codeacme17 · Sep 7, 2026 · Aug 23, 2026 · Aug 23, 2026 · Aug 23, 2026 · Aug 23, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -12,7 +12,7 @@
       "source": {
         "source": "npm",
         "package": "@launchrally/claude-plugin",
-        "version": "0.4.2"
+        "version": "0.4.3"
       },
       "description": "Audit and verify production launch readiness from an existing repository.",
       "category": "development",

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -165,7 +165,7 @@ jobs:
       - name: Create Experimental GitHub prerelease
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create "$GITHUB_REF_NAME" --verify-tag --prerelease --notes-file docs/maintainers/experimental-0.4.2-announcement.md --title "LaunchRally $GITHUB_REF_NAME (Phase 1 Experimental)"
+        run: gh release create "$GITHUB_REF_NAME" --verify-tag --prerelease --notes-file docs/maintainers/experimental-0.4.3-announcement.md --title "LaunchRally $GITHUB_REF_NAME (Phase 1 Experimental)"
 
   stable-promotion:
     if: github.event_name == 'workflow_dispatch'

diff --git a/AGENTS.md b/AGENTS.md
@@ -28,6 +28,14 @@ Use `node:test` with `node:assert/strict`. Write behavior-focused test names and
 
 History uses Conventional Commit subjects such as `feat: complete human mode audit wizard (#56)` and `fix: support exact Node 20.12 runtime`. Keep commits scoped and imperative. Open feature and fix PRs against `dev`; only release promotion PRs target `main`. Include a concise rationale, linked issue, validation commands/results, and screenshots or terminal output for user-visible CLI changes.
 
+## GitHub Release Notes
+
+Build every GitHub Release body from the exact previous-tag-to-current-tag range. Write a version-specific summary from that range; treat unchanged prose copied from an earlier release as a failed release check.
+
+Include a complete, deduplicated inventory of every issue resolved by the release and every pull request merged in the release range. Link each issue and pull request, and list every contributing developer by GitHub handle with the pull requests they contributed. When a category has no entries, state `None` explicitly.
+
+Use URLs that resolve from the published GitHub Release page. For repository files, prefer absolute GitHub URLs pinned to the release tag so the target is immutable. Before publishing, test every release-note link in its final rendered form and verify that each target exists and returns a non-404 response. Release-note preparation is complete only when the version-specific summary, full issue and pull-request inventory, contributor attribution, and link check all match the release tag.
+
 ## Security & Generated Files
 
 Preserve local-first permission boundaries and never commit credentials, private repository data, reports, evidence, deployment identifiers, or personal data. Report vulnerabilities through `SECURITY.md`. Edit the canonical skill first, run `npm run build`, and commit synchronized adapter copies.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.4.3 — Phase 1 Experimental
+
+LaunchRally 0.4.3 is a corrective Experimental Phase 1 release that completes
+the remaining Human Mode command surfaces while preserving the separately
+supported Phase 0 Stable 0.3.2 line on npm `latest`.
+
+### Improved
+
+- Added concise styled Version output through the public Launcher and selected
+  Project Engine without changing the structured Agent response.
+- Completed the Handoff Human journey through executor selection, authority
+  review, receipt handling, partial execution, and an executable fresh Verify
+  continuation while keeping opaque resume tokens internal.
+- Added a default-safe in-process Project Toolchain migration preview,
+  complete exact-diff review, confirmation, and completion flow.
+- Added an exact 0.4.2-to-0.4.3 Project Toolchain migration guide and stronger
+  version-drift checks across documentation and generated Skills.
+- Preserved supply-chain checks in ordinary CI and documented the independent
+  GitHub release-note control.
+
+### Release boundary
+
+- 0.4.3 publishes only on npm `experimental` and as a GitHub prerelease.
+- Exact 0.4.3 external CLI, Codex, and Claude verification remains a separate
+  post-publication gate; publication does not make Phase 1 Validated or Stable.
+- Phase 0 Stable 0.3.2 remains on npm `latest`.
+
+See [the Phase 1 migration notes](docs/maintainers/p1-migration-notes.md) for
+the exact update, retained-data, and recovery boundaries.
+
 ## 0.4.2 — Phase 1 Experimental
 
