From b43bb3e264179c9adc7e450e5c6fc8723866741a Mon Sep 17 00:00:00 2001
From: Willi Budzinski <w.budzinski@telekom.de>
Date: Fri, 19 Jun 2026 06:01:06 +0200
Subject: [PATCH 1/2] chore: prepare 0.9.28 release

---
 CHANGELOG.md                                  |   4 +
 README.md                                     |   2 +-
 deploy/Dockerfile                             |   2 +-
 deploy/README.md                              |   4 +-
 deploy/coolify/Dockerfile                     |   2 +-
 deploy/coolify/README.md                      |   2 +-
 deploy/coolify/docker-compose.yml             |   2 +-
 deploy/fly/Dockerfile                         |   2 +-
 deploy/fly/README.md                          |   2 +-
 deploy/fly/fly.toml                           |   2 +-
 deploy/helm/agentmemory/Chart.yaml            |   2 +-
 deploy/helm/agentmemory/README.md             |   6 +-
 deploy/helm/agentmemory/values.yaml           |   2 +-
 deploy/railway/Dockerfile                     |   2 +-
 deploy/railway/README.md                      |   4 +-
 deploy/render/Dockerfile                      |   2 +-
 deploy/render/README.md                       |   2 +-
 deploy/render/render.yaml                     |   2 +-
 .../release-prep-plan.md                      | 245 ++++++++++++++++++
 .../todo.md                                   |   2 +
 integrations/openclaw/openclaw.plugin.json    |   2 +-
 integrations/openclaw/package.json            |   2 +-
 integrations/openclaw/plugin.yaml             |   2 +-
 package.json                                  |   2 +-
 packages/mcp/package.json                     |   2 +-
 plugin/.claude-plugin/plugin.json             |   2 +-
 plugin/.codex-plugin/plugin.json              |   2 +-
 plugin/.factory-plugin/plugin.json            |   2 +-
 plugin/opencode/plugin.json                   |   2 +-
 plugin/plugin.json                            |   2 +-
 src/functions/export-import.ts                |   2 +-
 src/types.ts                                  |   2 +-
 src/version.ts                                |   2 +-
 test/export-import.test.ts                    |   2 +-
 test/plugin-surface-contract.test.ts          |  10 +
 35 files changed, 296 insertions(+), 35 deletions(-)
 create mode 100644 docs/todos/2026-06-17-issue-171-anthropic-deps/release-prep-plan.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3a946c0cf..5ad24c221 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - Remote text embeddings now require an explicit `EMBEDDING_PROVIDER` opt-in. Generic provider keys such as `GEMINI_API_KEY`, `OPENAI_API_KEY`, `VOYAGE_API_KEY`, `COHERE_API_KEY`, or `OPENROUTER_API_KEY` no longer enable embeddings by themselves. Existing key-only installs that want vector search must set `EMBEDDING_PROVIDER=gemini|openai|voyage|cohere|openrouter`, or `EMBEDDING_PROVIDER=local` for on-device embeddings.
 
+### Fixed
+
+- **The next npm package metadata no longer auto-installs Anthropic packages** ([#171](https://github.com/wbugitlab1/agentmemory/issues/171)). The source fix that removed `@anthropic-ai/sdk` and moved `@anthropic-ai/claude-agent-sdk` to an optional peer is carried forward into the next patch release so normal `npm install @agentmemory/agentmemory@latest` users do not receive Anthropic dependencies unless they explicitly opt into the Claude Agent SDK fallback.
+
 ## [0.9.27] — 2026-06-07
 
 Wave release closing several breaking regressions reported against v0.9.26, plus an agent-scope isolation security fix, an iii version-pin audit fix, and a benchmark scorecard correction. No breaking changes; drop-in upgrade.
diff --git a/README.md b/README.md
index 5401d34ad..b31fc83b0 100644
--- a/README.md
+++ b/README.md
@@ -872,7 +872,7 @@ npx -y @agentmemory/mcp
 <h2 id="deploy">Deploy</h2>
 
 Managed-host templates and setup guides run the shared
-`ghcr.io/wbugitlab1/agentmemory:0.9.27` image, built from the canonical
+`ghcr.io/wbugitlab1/agentmemory:0.9.28` image, built from the canonical
 `deploy/Dockerfile` after npm publication succeeds. Persistent storage
 mounts at `/data`; the first-boot entrypoint overwrites the
 npm-bundled iii config (which binds `127.0.0.1`) with a deploy-tuned
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index ae42e10b8..839d380d0 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 
diff --git a/deploy/README.md b/deploy/README.md
index 08117fb92..9e3403250 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -3,7 +3,7 @@
 Stand up agentmemory on managed infrastructure without rolling your own
 Docker host, or bring the same runtime model to Kubernetes with Helm.
 The managed-platform templates run the shared
-`ghcr.io/wbugitlab1/agentmemory:0.9.27` image built from
+`ghcr.io/wbugitlab1/agentmemory:0.9.28` image built from
 `deploy/Dockerfile` after npm publication succeeds. Storage mounts at
 `/data`; an HMAC secret is generated by the first-boot entrypoint and
 persisted to the volume. The entrypoint overwrites the npm-bundled iii
@@ -56,7 +56,7 @@ before exec'ing the agentmemory CLI.
 - Pick **Kubernetes / Helm** if you already operate a cluster and want
   a chart-managed Deployment, PVC, Service, optional Ingress, and
   NetworkPolicy. The chart defaults to
-  `ghcr.io/wbugitlab1/agentmemory:0.9.27`; override
+  `ghcr.io/wbugitlab1/agentmemory:0.9.28`; override
   `image.repository` only for a private fork image.
 
 All deployments give you the same agentmemory API at the same port
diff --git a/deploy/coolify/Dockerfile b/deploy/coolify/Dockerfile
index ae42e10b8..839d380d0 100644
--- a/deploy/coolify/Dockerfile
+++ b/deploy/coolify/Dockerfile
@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 
diff --git a/deploy/coolify/README.md b/deploy/coolify/README.md
index 147d62ac5..18c983ef2 100644
--- a/deploy/coolify/README.md
+++ b/deploy/coolify/README.md
@@ -5,7 +5,7 @@ Heroku/Render alternative that you run on your own VPS. This template
 deploys agentmemory as a Coolify *Application* backed by a Docker
 Compose stack — Coolify handles TLS termination, persistent volume
 provisioning, log aggregation, and the deploy webhook for you. The
-compose file pulls `ghcr.io/wbugitlab1/agentmemory:0.9.27`.
+compose file pulls `ghcr.io/wbugitlab1/agentmemory:0.9.28`.
 
