.5.0
• release.yml Resolve release version and Create release tag guard logic run read-only against a fresh clone with the remote tags, for TAG=v1.4.0 and TAG=v1.5.0
• npm view @opengsd/gsd-path versions --json
• git grep -l <candidate sha> on docs/trust-validation/evidence/releases/1.4.0 at 7a772927 and at HEAD
• git diff --stat dc5ab65c d089f66f -- CHANGELOG.md README.md docs/trust-validation/evidence

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.