0thernet · Oct 6, 2026 · Oct 5, 2026 · Oct 5, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,13 @@ Historical entries retain their original delivery coordinates.
 
 ## Unreleased
 
+## 0.18.87
+
+Restore the release-publication authority modes the GitHub Release publisher invokes.
+
+- `release-ref-authority.ts` accepts `publication-prewrite` and `publication-postwrite` again: each verifies the governed refs exactly as `release` does, then binds the caller's expected release commit and authenticated main commit before emitting the receipt. This repairs the immutable Release step that failed after the promotion-lattice retirement removed the modes.
+- v0.18.86 was tagged but never published; this release contains its changes verbatim.
+
 ## 0.18.86
 
 Publish MP4 video on LinkedIn, Threads, and Substack and repair the post-create response bindings on four providers.

diff --git a/README.md b/README.md
@@ -27,7 +27,7 @@ Install [Bun 1.3.14](https://bun.sh/docs/installation) if needed, then install
 GhostGet and read a public page:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.86/hraness-ghostget-0.18.86.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.87/hraness-ghostget-0.18.87.tgz
 ghostget read https://example.com
 ```
 
@@ -48,9 +48,9 @@ which always names the latest published release. Upgrading from Wrench? Read the
 The optional Agent Skill teaches your agent when and how to use GhostGet:
 
 ```sh
-npx skills add hraness/ghostget#v0.18.86
+npx skills add hraness/ghostget#v0.18.87
 # With Bun instead:
-bunx skills add hraness/ghostget#v0.18.86
+bunx skills add hraness/ghostget#v0.18.87
 ```
 
 Start a new agent session, then ask: “Use GhostGet to read https://example.com
@@ -182,7 +182,7 @@ firewall.
 
 ## Built-in provider catalog
 
-This v0.18.86 source tree supports executable actions for 21 services: Beeper,
+This v0.18.87 source tree supports executable actions for 21 services: Beeper,
 Bluesky, ClasificadosOnline, Facebook, Facebook Groups, Facebook Marketplace,
 GitHub, Gmail, Hacker News, Instagram, iMessage, LinkedIn, Reddit, Substack,
 Threads, TikTok, Twitch, WebMCP Registry, WhatsApp, X, and YouTube. LinkedIn
@@ -266,7 +266,7 @@ For that same released coordinate, install GhostGet in an agent or application
 that owns its own model, planning, tool loop, approvals, and interface:
 
 ```sh
-bun add https://github.com/hraness/ghostget/releases/download/v0.18.86/hraness-ghostget-0.18.86.tgz
+bun add https://github.com/hraness/ghostget/releases/download/v0.18.87/hraness-ghostget-0.18.87.tgz
 ```
 
 ```ts

diff --git a/dist/apple-photos-client.js b/dist/apple-photos-client.js
@@ -1,7 +1,7 @@
 // @bun
 import {
   GHOSTGET_VERSION
-} from "./index-0c7jvbdw.js";
+} from "./index-azzd31r0.js";
 import {
   canonicalJson,
   sha256

diff --git a/dist/beeper-client.js b/dist/beeper-client.js
@@ -1,7 +1,7 @@
 // @bun
 import {
   GHOSTGET_VERSION
-} from "./index-0c7jvbdw.js";
+} from "./index-azzd31r0.js";
 import {
   canonicalJson,
   canonicalJsonSha256Matches,

diff --git a/dist/index-0c7jvbdw.js → dist/index-azzd31r0.js b/dist/index-0c7jvbdw.js → dist/index-azzd31r0.js
@@ -1,5 +1,5 @@
 // @bun
 // src/version.ts
-var GHOSTGET_VERSION = "0.18.86";
+var GHOSTGET_VERSION = "0.18.87";
 
 export { GHOSTGET_VERSION };
@@ -332,12 +332,12 @@ changes the immutable Release or its tag.
 
 ## Install the canonical release
 
-These commands require the matching published immutable v0.18.85 release.
+These commands require the matching published immutable v0.18.87 release.
 
 For the CLI:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.86/hraness-ghostget-0.18.86.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.87/hraness-ghostget-0.18.87.tgz
 ghostget --version
 ghostget doctor --json
 ```

diff --git a/kb/launch/social-kit.md b/kb/launch/social-kit.md
@@ -57,7 +57,7 @@ The plan is for GhostGet to stay small. Your agent does the thinking, and GhostG
 Post 9 of 9, 192 characters
 
 ```text
-GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.86.
+GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.87.
 
 https://ghostget.com/blog/introducing-ghostget/
 ```
@@ -115,7 +115,7 @@ The plan is for GhostGet to stay small. Your agent does the thinking, and GhostG
 Post 9 of 9, 192 characters
 
 ```text
-GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.86.
+GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.87.
 
 https://ghostget.com/blog/introducing-ghostget/
 ```
@@ -173,7 +173,7 @@ The plan is for GhostGet to stay small. Your agent does the thinking, and GhostG
 Post 9 of 9, 192 characters
 
