emeisazam · Oct 8, 2026 · Oct 8, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,16 +1,21 @@
 # Changelog
 
-## Unreleased
+## 0.2.3 - 2026-10-08
+
+- Patch the MCP SDK to 1.31.0, proxy-addr to 2.0.8, and source-map-js to 1.2.2 for newly reported advisories.
+- Regenerate tooling identity and conformance evidence for 0.2.3; the normative protocol remains 0.2.0.
+- Keep the dependency audit limited to the exact current local workspace importer collision.
+
+## 0.2.2 - 2026-10-08
 
 - Patch the tooling Hono dependency to 4.13.7 and use a dependency audit that excludes only the exact local workspace importer collision.
 
 All material protocol and reference-tooling changes are recorded here. MASA uses semantic versioning; a tooling patch may advance without changing the normative protocol version when its record contracts remain compatible.
 
-## 0.2.2 - unreleased
 
 - Update the reviewed fast-uri 3.x dependency to 3.1.8 and regenerate the 0.2.2 tooling identity. MASA protocol 0.2.0 remains unchanged.
 - Refresh Vitest 4.1.11 and reviewed js-yaml, Hono and ip-address patches in the lock graph.
-- Packed tooling remains a local candidate; no public release is claimed.
+- Package registry publication remains separate from the Git source release.
 
 ## 0.2.1 - unreleased
 

diff --git a/README.md b/README.md
@@ -49,7 +49,7 @@ See [`docs/project-agnostic-integration.md`](docs/project-agnostic-integration.m
 
 ## Local conformance evidence
 
-The reference implementation records separate evidence for the `reader`, `writer`, `transformer`, `agent-host`, and `publisher` classes in [`conformance/0.2.0/evidence`](conformance/0.2.0/evidence). The 0.2.2 reference-tooling candidate (protocol 0.2.0) local run reports all five classes conformant on Node.js 22.22.3 for macOS arm64 against fixture-manifest digest `e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279`. The digest is refreshed from the examples, specification, capability catalog, schemas, ontology registries, JSON-LD context, and executable conformance runner whenever evidence is intentionally recorded.
+The reference implementation records separate evidence for the `reader`, `writer`, `transformer`, `agent-host`, and `publisher` classes in [`conformance/0.2.0/evidence`](conformance/0.2.0/evidence). The 0.2.3 reference tooling (protocol 0.2.0) local run reports all five classes conformant on Node.js 22.22.3 for macOS arm64 against fixture-manifest digest `db863d81206e4891f2bf61272421c7887b6dd3631747167987c1756a51c75a04`. The digest is refreshed from the examples, specification, capability catalog, schemas, ontology registries, JSON-LD context, and executable conformance runner whenever evidence is intentionally recorded.
 
 Run `pnpm check` to regenerate derived code and verify conformance on the current machine. Run `pnpm conformance:evidence` only when intentionally recording a new local evidence snapshot. Conformance is always specific to an implementation version, MASA version, profile, class, platform, and exact fixture set; it is not a universal certification.
 

diff --git a/capabilities/0.2.0/reference.json b/capabilities/0.2.0/reference.json
@@ -4,11 +4,11 @@
   "masaVersion": "0.2.0",
   "id": "https://masa.sonicfield.org/capabilities/0.2.0/reference",
   "implementation": {
-    "id": "https://masa.sonicfield.org/implementations/typescript-reference/0.2.2",
+    "id": "https://masa.sonicfield.org/implementations/typescript-reference/0.2.3",
     "name": "MASA local TypeScript reference",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
-  "generatedAt": "2026-10-01T02:00:16.890Z",
+  "generatedAt": "2026-10-08T23:47:44.000Z",
   "capabilities": [
     {
       "id": "https://masa.sonicfield.org/capabilities/0.2.0/matter.validate",

diff --git a/cli/package.json b/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sonicfield/masa-cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "private": true,
   "license": "MIT",
   "description": "Local command-line reference implementation for MASA",

diff --git a/conformance/0.2.0/evidence/agent-host.json b/conformance/0.2.0/evidence/agent-host.json
@@ -5,29 +5,29 @@
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
     "byteLength": 716691,
-    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
+    "digest": "db863d81206e4891f2bf61272421c7887b6dd3631747167987c1756a51c75a04",
     "status": "verified",
-    "verifiedAt": "2026-10-01T02:00:19.738Z"
+    "verifiedAt": "2026-10-08T23:51:42.984Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000004",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v26.8.2"
+    "runtime": "node v22.22.3"
   },
   "profile": "agent",
-  "runAt": "2026-10-01T02:00:19.738Z",
+  "runAt": "2026-10-08T23:51:42.984Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "tests": [
     {

diff --git a/conformance/0.2.0/evidence/publisher.json b/conformance/0.2.0/evidence/publisher.json
@@ -5,29 +5,29 @@
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
     "byteLength": 716691,
-    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
+    "digest": "db863d81206e4891f2bf61272421c7887b6dd3631747167987c1756a51c75a04",
     "status": "verified",
-    "verifiedAt": "2026-10-01T02:00:19.738Z"
+    "verifiedAt": "2026-10-08T23:51:42.984Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000005",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v26.8.2"
+    "runtime": "node v22.22.3"
   },
   "profile": "publication",
-  "runAt": "2026-10-01T02:00:19.738Z",
+  "runAt": "2026-10-08T23:51:42.984Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "tests": [
     {

