feat: pin @attomus/semafore-crypto@^1.0.0 and wire final notify/execute paths

README.md

@@ -18,13 +18,15 @@ Implemented today:
 - secret-origin checks for sensitive inputs
 - GitHub Actions log masking for tokens and device keys
 - SemaFore execute-mode HTTP client
+- notify-mode recipient resolution, per-device encryption, and ADR-0166 send
 - bootstrap secret-writing helper
+- runtime dependency on `@attomus/semafore-crypto`
 - bundled `dist/` output
 - lint, type-check, test, build, and audit workflow
 
 Still in active development:
 
-- full notify-mode recipient lookup and per-device encryption
+- live service-token recipient/key-bundle resolution endpoint for notify mode
 - bootstrap integration with the `@attomus/semafore-crypto` package
 - end-to-end staging runs against the SemaFore integration endpoints
 - Marketplace release packaging and `v1` tag movement

action.yml

@@ -35,6 +35,13 @@ inputs:
   github_token:
     required: false
     description: 'GitHub token with actions: write permission for bootstrap mode.'
+outputs:
+  message_id:
+    description: 'SemaFore message identifier returned by notify mode.'
+  result:
+    description: 'JSON result returned by execute mode.'
+  device_id:
+    description: 'Registered SemaFore device identifier returned by bootstrap mode.'
 runs:
   using: 'node20'
   main: 'dist/index.js'