 ## What you get
 
diff --git a/deploy/coolify/docker-compose.yml b/deploy/coolify/docker-compose.yml
index ab3680ba1..e24eab410 100644
--- a/deploy/coolify/docker-compose.yml
+++ b/deploy/coolify/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   agentmemory:
-    image: ghcr.io/wbugitlab1/agentmemory:0.9.27
+    image: ghcr.io/wbugitlab1/agentmemory:0.9.28
     restart: unless-stopped
     environment:
       SERVICE_FQDN_AGENTMEMORY_3111: ${SERVICE_FQDN_AGENTMEMORY_3111}
diff --git a/deploy/fly/Dockerfile b/deploy/fly/Dockerfile
index d96b76869..50053429d 100644
--- a/deploy/fly/Dockerfile
+++ b/deploy/fly/Dockerfile
@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 
diff --git a/deploy/fly/README.md b/deploy/fly/README.md
index 6c43f1ace..50b2742dd 100644
--- a/deploy/fly/README.md
+++ b/deploy/fly/README.md
@@ -4,7 +4,7 @@ This template runs agentmemory on a single fly.io machine with a 1 GB
 persistent volume mounted at `/data`. The HMAC secret is generated on
 first boot and persisted to the volume. Retrieve it through `fly ssh`;
 the secret value is not printed to deploy logs. The default Fly config
-deploys `ghcr.io/wbugitlab1/agentmemory:0.9.27`.
+deploys `ghcr.io/wbugitlab1/agentmemory:0.9.28`.
 
 ## What you get
 
diff --git a/deploy/fly/fly.toml b/deploy/fly/fly.toml
index da992471f..8e13e48f1 100644
--- a/deploy/fly/fly.toml
+++ b/deploy/fly/fly.toml
@@ -12,7 +12,7 @@ app = "agentmemory"
 primary_region = "iad"
 
 [build]
-  image = "ghcr.io/wbugitlab1/agentmemory:0.9.27"
+  image = "ghcr.io/wbugitlab1/agentmemory:0.9.28"
 
 [[mounts]]
   source = "agentmemory_data"
diff --git a/deploy/helm/agentmemory/Chart.yaml b/deploy/helm/agentmemory/Chart.yaml
index 3675c6992..f03b11226 100644
--- a/deploy/helm/agentmemory/Chart.yaml
+++ b/deploy/helm/agentmemory/Chart.yaml
@@ -3,7 +3,7 @@ name: agentmemory
 description: Kubernetes Helm chart for agentmemory
 type: application
 version: 0.1.0
-appVersion: "0.9.27"
+appVersion: "0.9.28"
 home: https://github.com/wbugitlab1/agentmemory
 sources:
   - https://github.com/wbugitlab1/agentmemory
diff --git a/deploy/helm/agentmemory/README.md b/deploy/helm/agentmemory/README.md
index 376cca274..154c4a437 100644
--- a/deploy/helm/agentmemory/README.md
+++ b/deploy/helm/agentmemory/README.md
@@ -2,13 +2,13 @@
 
 This chart deploys agentmemory on Kubernetes with the same single-container model used by the Fly, Railway, Render, and Coolify templates.
 
-By default the chart uses `ghcr.io/wbugitlab1/agentmemory:0.9.27`, the same image as the managed-platform templates. Override `image.repository` only when your cluster should pull a private fork image.
+By default the chart uses `ghcr.io/wbugitlab1/agentmemory:0.9.28`, the same image as the managed-platform templates. Override `image.repository` only when your cluster should pull a private fork image.
 
 ## Prerequisites
 
 - Helm 3
 - Kubernetes cluster with `ReadWriteOnce` persistent volume support
-- Access to pull `ghcr.io/wbugitlab1/agentmemory:0.9.27`, or a private image you set in `image.repository`
+- Access to pull `ghcr.io/wbugitlab1/agentmemory:0.9.28`, or a private image you set in `image.repository`
 
 ## Install
 
@@ -126,7 +126,7 @@ Keep a separate backup of the PVC before destructive cluster or storage operatio
 | --- | --- | --- |
 | `replicaCount` | `1` | Must remain `1`; file-backed SQLite state supports one writer. |
 | `image.repository` | `ghcr.io/wbugitlab1/agentmemory` | Image repository; override for private fork images. |
-| `image.tag` | `0.9.27` | Agentmemory image tag. |
+| `image.tag` | `0.9.28` | Agentmemory image tag. |
 | `service.port` | `3111` | REST API Service port. |
 | `persistence.enabled` | `true` | Create a PVC for `/data`. |
 | `persistence.mountPath` | `/data` | Must remain `/data`; deploy images and iii config use this directory. |
diff --git a/deploy/helm/agentmemory/values.yaml b/deploy/helm/agentmemory/values.yaml
index d16a536a9..a47fea520 100644
--- a/deploy/helm/agentmemory/values.yaml
+++ b/deploy/helm/agentmemory/values.yaml
@@ -2,7 +2,7 @@ replicaCount: 1
 
 image:
   repository: "ghcr.io/wbugitlab1/agentmemory"
-  tag: "0.9.27"
+  tag: "0.9.28"
   pullPolicy: IfNotPresent
   pullSecrets: []
 
diff --git a/deploy/railway/Dockerfile b/deploy/railway/Dockerfile
index d96b76869..50053429d 100644
--- a/deploy/railway/Dockerfile
+++ b/deploy/railway/Dockerfile
@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 
diff --git a/deploy/railway/README.md b/deploy/railway/README.md
index d3b10be6c..237d1e8d2 100644
--- a/deploy/railway/README.md
+++ b/deploy/railway/README.md
@@ -4,7 +4,7 @@ This template runs agentmemory on a single Railway service with a
 persistent volume mounted at `/data`. The HMAC secret is generated on
 first boot and persisted to the volume. Retrieve it through Railway
 shell access; the secret value is not printed to deploy logs. Use the
-published `ghcr.io/wbugitlab1/agentmemory:0.9.27` image as the service
+published `ghcr.io/wbugitlab1/agentmemory:0.9.28` image as the service
 source.
 
