[dofastted]

Delivery

• Rebuild cli-node from current local source 4154b4e6 and UPX 5.0.2 pack/test/byte-exact decompression roundtrip.
• Build CRAG native source 41254045 in the pinned bookworm builder; pack bootstrap/core before signing/encryption, preserving issuer, product key and original Claude 2.1.321.
• Pin all 22 payload paths (including the complete CRAG factory tree) to one new immutable payload Release. Preserve other component hashes.
• Bump v1.4.067; provenance and exact hashes included. No accounts, config, private source, plaintext core or supplier secrets committed.

Validation

• Consumer targeted kernel/catalog/install/license regressions: 147/147.
• Producer packaging/crypto tests: 7/7.
• UPX integrity checks; packed core offline version succeeds; CLI reports 2.1.321; decompressed CLI equals original build SHA256.
• Complete package passes verifyCragV2Tree; payload local check 22/22.

Rollout

Publish immutable Releases, replace production factory and selected caches, then run scoped kernel restart installation with scheduling/state preservation. Verify actual runtime core and all installed member hashes. No real model requests.

---

Note

Medium Risk
Replaces production cli-node and introduces the full CRAG v2 encrypted factory in the immutable payload; rollout needs scoped kernel restart installs and hash verification, though control-plane logic is unchanged.

Overview
v1.4.067 is a binary and payload release: no control-plane source changes, only version bump, changelog, pinned assets, and release docs.

The pinned factory moves to Release payload-2026.11.11-claude-321-upx. deploy/payload.json now fixes all 22 paths to that release. cli-node is rebuilt from local source at Claude 2.1.321 and UPX 5.0.2 (new size/hash). For the first time the pinned tree includes the full CRAG native v2 factory bundle—signed/encrypted bootstrap and core (UPX before sign/encrypt, existing issuer keys unchanged), plus unmodified official Claude Code 2.1.321 bytes. Other kernel/helper hashes stay on the prior verified baseline.

docs/releases/v1.4.067-binaries.json and v1.4.067-notes.md record commits, UPX options, and SHA256 provenance. Deployed hosts must fetch the new payload, refresh cli-node/CRAG caches, and run the kernel-page restart install on chosen VMs; copying factory files alone does not replace in-use slot copies.

^{Reviewed by Cursor Bugbot for commit 70e8f75. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: f3330cf2-b5b8-4a9b-992c-fd247657daca)