[abruption]

Summary

Prepare v1.3.2 from integrated main ef7748a78e6b466f67074708f5c14decf37f31d7, after #342, #345 and #347. Bump the package/generated standalone version, add English/Korean/Japanese/Simplified Chinese maintenance notes, and align README, documentation maps, runbooks and current-source checks.

The release scope is:

• Opt-in Direct listener/TLS diagnostics and readiness clarification. The two-Mac incident recovered on original released v1.3.1 after the owner allowed Python.app's incoming connections; diagnostic code did not restore transport. Optional receiver modules ship in Python archives and need an update of the receiver's own environment and an explicit restart.
• Control Better Auth/core 1.7.7 dependency security update, outside Python archives and requiring a separately authorized rollout. Publication does not deploy this service. The SIGINT change repairs fixture synchronization, not product signal behavior.
• MCP SDK floor mcp>=1.30,<2, preserving the Python 3.10+ marker and dependency-free Python 3.9 core. Minimum/latest-compatible SDK profiles run and audit independently in eight Mac/Linux × Python 3.10/3.13 cells. This does not establish a demonstrated exploitable issue in the stdio-only application or test every transitive dependency's minimum version.

Refs #341, #343, #344, #346. No binding, authentication, retry, ACK, native-generation or platform-support expansion. Skill v0.4.0 and the frozen handoff contract/fixture are byte-identical.

Validation

• fix(mcp): raise SDK floor and audit minimum-compatible profiles #347 exact head 1fc594e7b473a11b479c6c4a69fc035b9daa9ee7 passed all 32 checks and both automatic Codex reviews without findings. All eight downloaded SDK-profile/audit artifacts were independently parsed, with zero known vulnerabilities. Current latest compatible 1.x is also 1.30.0; the exact-minimum and latest resolution branches are distinct. Exact verification record.
• Integrated main CI 40615912194 and CodeQL 40615911475 succeeded at ef7748a78e6b466f67074708f5c14decf37f31d7. This preparation's current-head CI remains required before merge; final-main CI is required again after merge.
• Documentation/workflow tests: 69 pass. Generator consistency and diff checks pass.
• Two fresh local builds are reproducible. Wheel/sdist manifest, exact contents and separate fresh installed purelib/version/help/pip-check tests pass. Distribution suite: 41 tests, 3 PowerShell skips on macOS.
• Both wheel METADATA and sdist PKG-INFO report 1.3.2, Requires-Python >=3.9 and the MCP >=1.30,<2 extra with its Python 3.10 marker. A separate read-only packaging reviewer confirmed payload/source equality, exclusions and frozen skill/handoff bytes using the new integrated-build outputs.
• Source-change evidence remains scoped: 354 Relay tests, the Python 3.9/3.13 stalled-loopback regression, 123 Control tests, 11 Control/Python integration tests, 400 controlled signal attempts, and 28 MCP tests per local SDK/Python profile. No new native-agent or live OAuth acceptance is claimed by this preparation.

Independent review

Pre-PR final review used Claude Code 2.1.310 (requested and response-confirmed claude-opus-5-5) and Codex CLI 0.164.0 (isolated default model, actual model ID not exposed), non-interactively in parallel on immutable input SHA-256 b2b57c0a49a1d86eaed750ee723a6e8303fc3184d070c4e40a18aef2a7d91681. Scope: final release diff and four-language release notes, source manifest and verification boundaries. Both completed successfully without tools, writes, tests or network. Codex found no mandatory correction. Claude requested clearer regression-test wording and cross-language comparison wording; Codex checked the evidence and corrected these, the English runtime relationship and the PR #347 antecedent. Final document hashes, tests and reproducible builds were rerun. These small follow-up edits are not claimed as a second CLI review of identical final bytes.

Antigravity CLI 1.4.8 / explicit gemini-3.8-flash-medium independently checked the integrated release additions in four languages (165.208 seconds, structured success, no material findings). Codex retains responsibility for edits and factual validation. Earlier MCP/release translation checks were separate inputs; the narrow final wording corrections were checked by Codex, not a claimed second Gemini review.

Publication gates

Normal repository protections, successful final-main CI, exact tag/source/7-asset attestation and digest verification, and the actual required human PyPI environment approval remain. No service rollout, global installation, skill release or operational change is performed by this preparation. Published v1.3.1 assets remain unchanged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T01:42:43.050214Z	7828e3e	PR opened
🔒 Security Review	✅ Completed 2026-10-28T01:43:31.154503Z	7828e3e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

v1.3.2 published and verified

• GitHub release: stable/Latest, immutable, published 2026-10-28 01:52:40 UTC.
• PyPI 1.3.2: wheel uploaded 01:55:11.612762 UTC, sdist 01:55:13.659910 UTC, both non-yanked.
• Exact lightweight tag/source: f5e7c49554ff02771990a151e00b52f2abf3df0a, identical tree to reviewed PR head 7828e3efcc0d2ff11e5eb0c590101630eeed095e. Normal merges, no admin/protection bypass.

Verification:

• Final main CI and CodeQL: success.
• Preparation run, attempt 1: all five jobs succeeded. Independently downloaded all seven assets, verified each authenticated attestation against the exact source/main reference/prepare workflow/GitHub OIDC hosted-runner identity, and checked manifest, provenance/run attempt, payload/source and fresh remote asset digests.
• Publication and PyPI verification: all jobs succeeded after the required human pypi environment approval. No private PyPI login/binding recheck or approval bypass was performed.
• Independently downloaded the locked public release and actual PyPI wheel/sdist; exact file sets and hashes match. Separate fresh installations of each PyPI file pass installed purelib/version 1.3.2, help, pip check and JSON list against an initialized, empty test home. Native-agent calls: zero.
• MCP metadata contains >=1.30,<2 with the Python 3.10 extra marker; core Requires-Python remains >=3.9. chore(security): raise the optional MCP dependency floor and test minimum-supported dependencies #346/fix(mcp): raise SDK floor and audit minimum-compatible profiles #347's eight minimum/latest-compatible MCP cells and runtime graph audits are included. This is dependency-policy hardening, not a demonstrated HTTP/OAuth exploit in the stdio server.

SHA-256:

196552714b755c2ff755f3de507bd94a17ebd27b1c474ede83fbcc1301c488de  session_peer-1.3.2-py3-none-any.whl
e1824b089d2d3e38e03783f5dfc6e2d5ec54fa9758837deb0ebcbbb567837065  session_peer-1.3.2.tar.gz

Skill v0.4.0 and frozen handoff bytes remain unchanged. The diagnostic change did not restore networking: original v1.3.1 pairing recovered after owner firewall consent. Node Control remains outside Python archives and requires separate authorized deployment; applying receiver diagnostics requires updating its own environment and explicitly restarting it. No service/fleet rollout, global installation, skill release or new native acceptance claim is made here.