chore(release): prep 1.14.0 (changelog + version bump)

Release prep for 1.14.0: changelog, version bump, readiness doc, snapshot/CI assertion fixes. Tokmd Rust Result green; full workspace tests pass locally.

Author: EffortlessSteven

CHANGELOG.md

@@ -7,8 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.14.0] - 2026-06-25
+
+1.14 expands the PR evidence surface into a first-class local and CI workflow.
+It adds the `tokmd render` and `tokmd packet generate` CLIs, ships the
+`mode: packet` GitHub Action, sharpens syntax-receipt and complexity evidence,
+and makes several CLI error and validation paths more actionable. No receipt
+schema versions changed in this release.
+
 ### Added
 
+- Added `tokmd render`, which renders packet presets (including unsafe-review
+  bundles) from analysis/context/syntax inputs, ingests sibling tool bundles,
+  and validates against the `tokmd-packets` JSON Schema at the CLI boundary.
+- Added `tokmd packet generate`, an evidence-packet orchestrator that produces
+  the `sensors/tokmd/` packet (analysis, context, optional syntax, manifest)
+  from a single command.
 - Added `mode: packet` to the `EffortlessMetrics/tokmd` GitHub Action. It runs
   `tokmd packet generate` with the prebuilt-binary runtime as the default,
   shares the cockpit/sensor base-ref inference, uploads the `sensors/tokmd/`
@@ -21,18 +35,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `runtime` Action inputs for `mode: packet`. `fail-on` maps packet status to
   workflow failure (`failed`, `partial`, `never`); `runtime: container` is
   reserved for the pending GHCR runtime and fails fast for now.
+- Added `panic_seam_summary` to syntax receipts, summarizing panic-like seams
+  detected during syntax extraction for packet consumers.
 
 ### Changed
 
+- Syntax evidence ranking now deprioritizes test assertion noise so advisory
+  review signals surface higher-value seams instead of test-only assertions.
 - CI phase 3 (#226, #299): retired the duplicate routed Rust Small frontdoor
   workflow (`em-routed-rust-small.yml`) and its `tokmd_rust_small_*` lane
   catalogue entries. Runner routing is now the advisory `Route CI runner` job of
   `ci.yml` (self-hosted primary, GitHub-hosted overflow) feeding the single
   required `Tokmd Rust Result` gate. Branch protection already required only
   `Tokmd Rust Result`, so no required check changed.
 
+### Fixed
+
+- Aligned `max_cyclomatic` with per-function complexity units so the reported
+  maximum reflects a single function rather than an aggregate.
+- `tokmd diff` `resolve_targets` errors are now actionable, including usage
+  examples that show how to specify valid comparison targets.
+- `tokmd context` and `tokmd handoff` now validate numeric flags and reject
+  invalid values with clear errors instead of silently mishandling them.
+- `tokmd packet generate` / `tokmd evidence-packet` now detect UTF-16 encoded
+  JSON inputs (commonly produced by a bare PowerShell `>` redirect on Windows)
+  and return an actionable error pointing at `--output-dir` / `--output` or
+  `Out-File -Encoding utf8` instead of failing with an opaque parse error.
+
+### Security
+
+- Upgraded `pyo3` (and its transitive PyO3 crate family) from 0.28.3 to 0.29.0
+  in `tokmd-python`, resolving the `RUSTSEC-2026-0176` advisory flagged by
+  `cargo deny`.
+
 ### Documentation
 
+- Added usage example blocks to the `tokmd module`, `tokmd run`, and
+  `tokmd init` command help so `--help` shows common invocations, matching the
+  existing `context` / `handoff` / `analyze` / `cockpit` convention
+  (regenerated `docs/reference-cli.md`).
+
 - Resolved the `v1.13.1` publication GHCR visibility caveat: maintainer
   verification on 2026-06-21 records `ghcr.io/effortlessmetrics/tokmd` as
   **verified-public**; swarm GHCR visibility remains undecided (issue #264).

