build: move the pinned Bun toolchain from 1.3.14 to 1.4.2

.github/PULL_REQUEST_TEMPLATE.md

@@ -18,7 +18,7 @@ New to the project? See the "Your first PR" section in CONTRIBUTING.md.
       `packages/core/src/schema/adr.schema.ts` (not the root re-export), re-ran
       `bun run schema:emit`, and committed the generated `schema/adr.schema.json`.
 - [ ] If `packages/ci/src` **or** `@adrkit/core` changed, I regenerated
-      `packages/ci/dist` under **linux/amd64 bun 1.3.14** and committed it
+      `packages/ci/dist` under **linux/amd64 bun 1.4.2** and committed it
       (see CONTRIBUTING.md — a Mac-built bundle fails the diff gate).
 - [ ] New or changed behavior is covered by tests, and each test was **observed
       failing before it passed** — a check that never failed is not coverage

.github/dependabot.yml

@@ -104,7 +104,7 @@ updates:
           # and each will fail the same gate the first time it moves. A red
           # `clean-clone-builds` showing only a `packages/ci/dist` diff means
           # the fix is `bun run --filter='@adrkit/ci' build` under linux/amd64
-          # bun 1.3.14 (a Mac-built bundle fails the same diff; see
+          # bun 1.4.2 (a Mac-built bundle fails the same diff; see
           # CONTRIBUTING.md) and a commit, not another exclusion here.
           - "yaml"
         update-types:

.github/workflows/action-tag-recovery.yml

@@ -62,7 +62,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
 
       - name: Require an existing successful stable release
         id: source

.github/workflows/ci.yml

@@ -58,7 +58,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
       # The ONLY step permitted to use the network.
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -163,7 +163,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Test the guard, including the walk and symlink refusal
@@ -186,7 +186,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
       - name: Set up Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
@@ -320,7 +320,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Audit dependencies (fail on high/critical advisories)
@@ -342,7 +342,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: adr check on the PR's changed files
@@ -423,7 +423,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
       # No `bun install`. The Action is a self-contained bundle and the assertion
       # script imports only builtins, so a broken dependency graph cannot take this
       # gate down with it — the same property `dco` below is built for.
@@ -615,7 +615,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
       - name: Verify every commit carries a DCO sign-off
         env:
           # Explicit SHAs, not `origin/$BASE_REF..HEAD`. A ref resolves to

.github/workflows/container-release.yml

@@ -91,7 +91,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
 
       - name: Require the completed lockstep release
         id: source

.github/workflows/regenerate-artifacts.yml

@@ -70,7 +70,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
 
       # Objects, not a checkout. Read later with `git show` and `git diff-tree`.
       - name: Fetch the pull request's commit objects
@@ -153,7 +153,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
 
       - name: Fetch the pull request's commit objects
         env:

.github/workflows/release.yml

@@ -55,7 +55,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
 
       - name: Require the release commit on main
         run: |

.github/workflows/site.yml

@@ -60,7 +60,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/trusted-gates.yml

@@ -96,7 +96,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
 
       # Objects, not a checkout. `git fetch` moves commit and tree data into the
       # object store; nothing is written to the worktree and nothing is executed.
@@ -292,7 +292,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.2
 
       # `--slurp` because `--paginate` alone concatenates one JSON array per page
       # into a document that is not JSON. Written to a file rather than piped

.specify/memory/constitution.md

@@ -1,43 +1,16 @@
 <!--
 SYNC IMPACT REPORT
-Version change: 1.0.1 → 1.0.2
-Bump rationale: PATCH clarification of the existing clean-clone policy. The
-public, frozen dependency install already permitted by ADR-0007, contributor
-guidance, and CI is now distinguished from the network-free post-install gates.
+Version change: 1.0.2 → 1.0.3
+Bump rationale: PATCH. Principle II named a literal Bun version (1.3.14), which
+went stale when the toolchain moved to 1.4.2. It now points at the single pin
+that CI, the Containerfile, and contributors already share: `packageManager`
+in the root `package.json`. The rule itself is unchanged.
 Modified principles:
-  - II. Clean Clone Builds Green → II. Clean Clone Builds Green — permits only
-    unauthenticated public-registry access during `bun install
-    --frozen-lockfile`; all later gates and runtime remain credential-free,
-    service-free, and network-free.
+  - II. Clean Clone Builds Green — the frozen install uses the pinned Bun
+    version rather than a literal one.
 Added sections: none.
 Removed sections: none.
-Templates reviewed:
-  ✅ .specify/templates/plan-template.md — no change required; it derives the
-    Constitution Check from this file and contains no duplicated Principle II text.
-  ✅ .specify/templates/spec-template.md — no change required; it contains no
-    duplicated Principle II text.
-  ✅ .specify/templates/tasks-template.md — no change required; it contains no
-    duplicated Principle II text.
-  ✅ .github/agents/speckit.*.agent.md and
-    .github/prompts/speckit.*.prompt.md — no change required; installed
-    instructions load the constitution dynamically and contain no Principle II
-    wording.
-Dependent policy and runtime guidance:
-  ✅ CONTRIBUTING.md — updated to distinguish the sole public-registry install
-    exception from network-free post-install gates and runtime.
-  ✅ docs/adr/0007-adapter-isolation-and-public-surface-build.md — reviewed; no
-    change required.
-  ✅ .github/workflows/ci.yml — reviewed; no change required; Bun 1.3.14 and the
-    frozen install are already isolated in an explicit step.
-  ✅ README.md, CLAUDE.md, bunfig.toml,
-    .github/instructions/use-bun.instructions.md,
-    .cursor/rules/use-bun-instead-of-node-vite-npm-pnpm.mdc, and
-    docs/adr/0010-bun-toolchain.md — reviewed; no conflicting Principle II
-    wording requires propagation.
-Deferred TODOs: none.
-Source of authority: docs/adr/0001, 0002, 0004, 0005, 0007, 0008, 0009, 0010.
-The ADRs are normative. If this file and an accepted ADR disagree, the ADR wins
-and this file must be corrected by amendment.
+Dependent templates: none affected.
 -->
 