 ## What you get
@@ -23,7 +23,7 @@ source.
 ## Deploy via Railway dashboard
 
 1. Create a service from the image
-   `ghcr.io/wbugitlab1/agentmemory:0.9.27`.
+   `ghcr.io/wbugitlab1/agentmemory:0.9.28`.
 2. Set the **Config-as-Code Path** under the service Settings to
    `deploy/railway/railway.json` if the service is linked to the fork
    repository for deploy settings.
diff --git a/deploy/render/Dockerfile b/deploy/render/Dockerfile
index d96b76869..50053429d 100644
--- a/deploy/render/Dockerfile
+++ b/deploy/render/Dockerfile
@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 
diff --git a/deploy/render/README.md b/deploy/render/README.md
index 90945c483..ee37782f2 100644
--- a/deploy/render/README.md
+++ b/deploy/render/README.md
@@ -4,7 +4,7 @@ This template runs agentmemory on a single Render Web Service with a
 persistent disk mounted at `/data`. The HMAC secret is generated on
 first boot and persisted to the disk. Retrieve it through Render SSH;
 the secret value is not printed to deploy logs. The Blueprint pulls
-`ghcr.io/wbugitlab1/agentmemory:0.9.27`.
+`ghcr.io/wbugitlab1/agentmemory:0.9.28`.
 
