[masonwyatt23]

Automated bridge job RQ-N26-STACK-CONTRACT-DOC (pool: codex-personal), single commit on base 7f6726b3e.

Tests: no test command

Tier-1 (CODEOWNERS) paths, async post-merge review: packages/core/src/tests/fixtures/stack-manifest.v1.json packages/core/src/tests/stack-manifest.test.ts packages/core/src/index.ts packages/core/src/stack-manifest.ts

Agent notes

RQ-N26-STACK-CONTRACT-DOC

Added the public STACK_MANIFEST, StackManifest and StackComponent exports
from @ashlr/stack-core. The immutable, JSON-safe v1 contract describes core,
CLI, MCP and Claude Code plugin source versions. It performs no runtime I/O.
Source comments document schema evolution and distinguish source versions from
published or installed versions. Release version changes must update the export
and fixture; tests detect drift against existing package and plugin metadata.

Implementation and tests are under packages/core/src/. No package metadata,
lockfiles, dependencies, .github files, release configuration or tokens changed.
No dead code was found in the export surface touched by this change.

Commands and results:

• bun install --frozen-lockfile: passed, existing dependencies installed.
• HOME=$(mktemp -d) bun test packages/core/src/__tests__/stack-manifest.test.ts: 3 pass, 0 fail.
• bun run typecheck: passed after correcting test literal-type inference.
• bun run lint: passed, 255 files checked, after formatting/import fixes.
• HOME=$(mktemp -d) bun test packages/core/src/__tests__: 485 pass, 10 existing skips, 1 fail due to macOS /var versus /private/var path comparison.
• HOME=$(mktemp -d) TMPDIR=$(realpath /tmp) bun test packages/core/src/__tests__/credential-staging.test.ts: 33 pass, 0 fail.
• HOME=$(mktemp -d) TMPDIR=$(realpath /tmp) bun test packages/core/src/__tests__: 486 pass, 10 existing skips, 0 fail across 52 files. No test or security control was weakened.
• git diff --check: passed.

Net LOC: +83 implementation/fixture/test lines, +28 bridge-note lines, total +111.
All changes remain uncommitted. No commit, push, tag, publication or PR was
created; the explicit final task rules prohibit those actions, including running
publish.sh to publish the queued change.

Summary by CodeRabbit

• New Features
  • Added a versioned stack manifest that lists the core, CLI, and MCP npm packages and the Claude Code plugin, including their versions.
  • Made the manifest available through the core package.

[vercel]

@masonwyatt23 is attempting to deploy a commit to the Evero Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: ashlrai/ashlr-stack
• Branch: main
• File: .coderabbit.yaml
• Commit: 7f6726b
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ae964556-2bd6-4ca8-b11c-16e1c4de8b7c

Commits

Reviewing files that changed from the base of the PR and between 7f6726b and 7de16f9.

Files selected for processing: 4

• packages/core/src/__tests__/fixtures/stack-manifest.v1.json
• packages/core/src/__tests__/stack-manifest.test.ts
• packages/core/src/index.ts
• packages/core/src/stack-manifest.ts

Limit details: You’ve used all 10 included reviews currently available.

Walkthrough

The core package now exposes a frozen, typed manifest for the core, CLI, MCP, and plugin components. Tests compare it with a JSON fixture and check component metadata, semantic-version formatting, and immutability.

Changes: Stack manifest

Layer / File(s)	Summary
Define and validate the public manifest packages/core/src/stack-manifest.ts, packages/core/src/index.ts, packages/core/src/__tests__/fixtures/stack-manifest.v1.json, packages/core/src/__tests__/stack-manifest.test.ts	Adds public manifest and component types, exports the manifest from the core package, and defines release metadata for four components. Tests compare the manifest with the fixture and check metadata, version formatting, and immutability.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: Minimal · up to 7de16

The manifest is ready to merge after normal checks; the test-isolation convention can be addressed separately.

Security architecture risk: Minimal · up to 7de16

The new API exposes fixed component metadata without accepting input, accessing credentials, or performing external operations. Its objects are frozen, and it does not add privileged behavior or deployment changes. No material security risk was identified in this change.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The added exposure is limited to package consumers reading fixed component metadata. The new module does not introduce attacker-controlled input, tenant selection, credential access, or additional execution authority.

Trust Boundaries and Controls

• observed — All exported manifest objects are frozen before consumers receive them, preventing consumers from rewriting this shared metadata through the exported references. Every leaf value is a primitive.

Pre-merge checks: 3 · 1 · 1

Failed checks: 1 warning · 1 inconclusive

Check name	Status	Explanation	Resolution
Description check		The description provides implementation details and test results, but it does not follow the repository template. The required What this changes, Why, Checklist, and Notes for reviewers sections are m…	Rewrite the description using the repository template. Add a one-paragraph change summary, the motivation or issue link, completed checklist items, applicable screenshots or terminal output, and reviewer notes.
Title check		The title contains only an automated bridge identifier and does not describe the addition of the public stack manifest exports.	Replace the title with a concise summary, such as “Add public STACK_MANIFEST contract exports”.

Passed checks: 3 passed

Check name	Status	Explanation
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3 files. (1 skipped: 1 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3 files. (1 skipped: 1 unsupported.)

Full details: Description check

Explanation

The description provides implementation details and test results, but it does not follow the repository template. The required What this changes, Why, Checklist, and Notes for reviewers sections are missing or not clearly presented.

Resolution

Rewrite the description using the repository template. Add a one-paragraph change summary, the motivation or issue link, completed checklist items, applicable screenshots or terminal output, and reviewer notes.

Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 4
• Waived: $1.00 (charged $0.00)
• View usage details

Note

This review exceeded your plan’s limits and used usage-based reviews—free during trial, billed after paid activation unless disabled. Manage usage-based reviews.

_{Comment @coderabbitai help to get the list of available commands.}

[masonwyatt23]

Post-merge Tier-1 security review: no issues.

• packages/core/src/stack-manifest.ts:96-110 is a static, deep-frozen constant (public package names and versions). It does no I/O, env, network or subprocess work, and importing it from index.ts:2 adds no side effect.
• The test reads package and plugin metadata only. No manifest, lockfile or workflow change.