Fix Protection Off semantics and prepare v1.3.7

[Wibias]

Summary

Prepare v1.3.7 with the already-merged transient release-download fix from #397 and correct the Protection mode regression tracked in #398.

Changes

• keep the package version at 1.3.7 from Fix transient release downloads and bump v1.3.7 #397
• retain bounded release-asset retries for transient HTTP 502 / 503 / 504 failures
• restore Protection mode → Off to its intended meaning: disable the additional Windows Hello / trusted-authority layer, not GitHub mutation execution
• remove the blanket mutation_execution_denied:authority_mode_off execution denial
• preserve controller-owned current user intent / exact-text confirmation while continuing to ignore caller-controlled authorization booleans
• keep normal mutation-mode, expected-head, idempotency, stack, merge-driver, postcondition, and other execution safety checks unchanged
• keep high-assurance / Sensitive actions and all / Every GitHub write trusted-authority behavior unchanged
• update mutation-mode documentation plus the 1.3.7 README / CHANGELOG release notes

Regression coverage

The Protection-Off regressions prove that:

• an otherwise-authorized high-assurance mutation can execute with authorityMode=off without redeeming a Windows Hello grant
• caller-controlled explicitInstruction cannot self-authorize the same path
• controller-owned workflow intent remains operation-bound
• Off-mode merge/human-reply policy checks remain enforced

The initial execution regression used create_issue and accidentally entangled the unrelated create-idempotency receipt verifier. The corrected test uses assign_issue, which still exercises a high-assurance GitHub write plus deterministic postcondition verification without introducing remote-create receipt semantics.

Release boundary

This PR prepares the source for v1.3.7. It does not authorize or perform a tag, GitHub Release, npm publication, merge, or other release publication.

Fixes #398

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 90d43c85-f2cf-4b2e-a71e-809f9af4d00e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}