Prepare github-delivery 1.5.1 reliability release

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `github-delivery` are documented here.
 
 ## [Unreleased]
 
+## [1.5.1] - 2026-09-09
+
+### Changed
+
+- Bumped the package version from `1.5.0` to `1.5.1`.
+- Workflow checkpoints now expose controller-owned next actions and completed-phase receipts, ignore model-authored SHA, PR, check, and phase completion claims, reject caller-authored ref injection, and re-derive actionable state when legacy checkpoints resume without fabricating historical receipts (PR #436).
+- Agent debug traces now coalesce adjacent same-identity reasoning deltas and add bounded completion outcome, duration, and failure-class metadata without persisting raw tool payloads or error text (PR #437).
+
+### Fixed
+
+- Pre-open review completion now requires explicit head-bound structured evidence for each required review lens, and hygiene skips require trusted user-intent provenance instead of caller-authored reason text (PR #434).
+- Issue PR publication now keeps machine-readable GitHub CLI output colourless under forced colour environments, uses the validated deterministic publication planner, and supports a verified publication-only terminal state that still requires locked push and create-PR receipts (PR #435).
+- Windows Authority updates now remove obsolete release-owned `app\vX.Y.Z` runtime directories after the new version becomes active, so successful updates retain only the current runtime while preserving `authority.db`, `trust-store.json`, and unknown root/app data (PR #438).
+
 ## [1.5.0] - 2026-09-08
 
 ### Changed
@@ -930,4 +944,4 @@ All notable changes to `github-delivery` are documented here.
 - Executable offline routing and retained-regression evaluations.
 - Deterministic versioned skill bundles with checksums, installation planning, backups, and restore.
 - Tag-bound GitHub Releases with checksum verification, SPDX SBOMs, and artifact attestations.
-- Dependabot, Dependency Review, CodeQL, Scorecard, and executable repository workflow policy checks.
+- Dependabot, Dependency Review, CodeQL, Scorecard, and executable repository workflow policy checks.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-delivery",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Guided installer and safety tooling for GitHub Delivery workflows",
   "type": "module",
   "engines": {

tests/unit/pr-review-quality-contracts.test.mjs

@@ -63,10 +63,14 @@ test("full review surfaces code quality and blast radius through canonical revie
   assert.match(outcome, /unproven/i);
 });
 
-test("trace and PR reliability follow-up stays inside unreleased 1.5.0", () => {
+test("reliability hardening release is complete in 1.5.1", () => {
   const pkg = JSON.parse(read("package.json"));
   const changelog = read("CHANGELOG.md");
+  const release = changelog.split("## [1.5.1] - 2026-09-09")[1]?.split("## [1.5.0]")[0] ?? "";
 
-  assert.equal(pkg.version, "1.5.0");
-  assert.equal((changelog.match(/## \[1\.5\.0\]/g) ?? []).length, 1);
+  assert.equal(pkg.version, "1.5.1");
+  assert.ok(release, "expected a dated 1.5.1 changelog section");
+  for (const pr of [434, 435, 436, 437, 438]) {
+    assert.match(release, new RegExp(`PR #${pr}\\b`));
+  }
 });