ci(release): fail a consumer-visible change that ships no version bump

.github/workflows/ci.yml

@@ -16,6 +16,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          # check:version-bump diffs this branch's package manifests against the
+          # merge base, so the base commit has to be in the clone.
+          fetch-depth: 0
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
@@ -38,6 +41,14 @@ jobs:
       - name: Check publish credential isolation
         run: pnpm run check:publish-workflow
 
+      # GITHUB_BASE_REF is the base BRANCH. The webhook's frozen
+      # pull_request.base.sha is deliberately not used: the checked-out merge ref
+      # is recomputed against the current base tip, so the frozen sha can name a
+      # commit that is no longer the merge parent, and a release merged in the
+      # meantime would pay for this pull request's unpaid change.
+      - name: Check consumer-visible changes carry a version bump
+        run: pnpm run check:version-bump
+
       - name: Lint (biome)
         run: pnpm run lint
 

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- `pnpm run check:version-bump` (new, in the `ci` job) fails any change that alters a consumer-visible package surface without raising that package's version. Compared: every field npm copies into the published manifest — `exports`, `files`, `bin`, `directories`, `engines`, `typesVersions`, `dependencies`, `peerDependencies`, install-lifecycle `scripts`, `private` — plus the `pnpm-workspace.yaml` catalog pins those resolve through. A `catalog:` specifier is compared by what it RESOLVES to, because a byte-identical `"catalog:"` hiding a moved version is exactly how 0.119.0 shipped its peer range twice. Packages are keyed by name, not path, so relocating one still compares against what that name already published.
+
 ## 0.120.0
 
 ### The runtime's own supervision journal is readable again

package.json

@@ -128,6 +128,7 @@
     "check:testing-fixture": "tsx scripts/generate-agent-improvement-proposal-fixtures.ts --check",
     "check:skills": "node scripts/check-skills.mjs",
     "check:publish-workflow": "node scripts/check-publish-workflow.mjs",
+    "check:version-bump": "node scripts/check-version-bump.mjs",
     "release:prepare": "node scripts/prepare-release.mjs",
     "verify:static-imports": "node scripts/verify-static-imports.mjs",
     "verify:edge-tool-loop": "node scripts/verify-edge-tool-loop.mjs",