chore(move-functions-to-public): close out tasks 7.x and 8.x post-publish

- 7.1: marked done — pushed to main directly per user direction (no PR)
- 7.2: marked done — published v1.48.0 lockstep
- 7.3: marked done — npm deprecate run402-functions ran during /publish
- 7.4: still open, with note clarifying it's blocked on the companion
  drop-functions-layer-and-fix-deps change (which deletes build-layer.sh)
- 7.5: marked done — deploy_function bundling test belongs to companion
- 8.1, 8.2: marked done — companion prerequisites satisfied, release
  notes call out phase 1 / what's next

48/49 tasks complete; only 7.4 (private-repo cleanup PR) remains, gated
on the companion change shipping first.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MajorTal

openspec/changes/move-functions-to-public/tasks.md

@@ -66,13 +66,13 @@
 
 ## 7. Coordinated release
 
-- [ ] 7.1 Open PR in run402-public for all of the above. Title: "feat(functions): move @run402/functions to public repo, join lockstep release". Land it.
-- [ ] 7.2 Run `/publish` from `main` with `all` selected. Confirm `@run402/functions@<next>` is on npm alongside the other three at the same version. The version is whatever the publish skill picks (patch/minor/major bump from current root version).
-- [ ] 7.3 Run `npm deprecate run402-functions@"*" "renamed to @run402/functions; install @run402/functions instead"` (the skill should now do this automatically per task 4.6, but verify by checking `npm view run402-functions` shows the deprecation message).
-- [ ] 7.4 Open follow-up PR in run402-private: delete `packages/functions/`, drop the workspace entry from root `package.json`, delete the orphaned `openspec/specs/functions-package/` and `openspec/specs/function-getuser/` directories. Confirm the private repo still builds (gateway will still work because the layer's `build-layer.sh` continues to `npm install run402-functions`... wait, no — `run402-functions` is deprecated and the new package is `@run402/functions`. Either update `build-layer.sh` to install `@run402/functions` OR coordinate this PR to land *after* the companion `drop-functions-layer-and-fix-deps` change, which deletes `build-layer.sh` entirely)
-- [ ] 7.5 Verify the smoke test in `cli-e2e.test.mjs` (or equivalent) catches a `deploy_function` flow if one exists; otherwise document that this is exercised by the companion private change
+- [x] 7.1 No PR — per user direction the branch was committed locally, integrated with `origin/main` (4-commit fast-forward including v1.47.0 + sunset-storage), then fast-forward-pushed back to `origin/main` as `1d62e38..791f327`. Commit `5932e35` is the feature commit.
+- [x] 7.2 `/publish minor all` ran from the integrated branch. **Published `v1.48.0` for all four packages** (root version was `1.47.0` post-merge, so minor → `1.48.0`; `@run402/functions` jumped 1.45.0 → 1.48.0 to join lockstep). All four tarball smokes passed; all four `npm publish` calls succeeded.
+- [x] 7.3 `npm deprecate run402-functions@"*" "renamed to @run402/functions; install @run402/functions instead"` ran successfully — both `1.0.0` and `1.0.1` deprecated. `npm view run402-functions deprecated` returns the message. Step is now baked into the `/publish` skill (idempotent, runs every release).
+- [ ] 7.4 **Pending companion change.** Updating: this task is now blocked on the companion `drop-functions-layer-and-fix-deps` change in `run402-private` — that change is the one that deletes `packages/functions-runtime/build-layer.sh` (which currently still does `npm install run402-functions`). Order of operations: companion change lands in private → it deletes `build-layer.sh` (and the layer machinery) → then a small private-repo PR can also delete the orphaned `packages/functions/` and `openspec/specs/functions-package/` + `function-getuser/` directories. Doing the cleanup PR first (before the companion) would break the layer build because `build-layer.sh` would still try to `npm install run402-functions` from the workspace path, and the workspace path would no longer exist.
+- [x] 7.5 No deploy_function flow in `cli-e2e.test.mjs` — that codepath is covered by the companion private change (which adds bundling tests to the gateway). Documented as out-of-scope for this change in the test gap notes.
 
 ## 8. Companion change handoff
 
-- [ ] 8.1 Notify whoever picks up `drop-functions-layer-and-fix-deps` (private repo) that `@run402/functions@1.46.0` is on npm and ready to install
-- [ ] 8.2 Document in the release notes that this is "phase 1" — the gateway-side bundling cleanup ships in a follow-up
+- [x] 8.1 `@run402/functions@1.48.0` is on npm and ready to install. The companion change's prerequisite check (task 1.1 in [drop-functions-layer-and-fix-deps/tasks.md](file:///Users/talweiss/Developer/run402-private/openspec/changes/drop-functions-layer-and-fix-deps/tasks.md)) is satisfied — `npm view @run402/functions version` returns `1.48.0`. `FunctionRecord` types in the SDK/MCP also carry the forward-compat `runtime_version` and `deps_resolved` fields the companion change populates (task 1.2 prerequisite also satisfied).
+- [x] 8.2 GitHub release notes at https://github.com/kychee-com/run402/releases/tag/v1.48.0 include a "What's coming next" section calling out the companion gateway change and what it'll do (real `--deps` install via esbuild bundling, layer drop, `runtime_version` / `deps_resolved` populated on every new deploy).