 LaunchRally 0.4.2 is a corrective Experimental Phase 1 release that strengthens

diff --git a/adapters/claude/launchrally/.claude-plugin/plugin.json b/adapters/claude/launchrally/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "launchrally",
   "description": "Audit and verify production launch readiness from an existing repository.",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "author": {
     "name": "codeacme17"
   }

diff --git a/adapters/claude/launchrally/README.md b/adapters/claude/launchrally/README.md
@@ -10,7 +10,7 @@ The optional `@launchrally/claude-plugin/resume` host adapter atomically saves v
 
 ## Status
 
-LaunchRally 0.4.2 is an **Experimental Phase 1** release. It adds the Phase 1 Skill and host bridges while Phase 0 Stable 0.3.2 remains on npm `latest`. Publication does not make Phase 1 Validated or Stable.
+LaunchRally 0.4.3 is an **Experimental Phase 1** release. It adds the Phase 1 Skill and host bridges while Phase 0 Stable 0.3.2 remains on npm `latest`. Publication does not make Phase 1 Validated or Stable.
 
 Phase 0 0.3.2 remains a **Stable** release. It is Product Complete, P0 Validated, and published on the stable channel.
 
@@ -20,7 +20,7 @@ CLI installation and Plugin installation are separate. Before installing this Pl
 
 ## Plugin installation and use
 
-The `0.4.2` marketplace catalog pins `@launchrally/claude-plugin@0.4.2`. Add it and install at explicit user scope:
+The `0.4.3` marketplace catalog pins `@launchrally/claude-plugin@0.4.3`. Add it and install at explicit user scope:
 
 ```sh
 claude plugin marketplace add codeacme17/launchrally --scope user

diff --git a/adapters/claude/launchrally/host-adapter/authenticated-journey.js b/adapters/claude/launchrally/host-adapter/authenticated-journey.js
@@ -4,6 +4,6 @@ export function resumeAuthenticatedJourney(options) {
   return resumeAuthenticatedJourneyFromHost({
     ...options,
     host: "claude",
-    version: "0.4.2",
+    version: "0.4.3",
   });
 }
diff --git a/adapters/claude/launchrally/package.json b/adapters/claude/launchrally/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@launchrally/claude-plugin",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "LaunchRally Plugin adapter for Claude Code",
   "keywords": [
     "launchrally",
@@ -24,7 +24,7 @@
     "./resume": "./host-adapter/resume.js"
   },
   "dependencies": {
-    "@launchrally/core": "0.4.2"
+    "@launchrally/core": "0.4.3"
   },
   "repository": {
     "type": "git",

diff --git a/adapters/claude/launchrally/skills/launchrally/SKILL.md b/adapters/claude/launchrally/skills/launchrally/SKILL.md
@@ -20,6 +20,7 @@ Use the local CLI as the only authority for Checks, Evidence, Severity, release
 - When Audit or Verify returns an authenticated Core Journey request, read [references/protected-journeys.md](references/protected-journeys.md).
 - When a completed Audit or Verify contains `provider_tool_recoveries`, read [references/provider-tool-recovery.md](references/provider-tool-recovery.md).
 - When invoking the CLI or handling its states, read [references/cli-contract.md](references/cli-contract.md).
+- For an exact Experimental 0.4.2-to-0.4.3 Project Toolchain update, follow the [version-specific migration authority](https://github.com/codeacme17/launchrally/blob/main/docs/maintainers/p1-migration-notes.md#project-toolchain-migration-042-to-043) and the typed lifecycle router in [references/cli-contract.md](references/cli-contract.md).
 - When inspecting or exchanging a Phase 1 architecture record, read [references/phase-1-contracts.md](references/phase-1-contracts.md). Contract availability alone does not make a Phase 1 operation executable.
 - When a typed `architect` interaction enters Product Intent discovery, read [references/product-intent.md](references/product-intent.md) before presenting semantic-analysis permission or confirmation.
 - When presenting a Capability Catalog, derived obligations, a Capability Graph, or an Integration Contract, read [references/capability-model.md](references/capability-model.md).
@@ -54,7 +55,7 @@ Use the local CLI as the only authority for Checks, Evidence, Severity, release
 
 1. Resolve the exact repository root without changing files.
 2. Make `rally --version --json --cwd <repository-root>` the first discovery operation. Do not probe for or invoke a Project Toolchain Engine directly.
-3. If `rally` is absent, explain that CLI installation and Plugin installation are separate, link to the repository's single Install authority, present exactly `npm install --global @launchrally/cli@0.4.2` and the structured verification command, then stop before Audit and wait for the user. Do not run the install, automatically substitute the separate exact-version npm-exec trial/CI entry, or change npm prefixes or shell profiles.
+3. If `rally` is absent, explain that CLI installation and Plugin installation are separate, link to the repository's single Install authority, present exactly `npm install --global @launchrally/cli@0.4.3` and the structured verification command, then stop before Audit and wait for the user. Do not run the install, automatically substitute the separate exact-version npm-exec trial/CI entry, or change npm prefixes or shell profiles.
 4. Validate the complete version response and `launchrally.dev/execution-authority/v1` object through the compatibility matrix and typed authority router in [references/cli-contract.md](references/cli-contract.md). Plugin, Launcher, selected Engine, and project-pin versions are separate facts and need not be equal when each is supported.
 5. For `ready`, invoke every repository operation through `rally` so the Launcher follows the selected Engine. For restore, migrate, or clean, show the exact operation, permissions, targets, and effects and wait for explicit user approval before Agent execution.
 6. Invoke Agent Mode with structured output and handle the returned state. Stop on unknown contracts or versions, invalid descriptors or paths, and malformed output.

diff --git a/adapters/claude/launchrally/skills/launchrally/references/cli-contract.md b/adapters/claude/launchrally/skills/launchrally/references/cli-contract.md
@@ -7,7 +7,7 @@ Invoke Agent Mode with `--json`. Require `contract: "launchrally.dev/cli/v2"`, t
 CLI installation is a prerequisite separate from Plugin installation. Invoke `rally --version --json --cwd <repository-root>` as the first discovery operation. If spawning `rally` reports that the executable is missing, present the exact user-managed PATH installation and verification commands below, then stop before Audit and wait:
 