 ## What you get
 
diff --git a/deploy/render/render.yaml b/deploy/render/render.yaml
index 26b2aa939..868324db7 100644
--- a/deploy/render/render.yaml
+++ b/deploy/render/render.yaml
@@ -4,7 +4,7 @@ services:
     runtime: image
     plan: starter
     image:
-      url: ghcr.io/wbugitlab1/agentmemory:0.9.27
+      url: ghcr.io/wbugitlab1/agentmemory:0.9.28
     healthCheckPath: /agentmemory/livez
     autoDeploy: false
     disk:
diff --git a/docs/todos/2026-06-17-issue-171-anthropic-deps/release-prep-plan.md b/docs/todos/2026-06-17-issue-171-anthropic-deps/release-prep-plan.md
new file mode 100644
index 000000000..1fcd21f88
--- /dev/null
+++ b/docs/todos/2026-06-17-issue-171-anthropic-deps/release-prep-plan.md
@@ -0,0 +1,245 @@
+# Issue 171 Release Prep Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Prepare a new patch release so the already-fixed dependency metadata can reach npm users through `@agentmemory/agentmemory@latest`.
+
+**Architecture:** Keep the source dependency fix unchanged. Bump release metadata in the repo-required version surfaces, add a changelog entry for the public npm artifact fix, and verify the local packed package still excludes Anthropic packages from auto-install surfaces.
+
+**Tech Stack:** TypeScript ESM, pnpm 11 workspace metadata, npm pack verification, Vitest.
+
+---
+
+## Sprint Contract
+
+Goal: make issue #171 releasable by moving the existing source fix from version `0.9.27` to the next patch version, `0.9.28`.
+
+Scope:
+- Bump all repo-required agentmemory version surfaces from `0.9.27` to `0.9.28`.
+- Bump plugin, OpenClaw integration, deployment template, deployment documentation, and `@agentmemory/mcp` workspace shim versions to preserve repo contract tests and the existing lockstep release pattern.
+- Add a `CHANGELOG.md` entry documenting that the package metadata in the next release no longer auto-installs Anthropic packages.
+- Verify packed package metadata and targeted tests.
+- Prepare local branch state for a GitHub PR without pushing, creating a PR, publishing, merging, closing the issue, or archiving this thread.
+
+Non-goals:
+- No dependency declaration redesign; current source metadata already has the desired Anthropic optional-peer shape.
+- No npm publish or dist-tag update.
+- No GitHub issue closure until a published npm `latest` version is verified.
+- No thread archival until a terminal approved issue closure or PR merge succeeds.
+- No remote writes without explicit current-turn approval.
+
+Acceptance criteria:
+- `package.json`, `src/version.ts`, `src/types.ts`, `src/functions/export-import.ts`, `test/export-import.test.ts`, plugin manifests, OpenClaw integration manifests, deployment templates/docs, and `packages/mcp/package.json` consistently reference `0.9.28` where they mirror the root version.
+- `CHANGELOG.md` has an unreleased fixed entry explaining that the next publish carries the already-fixed package metadata for issue #171.
+- `npm pack --json --pack-destination /tmp` from the checkout embeds package metadata without `@anthropic-ai/sdk` or `@anthropic-ai/claude-agent-sdk` under regular dependencies.
+- Focused version/package tests pass.
+- Required local security gates for package metadata changes are run or blockers are recorded.
+
+Known boundaries:
+- Remote state changes require approval: fetch, push, PR creation/update, PR merge, npm publish, issue closure, dist-tag changes, and thread archival.
+- If later issue closure is requested, approval must bundle GitHub issue #171 closure plus archiving this Codex thread after successful closure.
+- If later PR merge is requested, approval must bundle PR merge into `origin/main` plus archiving this Codex thread after successful merge.
+
+Stop conditions:
+- Version bump verification shows Anthropic packages still appear in packed regular dependencies.
+- Required security scans fail with unaccepted findings.
+- A step would require publishing, pushing, PR creation, merge, issue closure, or archival without approval.
+- A required release decision beyond a patch version bump is ambiguous.
+
+## Files
+
+- Modify: `package.json`
+- Modify: `src/version.ts`
+- Modify: `src/types.ts`
+- Modify: `src/functions/export-import.ts`
+- Modify: `test/export-import.test.ts`
+- Modify: `plugin/.claude-plugin/plugin.json`
+- Modify: `plugin/.codex-plugin/plugin.json`
+- Modify: `plugin/.factory-plugin/plugin.json`
+- Modify: `plugin/plugin.json`
+- Modify: `plugin/opencode/plugin.json`
+- Modify: `packages/mcp/package.json`
+- Modify: `integrations/openclaw/package.json`
+- Modify: `integrations/openclaw/openclaw.plugin.json`
+- Modify: `integrations/openclaw/plugin.yaml`
+- Modify: `deploy/Dockerfile`
+- Modify: `deploy/fly/Dockerfile`
+- Modify: `deploy/railway/Dockerfile`
+- Modify: `deploy/render/Dockerfile`
+- Modify: `deploy/coolify/Dockerfile`
+- Modify: `deploy/fly/fly.toml`
+- Modify: `deploy/render/render.yaml`
+- Modify: `deploy/coolify/docker-compose.yml`
+- Modify: `deploy/helm/agentmemory/Chart.yaml`
+- Modify: `deploy/helm/agentmemory/values.yaml`
+- Modify: `deploy/README.md`
+- Modify: `deploy/fly/README.md`
+- Modify: `deploy/railway/README.md`
+- Modify: `deploy/render/README.md`
+- Modify: `deploy/coolify/README.md`
+- Modify: `deploy/helm/agentmemory/README.md`
+- Modify: `README.md`
+- Modify: `CHANGELOG.md`
+- Modify if changed by lockfile-only install: `pnpm-lock.yaml`
+- Modify: `test/plugin-surface-contract.test.ts`
+- Modify: `docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md`
+
+## Feature / Verification Matrix
+
+| Change | Verification method | Status | Evidence |
+| --- | --- | --- | --- |
+| Version metadata bump | `rg -n "0\\.9\\.27|0\\.9\\.28"` over release surfaces; focused export/import, plugin, deploy contract tests | Complete | Version scan showed required release surfaces at `0.9.28`, with `0.9.27` remaining only in historical compatibility/changelog references. |
+| Changelog release note | Manual diff inspection | Complete | Added `Unreleased` / `Fixed` entry for issue #171 carrying the package metadata fix into the next patch release. |
+| Package metadata remains fixed | Build, `npm pack --json --pack-destination /tmp`, inspect packed `package.json` with `jq`, and run temp consumer package-lock smoke | Complete | Build passed; `/tmp/agentmemory-agentmemory-0.9.28.tgz` metadata has no Anthropic regular deps; temp consumer lockfile had no Anthropic package keys. |
+| Source package guard remains active | `corepack pnpm exec vitest run test/export-import.test.ts test/quality-gates.test.ts test/plugin-surface-contract.test.ts test/codex-plugin.test.ts test/factory-plugin.test.ts test/deploy-version-contract.test.ts` | Complete | Final focused rerun passed 6 files / 56 tests after adding OpenCode contract coverage. |
+| Security gates | `git diff --check`; staged Gitleaks before commit; OSV/Semgrep as required for package metadata changes | Complete | `git diff --check`, `git diff --cached --check`, OSV, Semgrep, final lint, and staged Gitleaks passed. |
+
+## Subagent Ledger
+
+| Workstream | Scope | Edits allowed | Expected output | Result | Residual risk |
+| --- | --- | --- | --- | --- | --- |
+| Arena remediation choice | `/tmp/arena-issue-171/*` | No repo edits | Recommendation and synthesis | Complete: release-prep/version bump selected | Publishing remains a separate approval-gated action |