diff --git a/conformance/0.2.0/evidence/reader.json b/conformance/0.2.0/evidence/reader.json
@@ -5,29 +5,29 @@
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
     "byteLength": 716691,
-    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
+    "digest": "db863d81206e4891f2bf61272421c7887b6dd3631747167987c1756a51c75a04",
     "status": "verified",
-    "verifiedAt": "2026-10-01T02:00:19.738Z"
+    "verifiedAt": "2026-10-08T23:51:42.984Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000001",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v26.8.2"
+    "runtime": "node v22.22.3"
   },
   "profile": "core",
-  "runAt": "2026-10-01T02:00:19.738Z",
+  "runAt": "2026-10-08T23:51:42.984Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "tests": [
     {

diff --git a/conformance/0.2.0/evidence/transformer.json b/conformance/0.2.0/evidence/transformer.json
@@ -5,29 +5,29 @@
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
     "byteLength": 716691,
-    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
+    "digest": "db863d81206e4891f2bf61272421c7887b6dd3631747167987c1756a51c75a04",
     "status": "verified",
-    "verifiedAt": "2026-10-01T02:00:19.738Z"
+    "verifiedAt": "2026-10-08T23:51:42.984Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000003",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v26.8.2"
+    "runtime": "node v22.22.3"
   },
   "profile": "transformation",
-  "runAt": "2026-10-01T02:00:19.738Z",
+  "runAt": "2026-10-08T23:51:42.984Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "tests": [
     {

diff --git a/conformance/0.2.0/evidence/writer.json b/conformance/0.2.0/evidence/writer.json
@@ -5,29 +5,29 @@
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
     "byteLength": 716691,
-    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
+    "digest": "db863d81206e4891f2bf61272421c7887b6dd3631747167987c1756a51c75a04",
     "status": "verified",
-    "verifiedAt": "2026-10-01T02:00:19.738Z"
+    "verifiedAt": "2026-10-08T23:51:42.984Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000002",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v26.8.2"
+    "runtime": "node v22.22.3"
   },
   "profile": "core",
-  "runAt": "2026-10-01T02:00:19.738Z",
+  "runAt": "2026-10-08T23:51:42.984Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
   "tests": [
     {

diff --git a/mcp/package.json b/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sonicfield/masa-mcp",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "private": true,
   "license": "MIT",
   "description": "Read-oriented local MCP server for MASA",
@@ -27,7 +27,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.31.0",
     "@sonicfield/masa": "workspace:*",
     "@sonicfield/masa-bundle": "workspace:*",
     "@sonicfield/masa-validator": "workspace:*",

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sonicfield/masa-workspace",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "private": true,
   "license": "MIT",
   "description": "Local-first reference repository for the MASA Sound Matter Aware protocol",
@@ -27,7 +27,7 @@
     "audit:dependencies": "node scripts/audit-dependencies.mjs"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.31.0",
     "@sonicfield/masa": "workspace:*",
     "@sonicfield/masa-bundle": "workspace:*",
     "@sonicfield/masa-validator": "workspace:*",
@@ -47,7 +47,9 @@
       "qs@6": "6.16.0",
       "js-yaml@4": "4.3.2",
       "hono@4": "4.13.7",
-      "ip-address@10": "10.7.1"
+      "ip-address@10": "10.7.1",
+      "proxy-addr@2": "2.0.8",
+      "source-map-js@1": "1.2.2"
     }
   }
 }
diff --git a/packages/bundle/package.json b/packages/bundle/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sonicfield/masa-bundle",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Deterministic, bounded MASA directory and ZIP bundle tooling",
   "type": "module",
   "private": true,

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sonicfield/masa",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "private": true,
   "license": "MIT",
   "description": "Browser-safe types and pure utilities for MASA 0.2.0",

diff --git a/packages/core/src/generated/protocol-resources.ts b/packages/core/src/generated/protocol-resources.ts
@@ -25,11 +25,11 @@ export const referenceCapabilitySet = {
   "masaVersion": "0.2.0",
   "id": "https://masa.sonicfield.org/capabilities/0.2.0/reference",
   "implementation": {
-    "id": "https://masa.sonicfield.org/implementations/typescript-reference/0.2.2",
+    "id": "https://masa.sonicfield.org/implementations/typescript-reference/0.2.3",
     "name": "MASA local TypeScript reference",
-    "version": "0.2.2"
+    "version": "0.2.3"
   },
-  "generatedAt": "2026-10-01T02:00:16.890Z",
+  "generatedAt": "2026-10-08T23:47:44.000Z",
   "capabilities": [
     {
       "id": "https://masa.sonicfield.org/capabilities/0.2.0/matter.validate",

diff --git a/packages/core/src/generated/version.ts b/packages/core/src/generated/version.ts
@@ -1,3 +1,3 @@
 /** Generated from synchronized MASA workspace package metadata. */
 export const MASA_PROTOCOL_VERSION = "0.2.0";
-export const MASA_REFERENCE_IMPLEMENTATION_VERSION = "0.2.2";
+export const MASA_REFERENCE_IMPLEMENTATION_VERSION = "0.2.3";
diff --git a/packages/validator/package.json b/packages/validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sonicfield/masa-validator",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "private": true,
   "license": "MIT",
   "description": "Offline structural, semantic, profile, and public-safety validation for MASA 0.2.0",