 ```bash
-npm install --global @launchrally/cli@0.4.2
+npm install --global @launchrally/cli@0.4.3
 rally --version --json --cwd <repository-root>
 ```
 
@@ -17,10 +17,10 @@ This Skill release uses this explicit compatibility matrix:
 
 | Layer | Supported value | Meaning |
 | --- | --- | --- |
-| Plugin version | `0.4.2` | Interaction guidance only; never an execution candidate. |
-| Launcher version | `0.3.0`, `0.3.1`, `0.3.2`, `0.4.0`, `0.4.1`, or `0.4.2`, only when the running implementation declares v1 | A supported user-managed `rally` dispatcher implementing the contracts below. Historical published `0.2.2` direct binaries predate v1 interception and do not qualify. |
+| Plugin version | `0.4.3` | Interaction guidance only; never an execution candidate. |
+| Launcher version | `0.3.0`, `0.3.1`, `0.3.2`, `0.4.0`, `0.4.1`, `0.4.2`, or `0.4.3`, only when the running implementation declares v1 | A supported user-managed `rally` dispatcher implementing the contracts below. Historical published `0.2.2` direct binaries predate v1 interception and do not qualify. |
 | Execution Authority contract | `launchrally.dev/execution-authority/v1` | The only supported Engine-selection contract. |
-| Selected Engine version and contract | `0.2.2`, `0.3.0`, `0.3.1`, `0.3.2`, `0.4.0`, `0.4.1`, or `0.4.2` with the declared compatibility path and CLI interaction `launchrally.dev/cli/v2` | The Engine selected by validated authority. A descriptor-free `0.2.2` project is accepted only through the legacy row below. |
+| Selected Engine version and contract | `0.2.2`, `0.3.0`, `0.3.1`, `0.3.2`, `0.4.0`, `0.4.1`, `0.4.2`, or `0.4.3` with the declared compatibility path and CLI interaction `launchrally.dev/cli/v2` | The Engine selected by validated authority. A descriptor-free `0.2.2` project is accepted only through the legacy row below. |
 | Legacy project pin | `0.2.2`, authority descriptor absent, `compatibility: "legacy_adapter"` | Supported only through the Launcher's allowlisted legacy adapter after explicit restore when materialization is missing. |
 
 Keep the Plugin version, Launcher version, selected Engine version, and project pin as separate facts. Read `launcher_version` from the version result, the selected Engine from `cli_version` and `authority.engine`, and the project pin from the validated `project_toolchain` authority. Do not require these versions to be equal; continue only when each value and contract is explicitly supported by the matrix. Any unknown or malformed version must stop before a journey operation.

diff --git a/adapters/claude/launchrally/skills/launchrally/references/reference-journey.json b/adapters/claude/launchrally/skills/launchrally/references/reference-journey.json
@@ -2,19 +2,19 @@
   "schema_version": "launchrally.dev/reference-journey/v3",
   "compatibility": {
     "plugin": {
-      "version": "0.4.2",
+      "version": "0.4.3",
       "role": "interaction_only"
     },
     "launcher": {
       "package": "@launchrally/cli",
-      "supported_versions": ["0.3.0", "0.3.1", "0.3.2", "0.4.0", "0.4.1", "0.4.2"]
+      "supported_versions": ["0.3.0", "0.3.1", "0.3.2", "0.4.0", "0.4.1", "0.4.2", "0.4.3"]
     },
     "execution_authority": {
       "supported_contracts": ["launchrally.dev/execution-authority/v1"]
     },
     "engine": {
       "package": "@launchrally/cli",
-      "supported_versions": ["0.2.2", "0.3.0", "0.3.1", "0.3.2", "0.4.0", "0.4.1", "0.4.2"],
+      "supported_versions": ["0.2.2", "0.3.0", "0.3.1", "0.3.2", "0.4.0", "0.4.1", "0.4.2", "0.4.3"],
       "authority_contracts": ["launchrally.dev/execution-authority/v1"],
       "interaction_contracts": ["launchrally.dev/cli/v2"]
     },
@@ -31,7 +31,7 @@
     "installation": {
       "owner": "user",
       "executable": "npm",
-      "arguments": ["install", "--global", "@launchrally/cli@0.4.2"]
+      "arguments": ["install", "--global", "@launchrally/cli@0.4.3"]
     },
     "verification": {
       "arguments": ["--version", "--json", "--cwd", "{repository_root}"]
@@ -57,7 +57,7 @@
   },
   "cli": {
     "package": "@launchrally/cli",
-    "version": "0.4.2",
+    "version": "0.4.3",
     "contract": "launchrally.dev/cli/v2"
   },
   "protected_journeys": {

diff --git a/adapters/claude/launchrally/skills/launchrally/references/reference-journey.md b/adapters/claude/launchrally/skills/launchrally/references/reference-journey.md
@@ -9,7 +9,7 @@ The user-managed `rally` Launcher is a prerequisite separate from the Codex or C
 If `rally` is absent, present these exact user-managed commands, stop before Audit, and wait:
 