+| Pre-implementation plan review | Release-prep plan and version surfaces | No | High/Medium findings or `ACCEPT` | First round found missing plugin/OpenClaw/deploy/lockfile surfaces, consumer install smoke, build-before-pack, and ambiguous fetch boundary; all accepted into plan | None yet |
+| Final review | Stable diff after implementation | No | High/Medium findings or `ACCEPT` | Security and test coverage reviews accepted; maintainability found stale OpenCode manifest version and stale task-state statuses; targeted re-review confirmed OpenCode was fixed and task-state evidence was corrected. | No unresolved High/Medium findings. |
+
+## Task 1: Version Surface Bump
+
+**Files:**
+- Modify: `package.json`
+- Modify: `src/version.ts`
+- Modify: `src/types.ts`
+- Modify: `src/functions/export-import.ts`
+- Modify: `test/export-import.test.ts`
+- Modify: `plugin/.claude-plugin/plugin.json`
+- Modify: `plugin/.codex-plugin/plugin.json`
+- Modify: `plugin/.factory-plugin/plugin.json`
+- Modify: `plugin/plugin.json`
+- Modify: `plugin/opencode/plugin.json`
+- Modify: `integrations/openclaw/package.json`
+- Modify: `integrations/openclaw/openclaw.plugin.json`
+- Modify: `integrations/openclaw/plugin.yaml`
+- Modify: `packages/mcp/package.json`
+- Modify: `test/plugin-surface-contract.test.ts`
+- Modify: deployment template/docs files listed above
+- Modify if changed by lockfile-only install: `pnpm-lock.yaml`
+
+- [x] **Step 1: Update package and plugin versions**
+
+Change each `"version": "0.9.27"` in the package/plugin/OpenClaw package release surfaces to `"0.9.28"`, change stale `plugin/opencode/plugin.json` version metadata to `"0.9.28"`, and change `version: 0.9.27` in `integrations/openclaw/plugin.yaml` to `version: 0.9.28`.
+
+- [x] **Step 2: Update runtime version constant**
+
+Change `src/version.ts` to:
+
+```ts
+export const VERSION = "0.9.28";
+```
+
+- [x] **Step 3: Extend export version support**
+
+Append `"0.9.28"` to the `ExportData.version` union in `src/types.ts` and to the `supportedVersions` set in `src/functions/export-import.ts`.
+
+- [x] **Step 4: Update version assertion**
+
+Change `test/export-import.test.ts` so `export produces valid ExportData structure` expects `"0.9.28"`.
+
+- [x] **Step 5: Inspect version references**
+
+Run: `rg -n "0\\.9\\.27|0\\.9\\.28" package.json src/version.ts src/types.ts src/functions/export-import.ts test/export-import.test.ts plugin/.claude-plugin/plugin.json plugin/.codex-plugin/plugin.json plugin/.factory-plugin/plugin.json plugin/plugin.json plugin/opencode/plugin.json packages/mcp/package.json integrations/openclaw deploy README.md CHANGELOG.md`
+
+Expected: required release surfaces show `0.9.28`; `0.9.27` remains only in historical compatibility lists or previous changelog sections.
+
+- [x] **Step 6: Refresh pnpm lockfile metadata**
+
+Run: `corepack pnpm install --lockfile-only --ignore-scripts`
+
+Expected: command exits 0. If `pnpm-lock.yaml` changes, inspect and keep only version metadata churn caused by this release bump. If it is unchanged, record that no lockfile edit was needed.
+
+- [x] **Step 7: Verify frozen dependency setup**
+
+Run: `corepack pnpm install --frozen-lockfile --ignore-scripts`
+
+Expected: command exits 0 without requiring lifecycle build approvals.
+
+## Task 2: Changelog Entry
+
+**Files:**
+- Modify: `CHANGELOG.md`
+
+- [x] **Step 1: Add issue #171 release note under Unreleased / Fixed**
+
+Add a `### Fixed` section under `## [Unreleased]` if one is not present, then add a bullet explaining that the next npm package metadata no longer auto-installs `@anthropic-ai/sdk` or `@anthropic-ai/claude-agent-sdk`; the Claude Agent SDK remains an optional peer and explicit opt-in.
+
+- [x] **Step 2: Inspect changelog placement**
+
+Run: `sed -n '1,40p' CHANGELOG.md`
+
+Expected: the new `Fixed` entry appears under `Unreleased`, below existing `Security` content if both sections exist.
+
+## Task 3: Verification
+
+**Files:**
+- No source edits unless checks find a scoped issue.
+
+- [x] **Step 1: Run focused tests**
+
+Run: `corepack pnpm exec vitest run test/export-import.test.ts test/quality-gates.test.ts test/plugin-surface-contract.test.ts test/codex-plugin.test.ts test/factory-plugin.test.ts test/deploy-version-contract.test.ts`
+
+Expected: all listed test files pass.
+
+- [x] **Step 2: Build before package checks**
+
+Run: `corepack pnpm run build`
+
+Expected: build exits 0 and refreshes `dist/`/plugin script artifacts as the publish workflow does.
+
+- [x] **Step 3: Run package metadata check**
+
+Run:
+
+```bash
+npm pack --json --pack-destination /tmp
+tar -xOf /tmp/agentmemory-agentmemory-0.9.28.tgz package/package.json | jq '{version,dependencies,peerDependencies,peerDependenciesMeta,optionalDependencies,bundledDependencies,bundleDependencies}'
+corepack pnpm --dir packages/mcp pack --dry-run --json
+```
+
+Expected: packed root version is `0.9.28`; regular dependencies do not include `@anthropic-ai/sdk` or `@anthropic-ai/claude-agent-sdk`; `@anthropic-ai/claude-agent-sdk` is optional peer metadata only; MCP dry-run reports version `0.9.28` and the workspace dependency is suitable for publish rewrite.
+
+- [x] **Step 4: Run consumer npm install smoke**
+
+Create a temporary project under `/private/tmp`, run `npm init -y`, then run `npm install --package-lock-only --ignore-scripts /tmp/agentmemory-agentmemory-0.9.28.tgz`. Inspect `package-lock.json` with `jq` or `rg`.
+
+Expected: no lockfile package key contains `node_modules/@anthropic-ai/sdk` or `node_modules/@anthropic-ai/claude-agent-sdk`.
+
+- [x] **Step 5: Run whitespace diff check**
+
+Run: `git diff --check`
+
+Expected: no whitespace errors.
+
+- [x] **Step 6: Run package/security scans required for this surface**
+
+Run `osv-scanner scan source .` and `semgrep scan --config p/default --error --metrics=off .` unless the tools are unavailable or blocked. Record exact blockers instead of claiming success.
+
+## Task 4: Local GitHub PR Prep
+
+**Files:**
+- Modify: `docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md`
+
+- [x] **Step 1: Update task record with verification evidence**
+
+Record commands, results, changed files, remote-write boundaries, and the mandatory terminal archival contract.
+
+- [x] **Step 2: Run local GitHub push preparation**
+
+Use `$github-push-prepare` local mode as far as current approval allows: run required preflight, use existing local `origin/main` unless explicit current-turn approval is granted for a fresh `git fetch origin main`, run the required review chain or record unavailable skill blockers, stage only task-owned files, run `gitleaks protect --staged --redact`, commit, and stop before push/PR creation.
+
+Expected: local branch is clean and prepared for a PR, with exact next commands reported; no push, PR creation, publish, merge, issue closure, or thread archival occurs.
+
+## Plan Self-Review
+
+Spec coverage: Covers the arena-selected release-prep path, repo-mandated version surfaces, plugin/OpenClaw/deploy contract surfaces, and the established MCP shim lockstep version.
+
+Placeholder scan: No TBD placeholders remain. Each verification command has expected evidence.
+
+Type consistency: Version strings are consistently `0.9.28`; export compatibility keeps historical `0.9.27` while adding `0.9.28`.
diff --git a/docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md b/docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md
index 2cbb32ee1..255837955 100644
--- a/docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md
+++ b/docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md
@@ -123,6 +123,8 @@ Dependency-intake detail:
 
