chore(release): prepare v1.0.43

- package.json
- README.md
- docs/models.md
- docs/releases/v1.0.43.md
- scripts/benchmark-tool-paths.mjs
- scripts/package-smoke.test.mjs
- scripts/version.test.mjs

Author: juancarlosrodicio

README.md

@@ -420,7 +420,7 @@ After a tagged release is published, you can install the same CLI directly
 from GitHub without keeping a checkout:
 
 ```bash
-npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.42"
+npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.43"
 oc-switch
 ```
 
@@ -849,7 +849,7 @@ Validate only the canonical identity and current release note with:
 
 ```bash
 npm run check:version
-node scripts/version.mjs --check-tag v1.0.42
+node scripts/version.mjs --check-tag v1.0.43
 ```
 
 Tag validation compares an explicitly supplied tag with the package identity.

docs/models.md

@@ -34,7 +34,7 @@ oc-switch
 Once a release tag exists, a checkout is optional:
 
 ```bash
-npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.42"
+npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.43"
 oc-switch
 ```
 

docs/releases/v1.0.43.md

@@ -0,0 +1,67 @@
+# v1.0.43 - Safe lifecycle and canonical release identity
+
+This patch release ships the iteration-025 latency fast paths: a small-gate
+review skip, proportional review-lite, a condensed small-change card, a slimmer
+lead prompt with on-demand AHE playbooks, and collector telemetry v2. It also
+locks a red routing-fixture corpus, hardens the public leak scanner, and bumps
+browserslist for two published advisories.
+
+## Highlights
+
+- Add a small-gate fast path: a declared `small` change of at most two files
+  may skip final review when it does not touch protected surfaces, is not
+  destructive, and does not require new tests. `lead` records
+  `review_skipped_reason` (`small_gate_pass`, `protected_surface`,
+  `destructive_diff`, `tests_required`, `scope_not_small`, or `human_decision`).
+- Add proportional review-lite. Reviewer depth is `skipped`, `trivial`, `lite`,
+  or `full`. Lite consumes the developer Verification Envelope and must not
+  re-run green suites; medium/large and sensitive surfaces keep an intact
+  final verdict.
+- Add a condensed small card of at most six fields (objective, success,
+  validation, diff base, constraints, output) when the unique small-gate in
+  `opencode/docs/ai/harness/agents.md` holds.
+- Slim `lead.md` to a fast-router over phases, with on-demand Skill Resolution
+  and AHE details in `opencode/docs/ai/harness/playbooks/lead-ahe-flow.md`.
+- Extend phase-0 collector telemetry v2 with request-turn ids, paired handoff
+  timestamps, `review_skipped_reason`, and post-hoc `diff_size`.
+- Lock synthetic red routing fixtures so the classic corpus stays green, and
+  obfuscate a private hostname fragment in the public leak scanner.
+- Remove stale SearXNG and Synology documentation from the public kit.
+- Bump `browserslist` to 4.28.8 for GHSA-c83g-rgw3-j3cx and GHSA-73wf-gq98-2v4g.
+
+## Installation or upgrade
+
+Install or upgrade the published CLI package:
+
+```bash
+npm install --global opencode-agent-orchestration-kit@1.0.43
+oak version
+oak install --dry-run
+oak install
+```
+
+The npm installation exposes the CLIs but does not mutate OpenCode
+configuration. `oak install` remains a separate, explicit operation.
+
+## Migration
+
+No migration is required. Existing harness configuration remains compatible.
+Small changes that meet the unique small-gate may now skip final review; all
+other changes keep the previous review path.
+
+## Validation performed
+
+The public contract check, unit and script suite, tag/version identity check,
+`git diff --check`, and npm pack dry-run passed. GitHub Actions Check on
+merged `master` was green before the release-prep commit.
+
+## Public safety boundary
+
+The public release excludes private OpenCode and Pi configuration, local
+providers and MCP wiring, credentials, authentication files, provider URLs,
+raw transcripts, private evidence, absolute machine-local paths, and runtime
+state. Pi uses its own native model catalog and is not included in this
+OpenCode package.
+
+Boundary statement: no private config, no credentials, no provider URLs, no
+raw transcripts, no machine-local paths.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-agent-orchestration-kit",
-  "version": "1.0.42",
+  "version": "1.0.43",
   "private": false,
   "description": "Open-source multi-agent orchestration harness for OpenCode with specialized agents, durable workflows, review gates, and reproducible software-engineering processes.",
   "keywords": [

scripts/benchmark-tool-paths.mjs

@@ -143,7 +143,7 @@ async function benchmarkFixture(fixture, iterations, temporaryRoot) {
         const result = await createInstallationManager({
           sourceRoot: fixture.sourceRoot,
           repositoryRoot: fixture.root,
-          versionProvider: () => "1.0.42",
+          versionProvider: () => "1.0.43",
         }).run("install", { targetRoot });
         if (result.exitCode !== 0) throw invalid(`installation benchmark failed for ${fixture.id}`);
       } finally {

scripts/package-smoke.test.mjs

@@ -17,7 +17,7 @@ import {
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const HASH = "a".repeat(64);
-const BASENAME = "opencode-agent-orchestration-kit-1.0.42.tgz";
+const BASENAME = "opencode-agent-orchestration-kit-1.0.43.tgz";
 const REQUIRED = [
   "package/package.json",
   "package/supply-chain.json",
@@ -210,7 +210,7 @@ test("smokeTarball validates both archive listings before extraction", async ()
   await assert.rejects(
     smokeTarball({
       repositoryRoot: ROOT,
-      tarball: "/public/opencode-agent-orchestration-kit-1.0.42.tgz",
+      tarball: "/public/opencode-agent-orchestration-kit-1.0.43.tgz",
       captureTarball(_source, destination) {
         fs.writeFileSync(destination, "fixture");
         return { size: 1 };

scripts/version.test.mjs

@@ -109,7 +109,7 @@ test("[V004] direct version entrypoints are exact and mutation-free", (t) => {
   for (const args of [["scripts/version.mjs"], ["scripts/manage-installation.mjs", "--version"]]) {
     const result = run(process.execPath, args, { HOME: home });
     assert.equal(result.status, 0, result.stderr);
-    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.42\n");
+    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.43\n");
     assert.equal(fs.existsSync(target), false);
   }
 });
@@ -118,7 +118,7 @@ test("[V005] all lifecycle wrappers expose the canonical version", () => {
   for (const wrapper of ["install.sh", "upgrade.sh", "doctor.sh", "uninstall.sh", "rollback.sh"]) {
     const result = run(path.join(REPOSITORY_ROOT, wrapper), ["--version"]);
     assert.equal(result.status, 0, `${wrapper}: ${result.stderr}`);
-    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.42\n", wrapper);
+    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.43\n", wrapper);
   }
 });