 # adrkit Constitution
@@ -70,7 +43,8 @@ code, diffable, and attributable via `git log`. (ADR-0001, ADR-0004)
 ### II. Clean Clone Builds Green
 
 A fresh clone MAY access an unauthenticated public package registry only during
-the frozen dependency-install step. That step MUST use Bun 1.3.14, the committed
+the frozen dependency-install step. That step MUST use the Bun version pinned by
+`packageManager` in the root `package.json`, the committed
 `bun.lock`, and the repository's `bunfig.toml` settings, including the isolated
 linker and `minimumReleaseAge`. After installation, build, typecheck, test, lint,
 packaging, smoke tests, and runtime behavior MUST require no credentials, no
@@ -204,4 +178,4 @@ governs and this file MUST be amended to match.
 - **Compliance.** PRs and reviews verify compliance with Principles I–V. Added
   complexity must be justified against the simpler alternative it displaces.
 
-**Version**: 1.0.2 | **Ratified**: 2026-07-18 | **Last Amended**: 2026-07-20
+**Version**: 1.0.3 | **Ratified**: 2026-07-18 | **Last Amended**: 2026-09-30

CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 ## Toolchain
 
-Install Bun 1.3.14, then run:
+Install Bun 1.4.2, then run:
 
 ```bash
 bun install --frozen-lockfile
@@ -192,12 +192,12 @@ The `@adrkit/ci` Action ships a committed, self-contained bundle at
 `packages/ci/dist/index.js`, and CI enforces that it matches source with a
 `git diff --exit-code packages/ci/dist` gate.
 
-**Rebuild the bundle under `linux/amd64` Bun 1.3.14**, not on a Mac. Bun's
+**Rebuild the bundle under `linux/amd64` Bun 1.4.2**, not on a Mac. Bun's
 CommonJS interop output differs across host targets, so a Mac-built bundle
 drifts and fails the gate. Use the pinned container:
 
 ```bash
-docker run --rm --platform linux/amd64 -v "$PWD":/work -w /work oven/bun:1.3.14 \
+docker run --rm --platform linux/amd64 -v "$PWD":/work -w /work oven/bun:1.4.2 \
   bash -c "bun install --frozen-lockfile && bun run --filter='@adrkit/ci' build"
 bun install --frozen-lockfile   # restore your local (host) install afterward
 ```

Containerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
-ARG BUN_VERSION=1.3.14
-ARG BUN_DIGEST=sha256:5acc90a93e91ff07bf72aa90a7c9f0fa189765aec90b47bdbf2152d2196383c0
+ARG BUN_VERSION=1.4.2
+ARG BUN_DIGEST=sha256:d888c0ae6c86d7866ff10c5aafdd9077b36aee6455b33dd270fb93c0dd5cef6f
 ARG NODE_VERSION=24-alpine
 ARG NODE_DIGEST=sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
 

docs/RELEASING.md

@@ -39,13 +39,13 @@ temporary `NPM_TOKEN` is removed from the protected `npm` environment.
 - Packages publish in dependency order: core, evaluator, CLI, MCP (`@adrkit/mcp`
   depends only on core, so it is appended last to preserve the list's
   chronological order).
-- Bun 1.3.14 builds and packs the artifacts.
+- Bun 1.4.2 builds and packs the artifacts.
 - Packed manifests contain no `workspace:` protocols.
 - Tarballs include compiled ESM, declarations, README, LICENSE, and NOTICE.
 - Installed tarballs run on Node.js 22 and 24 before publication.
 - npm Trusted Publishing supplies short-lived OIDC authentication and automatic
-  provenance. npm CLI 11.5.1 is used only as the registry transport because Bun
-  1.3.14 does not implement npm's OIDC exchange.
+  provenance. npm CLI 11.5.1 is used only as the registry transport because
+  `bun publish` in Bun 1.4.2 still offers no OIDC exchange or provenance.
 - A rerun skips an already-published package only when its registry integrity
   exactly matches the local tarball.
 - A lockstep GitHub release draft is created only after every npm package

package.json

@@ -4,7 +4,7 @@
   "description": "Decision memory for human and agent-authored plans \u2014 machine-readable, CI-enforceable architecture decision records.",
   "type": "module",
   "private": true,
-  "packageManager": "bun@1.3.14",
+  "packageManager": "bun@1.4.2",
   "license": "Apache-2.0",
   "author": "Mark Beacom (@mbeacom)",
   "homepage": "https://github.com/mbeacom/adrkit#readme",