 ## Progress Notes
 
+- 2026-06-19: Current worktree `/Users/A1538552/.codex/worktrees/f04c/agentmemory` created local branch `issue/171-anthropic-dependencies` from detached `origin/main` state `eacce17e`. Public issue #171 remains open. Local source and local pack metadata are fixed, but public npm `@agentmemory/agentmemory@latest` still resolves to `0.9.27` with `@anthropic-ai/sdk` and `@anthropic-ai/claude-agent-sdk` under regular dependencies. Arena synthesis at `/tmp/arena-issue-171/SYNTHESIS.md` selected a narrow release-prep/version bump path instead of issue closure or more dependency source edits. Added `release-prep-plan.md` for the `0.9.28` release-prep continuation. No push, PR creation, publish, merge, issue closure, or thread archival is approved. Any future terminal issue closure approval must bundle GitHub issue #171 closure plus archiving this Codex thread after successful closure; any future PR merge approval must bundle merge into `origin/main` plus archiving this Codex thread after successful merge.
+- 2026-06-19: Implemented release-prep version bump to `0.9.28` across root package, runtime/export surfaces, plugin manifests including OpenCode, OpenClaw manifests, MCP shim package, deployment templates/docs, README deploy image, and changelog. Added `test/plugin-surface-contract.test.ts` coverage requiring the OpenCode manifest version to match the root package. `corepack pnpm install --lockfile-only --ignore-scripts` made no `pnpm-lock.yaml` changes; `corepack pnpm install --frozen-lockfile --ignore-scripts` passed with the expected missing `dist/cli.mjs` bin warning before build. Focused tests passed: `corepack pnpm exec vitest run test/plugin-surface-contract.test.ts test/export-import.test.ts test/quality-gates.test.ts test/codex-plugin.test.ts test/factory-plugin.test.ts test/deploy-version-contract.test.ts` -> 6 files / 56 tests. `corepack pnpm run build` passed. `corepack pnpm run lint` passed. Root pack produced `/tmp/agentmemory-agentmemory-0.9.28.tgz`; packed metadata has regular deps only `@clack/prompts`, `dotenv`, `iii-sdk`, and `zod`, with `@anthropic-ai/claude-agent-sdk` only as optional peer. MCP pack produced `/tmp/agentmemory-mcp-0.9.28.tgz` with dependency `@agentmemory/agentmemory: ~0.9.28`. Temp consumer install smoke in `/private/tmp/agentmemory-issue171-consumer-rerun-wEowMc` produced no lockfile package keys for `node_modules/@anthropic-ai/sdk` or `node_modules/@anthropic-ai/claude-agent-sdk`. Security gates: `git diff --check` and `git diff --cached --check` passed; `osv-scanner scan source .` passed with existing GHSA-8988-4f7v-96qf waiver and no unfiltered issues; `semgrep scan --config p/default --error --metrics=off .` completed with 0 findings and three rule timeout warnings; `gitleaks protect --staged --redact` passed with no leaks.
 - 2026-06-17: Read active repo instructions, confirmed clean detached worktree with `git status -sb --untracked-files=all`.
 - 2026-06-17: Created local branch `github-pr/issue-171-anthropic-deps-fe927dc2` from `fe927dc2` because GitHub push prep requires a named branch before local prep work.
 - 2026-06-17: Public upstream issue `rohitg00/agentmemory#430` confirms original report was `@agentmemory/agentmemory@0.9.16` installing `@anthropic-ai/sdk@^0.39.0` and `@anthropic-ai/claude-agent-sdk@^0.3.142` with a peer conflict. Current local package metadata fixes the peer conflict with `@anthropic-ai/sdk@^0.100.1` but still auto-installs both Anthropic packages.
diff --git a/integrations/openclaw/openclaw.plugin.json b/integrations/openclaw/openclaw.plugin.json
index 3e4c7e44e..91df5f1fd 100644
--- a/integrations/openclaw/openclaw.plugin.json
+++ b/integrations/openclaw/openclaw.plugin.json
@@ -3,7 +3,7 @@
   "kind": "memory",
   "name": "agentmemory",
   "description": "Persistent cross-session memory for OpenClaw via agentmemory.",
-  "version": "0.9.27",
+  "version": "0.9.28",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,
diff --git a/integrations/openclaw/package.json b/integrations/openclaw/package.json
index aef780b8d..5d7f3bfb9 100644
--- a/integrations/openclaw/package.json
+++ b/integrations/openclaw/package.json
@@ -1,6 +1,6 @@
 {
   "name": "agentmemory",
-  "version": "0.9.27",
+  "version": "0.9.28",
   "type": "module",
   "packageManager": "pnpm@11.6.0",
   "openclaw": {
diff --git a/integrations/openclaw/plugin.yaml b/integrations/openclaw/plugin.yaml
index fe711d5d9..666a63c4d 100644
--- a/integrations/openclaw/plugin.yaml
+++ b/integrations/openclaw/plugin.yaml
@@ -1,5 +1,5 @@
 name: agentmemory
-version: 0.9.27
+version: 0.9.28
 description: "Persistent cross-session memory for OpenClaw via agentmemory. 95.2% retrieval accuracy on LongMemEval-S."
 author: "Rohit Ghumare"
 homepage: "https://github.com/rohitg00/agentmemory"
diff --git a/package.json b/package.json
index 08fb9c810..74e0ddd9f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agentmemory/agentmemory",
-  "version": "0.9.27",
+  "version": "0.9.28",
   "description": "Persistent memory for AI coding agents, powered by iii-engine's three primitives",
   "type": "module",
   "packageManager": "pnpm@11.6.0",
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index 464aeb69c..bf3e3ba39 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agentmemory/mcp",
-  "version": "0.9.27",
+  "version": "0.9.28",
   "description": "Standalone MCP server for agentmemory — thin shim that re-exposes @agentmemory/agentmemory's MCP entrypoint",
   "type": "module",
   "packageManager": "pnpm@11.6.0",
diff --git a/plugin/.claude-plugin/plugin.json b/plugin/.claude-plugin/plugin.json
index 729efd19d..1a92af19c 100644
--- a/plugin/.claude-plugin/plugin.json
+++ b/plugin/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agentmemory",
-  "version": "0.9.27",
+  "version": "0.9.28",
   "description": "Persistent memory for AI coding agents -- captures tool usage, compresses via LLM, injects context into future sessions. 12 hooks, 61 MCP tools, 15 skills, real-time viewer.",
   "author": {
     "name": "Rohit Ghumare",
diff --git a/plugin/.codex-plugin/plugin.json b/plugin/.codex-plugin/plugin.json
index 826398bbe..e3294f972 100644
--- a/plugin/.codex-plugin/plugin.json
+++ b/plugin/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agentmemory",
-  "version": "0.9.27",
+  "version": "0.9.28",
   "description": "Persistent memory for AI coding agents -- captures tool usage, compresses via LLM, injects context into future sessions. 6 hooks, 61 MCP tools, 15 skills, real-time viewer.",
   "author": {
     "name": "Rohit Ghumare",
diff --git a/plugin/.factory-plugin/plugin.json b/plugin/.factory-plugin/plugin.json
index feb1a8299..5731c2282 100644
--- a/plugin/.factory-plugin/plugin.json
+++ b/plugin/.factory-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agentmemory",
-  "version": "0.9.27",
+  "version": "0.9.28",
   "description": "Persistent memory for AI coding agents -- captures tool usage, compresses via LLM, injects context into future sessions. 12 hooks, 61 MCP tools, 15 skills, real-time viewer.",
   "author": {
     "name": "Rohit Ghumare",
diff --git a/plugin/opencode/plugin.json b/plugin/opencode/plugin.json
index 1472752e9..179df957b 100644
--- a/plugin/opencode/plugin.json
+++ b/plugin/opencode/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agentmemory-capture",
-  "version": "0.9.20",
+  "version": "0.9.28",
   "description": "OpenCode plugin for agentmemory — full Claude Code hook parity: session lifecycle (create/idle/status/compacted/update/diff/delete/error), messages & prompts (chat.message, message.updated user+assistant, message.removed), tool lifecycle (ToolPart states with timing), part tracking (subtask, step-finish, reasoning, file, patch, compaction, agent, retry), file enrichment pipeline, permissions, task tracking (w/ priority), commands, config & model tracking. 22 hooks, 2 slash commands.",
   "author": {
     "name": "Rohit Ghumare",
diff --git a/plugin/plugin.json b/plugin/plugin.json
index ffaffead0..1f08d30c0 100644
--- a/plugin/plugin.json
+++ b/plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agentmemory",
-  "version": "0.9.27",
+  "version": "0.9.28",
   "description": "Persistent memory for AI coding agents -- captures tool usage, compresses via LLM, injects context into future sessions. 11 hooks, 61 MCP tools, 15 skills, real-time viewer.",
   "author": {
     "name": "Rohit Ghumare",
diff --git a/src/functions/export-import.ts b/src/functions/export-import.ts
index 1c6dacad7..8d2bbb53f 100644
--- a/src/functions/export-import.ts
+++ b/src/functions/export-import.ts
@@ -177,7 +177,7 @@ export function registerExportImportFunction(sdk: ISdk, kv: StateKV): void {
       const strategy = data.strategy || "merge";
       const importData = data.exportData;
 
