chore(release): @hasna/knowledge 0.2.103

[andrei-hasna]

Summary

• bump @hasna/knowledge from 0.2.102 to 0.2.103 after merged PR feat: add Knowledge project resource links #88
• add the 0.2.103 changelog entry for project/collection resource-link producers
• regenerate the version-bearing package artifacts

Source and registry proof

• merged source base: 46dce6133286af11e1d62ad586a5dbe67da4b6d5
• merged source tree: 24b41234879786164be88c6118f679e513da1ef9
• npm latest before push: 0.2.102
• exact @hasna/knowledge@0.2.103 lookup: E404 (unused)

Validation

• package release tests: 6 pass, 0 fail, 100 assertions
• TypeScript declaration/type gate: rc=0
• build: rc=0
• generated verifier: 6 bundles rebuild byte-identically with no stale generated code
• contracts conformance: rc=0
• no-cloud scan: rc=0
• public package validation: passed for hasna-knowledge-0.2.103.tgz
• git diff --check: rc=0

Secret scans

• staged gitleaks: 0 commits scanned; no leaks found
• origin/main..HEAD gitleaks: 1 commit scanned; no leaks found

Review

Independent adversarial review returned GO on exact head e6bdb1a37b8607efe56cc8dcd278d0324facaeef, with zero currently reachable in-scope P0/P1 behavior, security, integrity, release, or compatibility findings.

Scope

Draft release PR only. This PR does not merge, tag, publish, or install the package.

Task: 4080541a-96ea-49d5-8175-4b76bb1d9c40

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

NO_GO

Exact candidate reviewed: head e6bdb1a37b8607efe56cc8dcd278d0324facaeef, tree 91062222b1332567aa04d0efdaf86b1df483ecfc, base 46dce6133286af11e1d62ad586a5dbe67da4b6d5.

The release-only mechanics are otherwise correct: the range changes exactly CHANGELOG.md, package.json, bin/knowledge.js, bin/knowledge-mcp.js, and dist/index.js; the three generated JavaScript files differ from the merged source tree only by 0.2.102 -> 0.2.103; @hasna/knowledge@0.2.103 is unused (E404, with 0.2.102 resolving as the positive control); all seven projected CI jobs are terminal SUCCESS, including Windows Bun; package/type/build/generated/contracts/no-cloud/public-pack gates pass; staged and base-to-head redacted gitleaks scans report no leaks found.

Blocking P1 findings:

1. Advertised Node compatibility is broken by a static bun:sqlite import. package.json declares node >=18 and exports both . and ./serve, but on Node v22.22.3 importing either dist/index.js or dist/serve.js exits 1 with ERR_UNSUPPORTED_ESM_URL_SCHEME and Received protocol 'bun:'. dist/serve.js statically imports Database from bun:sqlite; the pre-feature dist/serve.js at 5cba5d5 imports successfully under the same Node process. This is currently reachable install/runtime incompatibility.

2. PostgreSQL compensation can leave immutable accepted receipts for absent targets. The production query client opens plain BEGIN transactions (PostgreSQL READ COMMITTED). A forward adopter reads the existing collection or membership before inserting its accepted receipt; an inverse transaction can then observe no other committed adopter, delete that target, and commit; the paused forward transaction can subsequently insert and commit its accepted receipt. The receipt table has no foreign key to the collection or membership, and neither path takes a shared row lock or rechecks target existence immediately before receipt insertion. The same reachable interleaving exists for collection registration and item binding, violating data and rollback integrity.

3. Project-resource page limits do not bound backing work. On this exact tree, a deterministic local fixture with five bound items and limit=1, kinds=["item"] printed:

   • FIRST_PAGE count=1 total=5 get_calls=5 has_more=true
   • SECOND_PAGE count=1 total=5 get_calls=5 has_more=true

   buildResources loads every membership and calls the item resolver for the entire population before slice(0, limit), and each continuation page repeats that work. This is a currently reachable availability defect in the public API/SDK/CLI producer path and fails the release's bounded-enumeration claim.

Focused remediation/re-review scope: these three P1s, their fixes, and direct regressions only; revalidate the affected Node import, PostgreSQL concurrency/integrity, and project-resource paging lanes. P2/P3 and optional hardening remain non-blocking.

[andrei-hasna]

[REVIEW] GO — #89 @ e6bdb1a — lens: correctness+isolation+wiring, reviewer codewith-sol-reviewer (1 of 1)

P0: None found.

P1: None found.

P2: None found.

P3: None found.

Evidence: package.json, bin/knowledge.js, bin/knowledge-mcp.js, and dist/index.js consistently move the package metadata from 0.2.102 to 0.2.103. A character-level comparison of the generated-artifact hunks found no behavioral delta hidden by the long bundled lines: their only change is the version string. CHANGELOG.md describes the project-resource implementation already present in the candidate's direct parent, so this release commit carries that reviewed implementation without rewriting it.

Exact-head CI completed successfully in all seven Bun/Node jobs across Ubuntu, macOS, and Windows; the applicable jobs also passed the generated-artifact verification step. Current main is the candidate's direct parent, and GitHub's merge-ref tree equals the head tree, so the reviewed candidate is the tree that would land. The registry currently reports 0.2.102 and has no 0.2.103, so the release version is not already occupied.

Could not verify: I did not perform a local package build, publish, install, live PostgreSQL/AWS exercise, or mutation of any repository. Those paths were outside this read-only review; exact-head CI is the available build/test evidence.

[andrei-hasna]

Closing unmerged at exact head e6bdb1a after current-disposition review GO. The feature commit is already on main; current source and registry are 0.2.105, so this stale 0.2.103 release commit must not land. Preserve branch release/4080541a-knowledge-0.2.103; do not delete it. Reopen only if current main is proven to lack the project-resources behavior or the historical 0.2.103 release record becomes an explicit acceptance gate.