From a592d3e6a51d5198891c65be0a9c6d4ae31e1765 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Sun, 2 Aug 2026 11:10:01 +0200
Subject: [PATCH] release: browser node v0.2.3

---
 CHANGELOG.md      | 8 ++++++++
 README.md         | 7 +++++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 src/version.ts    | 2 +-
 5 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b0595a2..6904cc3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.3 — 2026-08-02
+
+- Separate the browser implementation/package version from its IICP SDK compatibility version.
+- Register additive `implementation_name`, `implementation_version`, and
+  `sdk_compatibility_version` fields while retaining `sdk_version` for older directories.
+- Add one bounded quality workflow and a content-free build provenance manifest.
+- No task payload, encryption, relay, or browser execution semantics changed.
+
 ## 0.2.2 — 2026-07-10
 
 - Fix browser-provider relay ticket issuance for opaque node credentials by sending the required `X-Node-Id` subject hint.
diff --git a/README.md b/README.md
index 2b28af1..402a78f 100644
--- a/README.md
+++ b/README.md
@@ -67,6 +67,13 @@ Serving requires WebLLM — add it alongside this package:
 npm install @mlc-ai/web-llm   # peer dependency, only needed to serve
 ```
 
+## Version metadata
+
+Browser package identity and directory compatibility are separate values. Provider
+registration reports `implementation_name=@iicp/web-node`, the package
+`implementation_version`, and `sdk_compatibility_version`; the legacy
+`sdk_version` field remains the compatibility alias for older directories.
+
 ## Encryption
 
 IICP-CX (S.16) Tier-1: ephemeral **X25519** key agreement → **HKDF-SHA256** →
diff --git a/package-lock.json b/package-lock.json
index 26ebad8..456b2cd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@iicp/web-node",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@iicp/web-node",
-      "version": "0.2.2",
+      "version": "0.2.3",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/curves": "^2.2.0",
diff --git a/package.json b/package.json
index c4855ec..cf51da8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@iicp/web-node",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Browser-native IICP node (consume + serve): discovery-mesh client with mandatory E2E encryption (IICP-CX) + WebLLM provider. Zero-config, ESM.",
   "type": "module",
   "main": "dist/index.js",
diff --git a/src/version.ts b/src/version.ts
index 8b279b0..19711a6 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1,7 +1,7 @@
 // Browser implementation and IICP SDK-compatibility versions are separate axes.
 // Keep package.json synchronized with BROWSER_NODE_VERSION; the quality gate
 // rejects drift. SDK compatibility describes the registration contract only.
-export const BROWSER_NODE_VERSION = "0.2.2";
+export const BROWSER_NODE_VERSION = "0.2.3";
 export const BROWSER_NODE_SDK_COMPATIBILITY_VERSION = "0.7.101";
 
 /** Backward-compatible registration value for directories that know only sdk_version. */