-      const supportedVersions = new Set(["0.3.0", "0.4.0", "0.5.0", "0.6.0", "0.6.1", "0.7.0", "0.7.2", "0.7.3", "0.7.4", "0.7.5", "0.7.6", "0.7.7", "0.7.9", "0.8.0", "0.8.1", "0.8.2", "0.8.3", "0.8.4", "0.8.5", "0.8.6", "0.8.7", "0.8.8", "0.8.9", "0.8.10", "0.8.11", "0.8.12", "0.8.13", "0.9.0", "0.9.1", "0.9.2", "0.9.3", "0.9.4", "0.9.5", "0.9.6", "0.9.7", "0.9.8", "0.9.9", "0.9.10", "0.9.11", "0.9.12", "0.9.13", "0.9.14", "0.9.15", "0.9.16", "0.9.17", "0.9.18", "0.9.19", "0.9.20", "0.9.21", "0.9.22", "0.9.23", "0.9.24", "0.9.25", "0.9.26", "0.9.27"]);
+      const supportedVersions = new Set(["0.3.0", "0.4.0", "0.5.0", "0.6.0", "0.6.1", "0.7.0", "0.7.2", "0.7.3", "0.7.4", "0.7.5", "0.7.6", "0.7.7", "0.7.9", "0.8.0", "0.8.1", "0.8.2", "0.8.3", "0.8.4", "0.8.5", "0.8.6", "0.8.7", "0.8.8", "0.8.9", "0.8.10", "0.8.11", "0.8.12", "0.8.13", "0.9.0", "0.9.1", "0.9.2", "0.9.3", "0.9.4", "0.9.5", "0.9.6", "0.9.7", "0.9.8", "0.9.9", "0.9.10", "0.9.11", "0.9.12", "0.9.13", "0.9.14", "0.9.15", "0.9.16", "0.9.17", "0.9.18", "0.9.19", "0.9.20", "0.9.21", "0.9.22", "0.9.23", "0.9.24", "0.9.25", "0.9.26", "0.9.27", "0.9.28"]);
       if (!supportedVersions.has(importData.version)) {
         return {
           success: false,
diff --git a/src/types.ts b/src/types.ts
index 08b045ad5..5054ecbfc 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -441,7 +441,7 @@ export interface ExportPagination {
 }
 
 export interface ExportData {
-  version: "0.3.0" | "0.4.0" | "0.5.0" | "0.6.0" | "0.6.1" | "0.7.0" | "0.7.2" | "0.7.3" | "0.7.4" | "0.7.5" | "0.7.6" | "0.7.7" | "0.7.9" | "0.8.0" | "0.8.1" | "0.8.2" | "0.8.3" | "0.8.4" | "0.8.5" | "0.8.6" | "0.8.7" | "0.8.8" | "0.8.9" | "0.8.10" | "0.8.11" | "0.8.12" | "0.8.13" | "0.9.0" | "0.9.1" | "0.9.2" | "0.9.3" | "0.9.4" | "0.9.5" | "0.9.6" | "0.9.7" | "0.9.8" | "0.9.9" | "0.9.10" | "0.9.11" | "0.9.12" | "0.9.13" | "0.9.14" | "0.9.15" | "0.9.16" | "0.9.17" | "0.9.18" | "0.9.19" | "0.9.20" | "0.9.21" | "0.9.22" | "0.9.23" | "0.9.24" | "0.9.25" | "0.9.26" | "0.9.27";
+  version: "0.3.0" | "0.4.0" | "0.5.0" | "0.6.0" | "0.6.1" | "0.7.0" | "0.7.2" | "0.7.3" | "0.7.4" | "0.7.5" | "0.7.6" | "0.7.7" | "0.7.9" | "0.8.0" | "0.8.1" | "0.8.2" | "0.8.3" | "0.8.4" | "0.8.5" | "0.8.6" | "0.8.7" | "0.8.8" | "0.8.9" | "0.8.10" | "0.8.11" | "0.8.12" | "0.8.13" | "0.9.0" | "0.9.1" | "0.9.2" | "0.9.3" | "0.9.4" | "0.9.5" | "0.9.6" | "0.9.7" | "0.9.8" | "0.9.9" | "0.9.10" | "0.9.11" | "0.9.12" | "0.9.13" | "0.9.14" | "0.9.15" | "0.9.16" | "0.9.17" | "0.9.18" | "0.9.19" | "0.9.20" | "0.9.21" | "0.9.22" | "0.9.23" | "0.9.24" | "0.9.25" | "0.9.26" | "0.9.27" | "0.9.28";
   exportedAt: string;
   sessions: Session[];
   observations: Record<string, CompressedObservation[]>;
diff --git a/src/version.ts b/src/version.ts
index 927846096..6d09f4f4a 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const VERSION = "0.9.27";
+export const VERSION = "0.9.28";
diff --git a/test/export-import.test.ts b/test/export-import.test.ts
index 394986269..39c17cab8 100644
--- a/test/export-import.test.ts
+++ b/test/export-import.test.ts
@@ -119,7 +119,7 @@ describe("Export/Import Functions", () => {
   it("export produces valid ExportData structure", async () => {
     const result = (await sdk.trigger("mem::export", {})) as ExportData;
 