 ```bash
-npm install --global @launchrally/cli@0.4.2
+npm install --global @launchrally/cli@0.4.3
 rally --version --json --cwd <repository-root>
 ```
 

diff --git a/adapters/codex/launchrally/.codex-plugin/plugin.json b/adapters/codex/launchrally/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "launchrally",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Audit and verify production launch readiness from an existing repository.",
   "author": {
     "name": "codeacme17",

diff --git a/adapters/codex/launchrally/README.md b/adapters/codex/launchrally/README.md
@@ -10,7 +10,7 @@ The optional `@launchrally/codex-plugin/resume` host adapter atomically saves va
 
 ## Status
 
-LaunchRally 0.4.2 is an **Experimental Phase 1** release. It adds the Phase 1 Skill and host bridges while Phase 0 Stable 0.3.2 remains on npm `latest`. Publication does not make Phase 1 Validated or Stable.
+LaunchRally 0.4.3 is an **Experimental Phase 1** release. It adds the Phase 1 Skill and host bridges while Phase 0 Stable 0.3.2 remains on npm `latest`. Publication does not make Phase 1 Validated or Stable.
 
 Phase 0 0.3.2 remains a **Stable** release. It is Product Complete, P0 Validated, and published on the stable channel.
 
@@ -23,7 +23,7 @@ CLI installation and Plugin installation are separate. Before installing this Pl
 Codex installs Plugins at user scope. Pin the marketplace to the exact release tag, then install LaunchRally:
 
