Publish neo-app 13.3.2 so new workspaces get the coding-agent layer #49

Context

The coding-agent layer for scaffolded workspaces is on main: #47 (#45: AGENTS.md, CLAUDE.md, the app skills) and #48 (#46: MCP configs that start the Neural Link from npm). npm still serves neo-app@13.3.1, published 2026-10-24 from dacf149f, which predates both merges (git merge-base --is-ancestor cd2e242 dacf149f → not an ancestor). main declares the same version, so npm-publish.yml cannot ship them until the version moves.

Nothing upstream blocks the publish: neo-neural-link@1.0.0, the package the generated MCP configs start, has been latest on npm since 2026-10-26 01:53Z.

The Problem

npx neo-app creates a workspace without the agent layer, so the outcome of neomjs/neo#20114 ("a coding agent outside our repositories gets neo in one command") is merged but not delivered.

The Architectural Reality

• package.json version (line 3) is what npm publish in .github/workflows/npm-publish.yml publishes (workflow_dispatch, npm Trusted Publishing).
• package-lock.json carries the version twice (root version, packages[""].version); the workflow's npm ci needs both in sync.
• The generated engine pin (tasks/createPackageJson.mjs, "neo.mjs": "^13.3.1") and scripts/check-engine-parity.mjs key on the engine release, not on neo-app's own version. The engine is still 13.3.1, so neither changes.
• Precedent for a scaffolder-only patch ahead of the engine: neo-app@10.0.3 on engine 10.0.2; 10.8.1 and 10.8.2 on engine 10.8.0.

The Fix

npm version 13.3.2 --no-git-tag-version: package.json and both package-lock.json fields. Nothing else.

Acceptance Criteria

• AC-1: package.json and both package-lock.json version fields read 13.3.2, the generated pin stays ^13.3.1, and npm test and npm ci --dry-run exit 0.
• AC-2: npm pack --dry-run lists tasks/createAgentLayer.mjs.
• AC-3: a workspace scaffolded from the packed tarball in a fresh directory contains AGENTS.md, CLAUDE.md and MCP configs that name neo-neural-link.
• AC-4 (post-merge): after @tobiu merges, npm-publish.yml is dispatched, npm view neo-app version reads 13.3.2, and the receipt is on A coding agent outside our repositories gets neo in one command neo#20114.

Out of Scope

• The cold npx neo-app acceptance run with a coding agent reaching the app through the Neural Link: that is A coding agent outside our repositories gets neo in one command neo#20114's own acceptance, run against the published package.
• Any scaffold change beyond the version.

Avoided Traps

• Waiting for the next engine release. It delays the epic's outcome by up to two weeks for no technical reason, because the pin and the parity check are engine-keyed.
• Next post-release bump. If the engine's next release is 13.3.2, that release's neo-app bump takes 13.3.3 (npm refuses a republished version); a 13.4.0 engine needs nothing special.

Related

• Parent: A coding agent outside our repositories gets neo in one command neo#20114
• feat(neo-app): every new workspace is ready for a coding agent (#45) #47, feat(neo-app): the workspace's MCP configs start the Neural Link from npm (#46) #48 (the layer this ships); Bump neo-app and generated neo.mjs pin to 13.3.1 and sync package-lock.json #41 / chore(release): bump neo-app and generated neo.mjs pin to 13.3.1 (#41) #42 (the last version bump, 13.3.1)

Sweeps (2026-10-26T14:06Z): live latest-open — neomjs/create-app 0 open, neomjs/neo latest 20 open by creation, no equivalent; A2A in-flight — latest 30 messages, no claim on a neo-app bump or publish; Memory Core — no prior decision beyond the 2026-10-26 continuity note that names this bump as the next step; own-assignment — 0 open in neomjs/create-app, none overlapping in neomjs/neo.

Origin Session ID: 9853627c-2129-4d41-b905-0c74bec35a48
Retrieval Hint: "neo-app 13.3.2 publish coding-agent layer create-app #47 #48 neo#20114"