Cargo.lock

@@ -44,7 +44,7 @@ default-members = [
 # xtask is a workspace member but excluded from default-members
 
 [workspace.package]
-version = "1.13.1"
+version = "1.14.0"
 edition = "2024"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -194,22 +194,22 @@ name = "tokmd-workspace"
 
 [workspace.dependencies]
 # Internal crates - centralized for "bump once" version management
-tokmd = { path = "crates/tokmd", version = "1.13.1" }
-tokmd-analysis = { path = "crates/tokmd-analysis", version = "1.13.1" }
-tokmd-analysis-types = { path = "crates/tokmd-analysis-types", version = "1.13.1" }
-tokmd-envelope = { path = "crates/tokmd-envelope", version = "1.13.1" }
-tokmd-core = { path = "crates/tokmd-core", version = "1.13.1" }
-tokmd-format = { path = "crates/tokmd-format", version = "1.13.1" }
-tokmd-git = { path = "crates/tokmd-git", version = "1.13.1" }
-tokmd-model = { path = "crates/tokmd-model", version = "1.13.1" }
-tokmd-wasm = { path = "crates/tokmd-wasm", version = "1.13.1" }
-tokmd-scan = { path = "crates/tokmd-scan", version = "1.13.1" }
-tokmd-sensor = { path = "crates/tokmd-sensor", version = "1.13.1" }
-tokmd-settings = { path = "crates/tokmd-settings", version = "1.13.1" }
-tokmd-types = { path = "crates/tokmd-types", version = "1.13.1" }
-tokmd-io-port = { path = "crates/tokmd-io-port", version = "1.13.1" }
-tokmd-gate = { path = "crates/tokmd-gate", version = "1.13.1" }
-tokmd-cockpit = { path = "crates/tokmd-cockpit", version = "1.13.1" }
+tokmd = { path = "crates/tokmd", version = "1.14.0" }
+tokmd-analysis = { path = "crates/tokmd-analysis", version = "1.14.0" }
+tokmd-analysis-types = { path = "crates/tokmd-analysis-types", version = "1.14.0" }
+tokmd-envelope = { path = "crates/tokmd-envelope", version = "1.14.0" }
+tokmd-core = { path = "crates/tokmd-core", version = "1.14.0" }
+tokmd-format = { path = "crates/tokmd-format", version = "1.14.0" }
+tokmd-git = { path = "crates/tokmd-git", version = "1.14.0" }
+tokmd-model = { path = "crates/tokmd-model", version = "1.14.0" }
+tokmd-wasm = { path = "crates/tokmd-wasm", version = "1.14.0" }
+tokmd-scan = { path = "crates/tokmd-scan", version = "1.14.0" }
+tokmd-sensor = { path = "crates/tokmd-sensor", version = "1.14.0" }
+tokmd-settings = { path = "crates/tokmd-settings", version = "1.14.0" }
+tokmd-types = { path = "crates/tokmd-types", version = "1.14.0" }
+tokmd-io-port = { path = "crates/tokmd-io-port", version = "1.14.0" }
+tokmd-gate = { path = "crates/tokmd-gate", version = "1.14.0" }
+tokmd-cockpit = { path = "crates/tokmd-cockpit", version = "1.14.0" }
 
 # External crates - centralized for consistent versioning
 anyhow = "1.0.102"

Cargo.toml

@@ -14,7 +14,7 @@ expression: "String::from_utf8(buf).unwrap()"
       {
         "vendor": "tokmd",
         "name": "tokmd",
-        "version": "1.13.1"
+        "version": "1.14.0"
       }
     ]
   },

crates/tokmd-format/tests/snapshots/deep_format_w47__snapshot_cyclonedx_multi_file.snap

@@ -13,7 +13,7 @@ expression: out
       {
         "vendor": "tokmd",
         "name": "tokmd",
-        "version": "1.13.1"
+        "version": "1.14.0"
       }
     ]
   },

crates/tokmd-format/tests/snapshots/format_depth_w63__snapshot_w63_cyclonedx_basic.snap