 ```text
-GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.86.
+GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.87.
 
 https://ghostget.com/blog/introducing-ghostget/
 ```
@@ -197,7 +197,7 @@ GhostGet is for Claude Code, Codex, Cursor, and other agents that run commands o
 
 The plan is for GhostGet to stay small. Your agent does the thinking, and GhostGet runs only actions someone has reviewed. Each new service arrives as reviewed actions with their own previews.
 
-GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.86.
+GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.87.
 
 https://ghostget.com/blog/introducing-ghostget/
 ```
@@ -224,8 +224,8 @@ Topics: Developer Tools, Artificial Intelligence, Open Source
 - Sometimes a post goes through but the answer gets lost on the way back. GhostGet writes down every send before it leaves and never sends it again on its own until it knows what happened.
 - Anything beyond a read starts as a preview that shows the service, the account, and exactly what will be sent. Your agent can prepare it. Nothing is sent until someone confirms that exact preview.
 - GhostGet is for Claude Code, Codex, Cursor, and other agents that run commands on your Mac or Linux machine and need to read the web and use the accounts you already have.
-- GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.86.
-- Latest release: v0.18.86. https://ghostget.com/blog/introducing-ghostget/
+- GhostGet is free, MIT licensed, and runs on macOS and Linux. The first step reads a public page and needs no account. Latest release: v0.18.87.
+- Latest release: v0.18.87. https://ghostget.com/blog/introducing-ghostget/
 
 ## Beats
 
@@ -251,4 +251,4 @@ Topics: Developer Tools, Artificial Intelligence, Open Source
 - claimsTotal: 211. verification/claims.json, every claim
 - claimsEvidenced: 198. verification/claims.json, status evidenced
 - claimsConfigReadback: 9. verification/claims.json, layer configuration-readback
-- status: Latest release: v0.18.86. package.json version
+- status: Latest release: v0.18.87. package.json version
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hraness/ghostget",
-  "version": "0.18.86",
+  "version": "0.18.87",
   "description": "GhostGet gives your AI agent named web actions: read a page, archive one media item, or use a connected account, without credentials or a browser to steer.",
   "license": "MIT",
   "type": "module",