-    expect(result.version).toBe("0.9.27");
+    expect(result.version).toBe("0.9.28");
     expect(result.exportedAt).toBeDefined();
     expect(result.sessions.length).toBe(1);
     expect(result.sessions[0].id).toBe("ses_1");
diff --git a/test/plugin-surface-contract.test.ts b/test/plugin-surface-contract.test.ts
index e85b89836..5e0495324 100644
--- a/test/plugin-surface-contract.test.ts
+++ b/test/plugin-surface-contract.test.ts
@@ -169,6 +169,16 @@ describe("Package and integration manifests", () => {
     expect(existsSync(join(repoRoot, "integrations/openclaw/plugin.mjs"))).toBe(true);
   });
 
+  it("keeps the OpenCode plugin manifest aligned with the main package version", () => {
+    const rootPkg = readJson<{ version: string }>(join(repoRoot, "package.json"));
+    const manifest = readJson<{ name: string; version: string }>(
+      join(pluginRoot, "opencode/plugin.json"),
+    );
+
+    expect(manifest.name).toBe("agentmemory-capture");
+    expect(manifest.version).toBe(rootPkg.version);
+  });
+
   it("keeps pi integration packaging private and ESM-only", () => {
     const pkg = readJson<{ name: string; private: boolean; type: string }>(
       join(repoRoot, "integrations/pi/package.json"),

From da2656ed06ac5a53c0d1b20e0c78b14a3c54f3b1 Mon Sep 17 00:00:00 2001
From: Willi Budzinski <w.budzinski@telekom.de>
Date: Fri, 19 Jun 2026 14:19:26 +0200
Subject: [PATCH 2/2] test: align agent stats version

---
 AGENTS.md                                              | 2 +-
 docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 40af4b601..b8a8c0bc4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -115,7 +115,7 @@ Hook scripts in `src/hooks/` are standalone Node.js scripts (no iii-sdk import).
 - Test files go in `test/` with `.test.ts` extension
 - Follow existing patterns in `test/crystallize.test.ts` for function tests
 
-## Current Stats (v0.9.27)
+## Current Stats (v0.9.28)
 
 - 61 MCP tools (8 visible by default, `AGENTMEMORY_TOOLS=all` for all)
 - 134 REST endpoints
diff --git a/docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md b/docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md
index 255837955..ea8641967 100644
--- a/docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md
+++ b/docs/todos/2026-06-17-issue-171-anthropic-deps/todo.md
@@ -125,6 +125,7 @@ Dependency-intake detail:
 
 - 2026-06-19: Current worktree `/Users/A1538552/.codex/worktrees/f04c/agentmemory` created local branch `issue/171-anthropic-dependencies` from detached `origin/main` state `eacce17e`. Public issue #171 remains open. Local source and local pack metadata are fixed, but public npm `@agentmemory/agentmemory@latest` still resolves to `0.9.27` with `@anthropic-ai/sdk` and `@anthropic-ai/claude-agent-sdk` under regular dependencies. Arena synthesis at `/tmp/arena-issue-171/SYNTHESIS.md` selected a narrow release-prep/version bump path instead of issue closure or more dependency source edits. Added `release-prep-plan.md` for the `0.9.28` release-prep continuation. No push, PR creation, publish, merge, issue closure, or thread archival is approved. Any future terminal issue closure approval must bundle GitHub issue #171 closure plus archiving this Codex thread after successful closure; any future PR merge approval must bundle merge into `origin/main` plus archiving this Codex thread after successful merge.
 - 2026-06-19: Implemented release-prep version bump to `0.9.28` across root package, runtime/export surfaces, plugin manifests including OpenCode, OpenClaw manifests, MCP shim package, deployment templates/docs, README deploy image, and changelog. Added `test/plugin-surface-contract.test.ts` coverage requiring the OpenCode manifest version to match the root package. `corepack pnpm install --lockfile-only --ignore-scripts` made no `pnpm-lock.yaml` changes; `corepack pnpm install --frozen-lockfile --ignore-scripts` passed with the expected missing `dist/cli.mjs` bin warning before build. Focused tests passed: `corepack pnpm exec vitest run test/plugin-surface-contract.test.ts test/export-import.test.ts test/quality-gates.test.ts test/codex-plugin.test.ts test/factory-plugin.test.ts test/deploy-version-contract.test.ts` -> 6 files / 56 tests. `corepack pnpm run build` passed. `corepack pnpm run lint` passed. Root pack produced `/tmp/agentmemory-agentmemory-0.9.28.tgz`; packed metadata has regular deps only `@clack/prompts`, `dotenv`, `iii-sdk`, and `zod`, with `@anthropic-ai/claude-agent-sdk` only as optional peer. MCP pack produced `/tmp/agentmemory-mcp-0.9.28.tgz` with dependency `@agentmemory/agentmemory: ~0.9.28`. Temp consumer install smoke in `/private/tmp/agentmemory-issue171-consumer-rerun-wEowMc` produced no lockfile package keys for `node_modules/@anthropic-ai/sdk` or `node_modules/@anthropic-ai/claude-agent-sdk`. Security gates: `git diff --check` and `git diff --cached --check` passed; `osv-scanner scan source .` passed with existing GHSA-8988-4f7v-96qf waiver and no unfiltered issues; `semgrep scan --config p/default --error --metrics=off .` completed with 0 findings and three rule timeout warnings; `gitleaks protect --staged --redact` passed with no leaks.
+- 2026-06-19: After PR #1011 creation, GitHub CI failed because `test/tool-count-consistency.test.ts` requires `AGENTS.md` `Current Stats` to match the root package version, and the release-prep branch still had `v0.9.27`. Fetched current `origin/main` (`bb673668`, PR #1010) and merged it into `issue/171-anthropic-dependencies` locally, then updated `AGENTS.md` to `Current Stats (v0.9.28)`. Follow-up verification passed: `corepack pnpm exec vitest run test/tool-count-consistency.test.ts`, `corepack pnpm test`, `corepack pnpm run coverage`, and `git diff --check`.
 - 2026-06-17: Read active repo instructions, confirmed clean detached worktree with `git status -sb --untracked-files=all`.
 - 2026-06-17: Created local branch `github-pr/issue-171-anthropic-deps-fe927dc2` from `fe927dc2` because GitHub push prep requires a named branch before local prep work.
 - 2026-06-17: Public upstream issue `rohitg00/agentmemory#430` confirms original report was `@agentmemory/agentmemory@0.9.16` installing `@anthropic-ai/sdk@^0.39.0` and `@anthropic-ai/claude-agent-sdk@^0.3.142` with a peer conflict. Current local package metadata fixes the peer conflict with `@anthropic-ai/sdk@^0.100.1` but still auto-installs both Anthropic packages.