package.json said 1.42.211 while ghcr.io/hanzoai/app shipped 1.42.354. The
stream advanced twice DURING the work that measured it, which is the cleanest
possible proof that a manual sync is not a fix.
Same cause as chat: the declared version is an input to the tags∪registry scan
that no writer ever writes. The release job now stamps package.json before the
build, commits that tree, and tags that commit.
The scan itself moves VERBATIM into scripts/version.sh — the 1.42. line pin,
curl-not-gh, the `app`-not-`hanzo-app` package name, the jq/grep fallback, the
collision guard and all three incident comments — precisely so the gate and the
writer cannot disagree about what "published" means. That scan is defensive for
recorded reasons: an orphan v2.2.1 hijacking the floor, a scan pointed at the
retired package, and the forge's tag stream lagging GitHub's so v1.42.158 was
cut after v1.42.163 was live.
`scripts/version.sh check` enforces one invariant across all three repos: the
declared version must never be BEHIND the highest published version of its
stream. Wired as a version-drift gate in hanzo.yml on every push and PR.
Corrected forward only, 1.42.211 -> 1.42.354; next release is 1.42.355.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
zeekayandhanzo-dev
f3b587147c