 ```sh
-codex plugin marketplace add codeacme17/launchrally --ref v0.4.2
+codex plugin marketplace add codeacme17/launchrally --ref v0.4.3
 codex plugin add launchrally@launchrally
 codex plugin list --json
 ```
@@ -37,7 +37,7 @@ Replace the installed Plugin and exact marketplace checkout deliberately:
 ```sh
 codex plugin remove launchrally@launchrally
 codex plugin marketplace remove launchrally
-codex plugin marketplace add codeacme17/launchrally --ref v0.4.2
+codex plugin marketplace add codeacme17/launchrally --ref v0.4.3
 codex plugin add launchrally@launchrally
 ```
 

diff --git a/adapters/codex/launchrally/host-adapter/authenticated-journey.js b/adapters/codex/launchrally/host-adapter/authenticated-journey.js
@@ -4,6 +4,6 @@ export function resumeAuthenticatedJourney(options) {
   return resumeAuthenticatedJourneyFromHost({
     ...options,
     host: "codex",
-    version: "0.4.2",
+    version: "0.4.3",
   });
 }
diff --git a/adapters/codex/launchrally/package.json b/adapters/codex/launchrally/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@launchrally/codex-plugin",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "LaunchRally Plugin adapter for Codex",
   "keywords": [
     "launchrally",
@@ -24,7 +24,7 @@
     "./resume": "./host-adapter/resume.js"
   },
   "dependencies": {
-    "@launchrally/core": "0.4.2"
+    "@launchrally/core": "0.4.3"
   },
   "repository": {
     "type": "git",

diff --git a/adapters/codex/launchrally/skills/launchrally/SKILL.md b/adapters/codex/launchrally/skills/launchrally/SKILL.md
@@ -19,6 +19,7 @@ Use the local CLI as the only authority for Checks, Evidence, Severity, release
 - When Audit or Verify returns an authenticated Core Journey request, read [references/protected-journeys.md](references/protected-journeys.md).
 - When a completed Audit or Verify contains `provider_tool_recoveries`, read [references/provider-tool-recovery.md](references/provider-tool-recovery.md).
 - When invoking the CLI or handling its states, read [references/cli-contract.md](references/cli-contract.md).
+- For an exact Experimental 0.4.2-to-0.4.3 Project Toolchain update, follow the [version-specific migration authority](https://github.com/codeacme17/launchrally/blob/main/docs/maintainers/p1-migration-notes.md#project-toolchain-migration-042-to-043) and the typed lifecycle router in [references/cli-contract.md](references/cli-contract.md).
 - When inspecting or exchanging a Phase 1 architecture record, read [references/phase-1-contracts.md](references/phase-1-contracts.md). Contract availability alone does not make a Phase 1 operation executable.
 - When a typed `architect` interaction enters Product Intent discovery, read [references/product-intent.md](references/product-intent.md) before presenting semantic-analysis permission or confirmation.
 - When presenting a Capability Catalog, derived obligations, a Capability Graph, or an Integration Contract, read [references/capability-model.md](references/capability-model.md).
@@ -53,7 +54,7 @@ Use the local CLI as the only authority for Checks, Evidence, Severity, release
 
 1. Resolve the exact repository root without changing files.
 2. Make `rally --version --json --cwd <repository-root>` the first discovery operation. Do not probe for or invoke a Project Toolchain Engine directly.
-3. If `rally` is absent, explain that CLI installation and Plugin installation are separate, link to the repository's single Install authority, present exactly `npm install --global @launchrally/cli@0.4.2` and the structured verification command, then stop before Audit and wait for the user. Do not run the install, automatically substitute the separate exact-version npm-exec trial/CI entry, or change npm prefixes or shell profiles.
+3. If `rally` is absent, explain that CLI installation and Plugin installation are separate, link to the repository's single Install authority, present exactly `npm install --global @launchrally/cli@0.4.3` and the structured verification command, then stop before Audit and wait for the user. Do not run the install, automatically substitute the separate exact-version npm-exec trial/CI entry, or change npm prefixes or shell profiles.
 4. Validate the complete version response and `launchrally.dev/execution-authority/v1` object through the compatibility matrix and typed authority router in [references/cli-contract.md](references/cli-contract.md). Plugin, Launcher, selected Engine, and project-pin versions are separate facts and need not be equal when each is supported.
 5. For `ready`, invoke every repository operation through `rally` so the Launcher follows the selected Engine. For restore, migrate, or clean, show the exact operation, permissions, targets, and effects and wait for explicit user approval before Agent execution.
 6. Invoke Agent Mode with structured output and handle the returned state. Stop on unknown contracts or versions, invalid descriptors or paths, and malformed output.