diff --git a/scripts/npm-release-workflow.test.ts b/scripts/npm-release-workflow.test.ts
@@ -359,7 +359,7 @@ describe("npm publication contract", () => {
         (MAX_UNPACKED_BYTES + MAX_PACKED_ENTRIES * 1_023 + 1_024) / 512,
       ) * 512,
     );
-    expect(MAX_PACKAGE_TAR_BYTES).toBe(25_070_080);
+    expect(MAX_PACKAGE_TAR_BYTES).toBe(25_070_592);
     expect(MAX_PACKAGE_TAR_BYTES % 512).toBe(0);
     expect(artifact).toContain("maxOutputLength: MAX_PACKAGE_TAR_BYTES");
     expect(artifact).not.toContain("const maximumTarBytes");
@@ -569,10 +569,10 @@ describe("npm publication contract", () => {
     expect(budget).toContain("785b8fa60c329d7ac46bc8fcf4d959b5fa9d96455bba9e7cdea63f6a3827c4f6");
     expect(Object.isFrozen(repairPackageMeasurement)).toBeTrue();
     expect(repairPackageMeasurement).toMatchObject({
-      scope: "0.18.86 media.publish video lanes and create-response binding repairs",
+      scope: "0.18.87 release-publication authority repair",
       npmVersion: "11.19.0", nodeVersion: "24.20.0", zlibVersion: "1.3.2.1-motley-42c2f19",
-      archiveSha256: "78df7ff4f1934aeef092ad55cdbfcb8c8b5d6cf3543561044653afe14d95766d",
-      packedBytes: 12_231_057, unpackedBytes: 24_414_834, entryCount: 639,
+      archiveSha256: "753ffbeb39d4606f252d299c971fa32ae06c8927b8a4037fb72f349a5c527c9f",
+      packedBytes: 12_231_242, unpackedBytes: 24_415_392, entryCount: 639,
       packedPlatformProjection: 12_387, packedPortabilityAllowance: 4_096,
       payloadPlatformProjection: 353, payloadAllowance: 65,
     });
@@ -588,8 +588,8 @@ describe("npm publication contract", () => {
     expect(budget).toContain("24,024,705 + 353 + 65 = 24,025,123 unpacked");
     expect(budget).toContain("12,152,562 + 12,387 + 4,096 = 12,169,045 packed");
     expect(budget).toContain("24,093,786 + 353 + 65 = 24,094,204 unpacked");
-    expect(MAX_PACKED_BYTES).toBe(12_247_540);
-    expect(MAX_PACKED_BYTES).toBe(12_231_057 + 12_387 + 4_096);
+    expect(MAX_PACKED_BYTES).toBe(12_247_725);
+    expect(MAX_PACKED_BYTES).toBe(12_231_242 + 12_387 + 4_096);
     expect(budget).toContain("aa127b3193c9bb3b0cb5deece5927be60ccb7111a50169320d322ffdeaa13f39");
     expect(budget).toContain("0c331bab3ab3df69a108e18f5f29845b0db90c281cbd6455c0d90fa0b24081e2");
     expect(budget).toContain("873cad8139fda303e2d19c6afd61cf549cf9b4d1d76b2a1d6d632a6afe6bd0d1");
@@ -710,7 +710,7 @@ describe("npm publication contract", () => {
     expect(budget).toContain("47684b3e2eb5cf3ed07fbb520aade8c7251d993f75262fbf1af627d9081a1a5f");
     expect(budget).toContain("23,688,277 + 353 + 65 = 23,688,695");
     expect(budget).toContain("23,759,283 + 353 + 65 = 23,759,701");
-    expect(MAX_UNPACKED_BYTES).toBe(24_415_252);
+    expect(MAX_UNPACKED_BYTES).toBe(24_415_810);
     expect(budget).toContain("23,037,873 + 65 = 23,037,938");
     expect(budget).toContain("f9f3ab38a682690ceaa2699a7309997512030f0fa500a9dc29dcd108123dc41f");
     expect(budget).toContain("23,038,557 + 65 = 23,038,622");
@@ -743,7 +743,7 @@ describe("npm publication contract", () => {
     expect(budget).toContain("01875f12ab73a49d6c7d6bf520dc3d318db816addee2fa7981889f35c958cf7c");
     expect(budget).toContain("b12909f08f7c19460ced56e30619f4860a1183f4b0106170c07837dae577a937");
     expect(budget).toContain("0b212ac291218528dcf979370110a36f10850e046ca90a536057d9a44e807d1d");
-    expect(MAX_UNPACKED_BYTES).toBe(24_414_834 + 353 + 65);
+    expect(MAX_UNPACKED_BYTES).toBe(24_415_392 + 353 + 65);
     expect(budget).toContain("22,794,052 + 65 = 22,794,117");
     expect(budget).toContain("c482efe748f880e3717727d6d39fd92a68953e6eea766642b329ba47ae772d80");
     expect(budget).toContain("22,759,423 + 65 = 22,759,488");
@@ -779,8 +779,8 @@ describe("npm publication contract", () => {
     expect(packageArtifactBudget).toEqual({
       entryCount: { min: 639, max: 639 },
       fileCount: { min: 639, max: 639 },
-      packedBytes: { min: 1_600_000, max: 12_247_540 },
-      unpackedBytes: { min: 9_000_000, max: 24_415_252 },
+      packedBytes: { min: 1_600_000, max: 12_247_725 },
+      unpackedBytes: { min: 9_000_000, max: 24_415_810 },
     });
   });
 

diff --git a/scripts/package-budget.ts b/scripts/package-budget.ts
@@ -2518,16 +2518,24 @@
 // 78df7ff4f1934aeef092ad55cdbfcb8c8b5d6cf3543561044653afe14d95766d. Retain the
 // reviewed allowances: 12,231,057 + 12,387 + 4,096 = 12,247,540 packed;
 // 24,414,834 + 353 + 65 = 24,415,252 unpacked.
+// The 0.18.87 release restores the release-publication authority modes the
+// canonical GitHub Release publisher invokes. Two clean npm 11.19.0 packs on
+// Node 24.20.0 (zlib 1.3.2.1-motley-42c2f19) with --ignore-scripts on darwin
+// arm64 were byte-identical at 639 files/entries, 12,231,242 packed bytes
+// and 24,415,392 unpacked bytes; archive SHA-256
+// 753ffbeb39d4606f252d299c971fa32ae06c8927b8a4037fb72f349a5c527c9f. Retain the
+// reviewed allowances: 12,231,242 + 12,387 + 4,096 = 12,247,725 packed;
+// 24,415,392 + 353 + 65 = 24,415,810 unpacked.
 export const repairPackageMeasurement = Object.freeze({
-  scope: "0.18.86 media.publish video lanes and create-response binding repairs",
+  scope: "0.18.87 release-publication authority repair",
   command: "npm pack --ignore-scripts",
   npmVersion: "11.19.0",
   nodeVersion: "24.20.0",
   zlibVersion: "1.3.2.1-motley-42c2f19",
   platform: "darwin-arm64",
-  archiveSha256: "78df7ff4f1934aeef092ad55cdbfcb8c8b5d6cf3543561044653afe14d95766d",
-  packedBytes: 12_231_057,
-  unpackedBytes: 24_414_834,
+  archiveSha256: "753ffbeb39d4606f252d299c971fa32ae06c8927b8a4037fb72f349a5c527c9f",
+  packedBytes: 12_231_242,
+  unpackedBytes: 24_415_392,
   entryCount: 639,
   packedPlatformProjection: 12_387,
   packedPortabilityAllowance: 4_096,