Repository navigation
chore(release): prepare 0.3.5 stable staging - #144
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6fdf9d65fb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| **Documentation and source version: 0.3.4.** Review the selected release and registry metadata before installation. Dated preparation and validation records are in [VALIDATION.md](VALIDATION.md); release procedures are in [RELEASING.md](RELEASING.md). SSH endpoints require the same TypeScript client version; 0.3.3 and 0.3.4 refuse each other’s SSH preflight. | ||
| **Documentation and source version: 0.3.5.** Review the selected release and registry metadata before installation. Dated preparation and validation records are in [VALIDATION.md](VALIDATION.md); release procedures are in [RELEASING.md](RELEASING.md). SSH endpoints require the same TypeScript client version; 0.3.4 and 0.3.5 refuse each other’s SSH preflight. | ||
|
|
||
| Version 0.3.5 is an unmerged preparation candidate, not a publication record. |
There was a problem hiding this comment.
Once this change is merged, the stable publication workflow runs only from main and packages README.md, so every staged or published 0.3.5 tarball will incorrectly state that its own release preparation is “unmerged.” The same claim is copied into the localized READMEs and guides, meaning the documented artifact-state check cannot pass without another source change and a newly reviewed artifact. Describe 0.3.5 as unpublished instead, or confine the pre-merge status to a dated preparation record.
Useful? React with 👍 / 👎.
Summary
Refs #143 and #139. Release preparation ready for human review. No merge, dispatch, staging, tag, release or publication.
Latest head:
6fdf9d65fb0b62cca3801a3733af07add5fb6553. This main-based candidate includes unmerged dependency PR #140 atb917769047db41dedcb4aa1367a1b89915beb000. Human review/merge of that dependency comes first, then rebase/current-head checks for this preparation.Changes
0.2.1 / typescript / min 0.1.0 / full 0.3.2 / probe-helpproposal in compiled 0.3.5; retain exact legacy 0.1.0/0.2.0 rows and explicit historical runtime verdicts. Future versions remain incompatible. Parser/reader behavior unchanged.sha512-O9Uwpa0x1NZ8MNZCk0a1Z4hj7S+v0F0QeOJa+rKfbwcAYzBCSMwqmEWQWZQMWM36SbxVu3RowTSvpwPiKd/BDA==; preview remains 0.1.0-preview.1. Registry read confirmed target 0.3.5 absent at preparation. This is not an authenticated publisher/stage/MFA audit.8482cf644507c682915e35c85aa3384c53864906, SHA00c6fc343fdbeb8f6dc1b1ee1b730f04cef71bbfb08205a7be3559202f1d8804, Python reference 1.0.2 and historical evidence stay unchanged. Dependencies/engines/exports/allowlist/workflows unchanged. Drafts 106–109/82/142 excluded.Exact companion review
Companion Draft #35, exact source
9db5420b45568dd08fc43d406dbf9ad1952f7891, supplies complete SKILL candidate 13,930 raw UTF-8 bytes, SHA96d5a0d049f8a4d193703af3583b198a91079d44ae373de34e94a54e2296a4d6. Setup SHAb9f34cf06840c63c1d26dd835c512ce4b6e457063d1808eb73bc7e9f5ebc70e7; compatibility SHA495420a268841c8da6f9bc68039e65dc52cb95aba52e33ab906710826eeb2b43. API bytes/hashes and unchanged functional/safety body after the introduction were independently compared, with another read-only Codex subagent review: no blocker.Companion accepted the release-default source/fixture amendment at TS
08c507cfor design only. TS accepts these exact full candidate bytes/profile for guard-preparation design/content only, not a final joint publication freeze, adoption, install pin or release permission. Final skill wording after actual runtime publication changes the bytes and requires new exact review and separate approval. The review reply underSTS-035-SKILL-PROFILE-REVIEW-20261013-Awas queued once; consumption is not inferred.Full bytes are mirrored only in
test/fixtures/ts-skill-0.2.1-candidate.md, excluded from npm. Tests verify length/hash/fatal UTF-8, default/undefined/explicit 0.3.5 and outer inspectSkill acceptance, old 0.3.2/0.3.3/0.3.4 and future 0.3.6/0.4.0 rejection. Skill instructions are never executed. Metadata compatibility is not content authenticity, send permission, consumption or ACK.Validation
Local macOS arm64, Node 24.16.0/npm 11.15.0:
a774209checkpoint: ci/build/types/full test 191 total / 186 PASS / 0 FAIL / 5 Windows-only SKIP, verified Python47c23713d0a2a3c11ebde6186afd8c43489b8b65oracle and byte-identical vendored fixture.session-peer 0.3.5 (typescript), launcher removed on uninstall. All 18 packaged Markdown files match source; test fixtures/experiments excluded.Latest head checks: 12/12 SUCCESS, no reruns. CLI 38368924868 includes macOS/Ubuntu Node 22/24, Windows native 22/24, policy and release gate. CodeQL 38368918377, aggregate CodeQL and GitGuardian pass. No automatic Code/Security review comments, formal reviews or inline findings submitted for #140/#144 at this checkpoint; no manual mentions. CI fixtures are not live native observer/steering qualification.
Current local artifact, separate from later merged-main/Actions artifacts:
6fdf9d65fb0b62cca3801a3733af07add5fb655386a962405a7eb3e823df68715380367dd50517fc274612710d72965af4789387sha512-T4L9ZIx5+F9QC4cPYxMh7qSIiKAeIUF6fa+26XkiCpTWvsDRQqUgcqAMkSQQwstUvWuIWaNknp1Rk0ahRaLf9Q==session-peer-0.3.5.tgzEarlier artifacts at a774209 (SHA 4d196d73…) and 08c507c (SHA 84cf6d5d…) are superseded, retained locally; their CI/local records remain checkpoint-specific.
Remaining human/publication gates
No global/fleet install, installed skill/runtime update, native/model/ACK experiment, operations/configuration change, protection bypass or publication. #139 remains open until the full rollout succeeds.
Ready-for-review transition — 2026-10-13 KST
Converted from Draft after exact complete candidate review, scoped24/24 checks and current-head12/12CI. Source/artifact unchanged. Human review/merge and publication gates still apply; no automatic merge or manual review mention.