[ThoughtProof]

Fresh installs of pot-cli@0.8.11 resolve @pot-sdk2/bridge@1.3.0 through ^1.2.0. That version removed checkAuthorVerifierSeparation, so every CLI command fails while loading, including pot --version. Repository npm ci locks bridge 1.2.0 and hid the failure.

Release the fix as 0.8.12: pin the tested bridge 1.2.0, read the CLI version from package.json instead of the hard-coded 0.5.0, and add a package installation test with a Node 22 Actions check. The test packs the build, installs it normally in a clean consumer without the development lockfile, and checks --version and ask --dry-run with a temporary local config.

The original supplied patch is commit fcd544888eab80c30f61bb52b9614e4a3f8ed6af and is unchanged. Commit 00dafa7 separately updates the package and lockfile to 0.8.12 and labels the changelog entry unreleased. The published 0.8.11 package is immutable; 0.8.12 still needs release and npm publication after this draft is reviewed.

Validation:

• On the original fix, clean install, build, package tests 2/2, plan 337/337, RV 20/20, and product boundaries passed on Node 24.19.0 / npm 11.9.0 and independently on Node 22.14.0 / npm 10.9.9.
• On the 0.8.12 commit, clean npm ci, build, and fresh consumer tests 2/2 pass on Node 24.19.0 / npm 11.9.0. The version test checks the installed 0.8.12 package.
• GitHub's Node 22 package installation check also passes on commit 00dafa7: Actions run 37998395901.

Sentinel's npm migration draft #91 will use the published 0.8.12 version and its actual registry integrity before merging.