@@ -47,7 +47,7 @@ expression: pretty
       {
         "name": "tokmd",
         "vendor": "tokmd",
-        "version": "1.13.1"
+        "version": "1.14.0"
       }
     ]
   },

crates/tokmd-format/tests/snapshots/format_tests__cyclonedx_snapshot_deterministic.snap

@@ -13,7 +13,7 @@ expression: "String::from_utf8(buf).unwrap()"
       {
         "vendor": "tokmd",
         "name": "tokmd",
-        "version": "1.13.1"
+        "version": "1.14.0"
       }
     ]
   },

crates/tokmd-format/tests/snapshots/snapshot_w45__snapshot_export_cyclonedx_single_file.snap

@@ -117,7 +117,7 @@ expression: "serde_json::to_string_pretty(&pretty).unwrap()"
       {
         "name": "tokmd",
         "vendor": "tokmd",
-        "version": "1.13.1"
+        "version": "1.14.0"
       }
     ]
   },

crates/tokmd-format/tests/snapshots/snapshot_w74__w74_export_cyclonedx.snap

@@ -1,6 +1,6 @@
 {
   "name": "@tokmd/core",
-  "version": "1.13.1",
+  "version": "1.14.0",
   "description": "Code inventory receipts and analytics - Node.js bindings",
   "main": "index.js",
   "types": "index.d.ts",
@@ -19,11 +19,11 @@
     "index.d.ts"
   ],
   "optionalDependencies": {
-    "@tokmd/core-darwin-arm64": "1.13.1",
-    "@tokmd/core-darwin-x64": "1.13.1",
-    "@tokmd/core-linux-arm64-gnu": "1.13.1",
-    "@tokmd/core-linux-x64-gnu": "1.13.1",
-    "@tokmd/core-win32-x64-msvc": "1.13.1"
+    "@tokmd/core-darwin-arm64": "1.14.0",
+    "@tokmd/core-darwin-x64": "1.14.0",
+    "@tokmd/core-linux-arm64-gnu": "1.14.0",
+    "@tokmd/core-linux-x64-gnu": "1.14.0",
+    "@tokmd/core-win32-x64-msvc": "1.14.0"
   },
   "repository": {
     "type": "git",

crates/tokmd-node/npm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokmd/core",
-  "version": "1.13.1",
+  "version": "1.14.0",
   "description": "Node.js bindings for tokmd - code inventory and analytics",
   "main": "index.js",
   "types": "index.d.ts",
@@ -60,13 +60,13 @@
     "@napi-rs/cli": "^3.6.2"
   },
   "optionalDependencies": {
-    "@tokmd/core-win32-x64-msvc": "1.13.1",
-    "@tokmd/core-darwin-x64": "1.13.1",
-    "@tokmd/core-darwin-arm64": "1.13.1",
-    "@tokmd/core-linux-x64-gnu": "1.13.1",
-    "@tokmd/core-linux-x64-musl": "1.13.1",
-    "@tokmd/core-linux-arm64-gnu": "1.13.1",
-    "@tokmd/core-linux-arm64-musl": "1.13.1",
-    "@tokmd/core-win32-arm64-msvc": "1.13.1"
+    "@tokmd/core-win32-x64-msvc": "1.14.0",
+    "@tokmd/core-darwin-x64": "1.14.0",
+    "@tokmd/core-darwin-arm64": "1.14.0",
+    "@tokmd/core-linux-x64-gnu": "1.14.0",
+    "@tokmd/core-linux-x64-musl": "1.14.0",
+    "@tokmd/core-linux-arm64-gnu": "1.14.0",
+    "@tokmd/core-linux-arm64-musl": "1.14.0",
+    "@tokmd/core-win32-arm64-msvc": "1.14.0"
   }
 }