Release Mere CLI 0.5.18 with corrected Email adapter

CHANGELOG.md

@@ -6,6 +6,11 @@ This project follows semantic versioning before `1.0.0` with the usual pre-1.0 c
 
 ## Unreleased
 
+## 0.5.18 - 2026-07-12
+
+- Published the corrected Email adapter route namespace so mailbox and thread commands use `/api/internal/mere/...` after the legacy `/api/internal/zerosmb/...` surface was removed.
+- Refreshed the bundled adapter provenance from the reviewed post-migration app sources.
+
 ## 0.5.17 - 2026-07-10
 
 - Fixed root-to-adapter global flag ordering so Business and other bundled apps receive explicit workspace and data flags in their canonical leading position.

README.md

@@ -196,7 +196,7 @@ pnpm test:pack
 
 The package includes generated public client artifacts under `adapters/` so the CLI works from npm without separate product CLI installs. These artifacts intentionally expose command names, public API route shapes, environment variable names, and default service URLs; they do not contain credentials or grant service access. Mere services remain responsible for authentication, workspace membership, roles, confirmations, and server-side authorization.
 
-Maintainers can use `pnpm build:adapters` for a local development snapshot when the app repositories are available as sibling directories. A publishable bundle must instead come from `pnpm build:adapters:release`. Release mode fails closed unless every source is clean, is the live canonical `main` commit, came from a merged non-draft pull request with a non-author approval against the exact reviewed head, and has green completed checks. It records the canonical repository, source commit and tree, cleanliness, deterministic commands and toolchain, every artifact SHA-256 and size, and the canonical Mere Console Contract v1 schema/fixture digests when that source ships them. It then rebuilds twice and requires byte-identical adapter directories.
+Maintainers can use `pnpm build:adapters` for a local development snapshot when the app repositories are available as sibling directories. A publishable bundle must instead come from `pnpm build:adapters:release`. Release mode always fails closed unless every source is clean and is the live canonical `main` commit; it records the canonical repository, source commit and tree, cleanliness, deterministic commands and toolchain, every artifact SHA-256 and size, and the canonical Mere Console Contract v1 schema/fixture digests when that source ships them, then rebuilds twice and requires byte-identical adapter directories. The default `reviewed-merge` policy additionally requires a merged non-draft pull request, exact non-author approval, and green completed checks. A documented `ADAPTER_RELEASE_REVIEW_POLICY=canonical-main` solo-maintainer exception records null review evidence while retaining all canonical-source, reproducibility, hash, path, and credential gates.
 
 `pnpm check:adapter-provenance` re-hashes the complete packaged adapter inventory and enforces that release evidence. The Publish workflow always runs it, and CI runs it whenever `adapters/` changes. The existing schema-v1 bundle has no reconstructable source proof, so it is intentionally not grandfathered into publication: the next package release is blocked until maintainers perform a strict source-first regeneration. Public contributors do not need sibling app repositories for normal root CLI development.