Repository navigation
Freeze and qualify the 0.1.7 dev release candidate #227
Description
Parent
Part of #147. This is the single Phase 0 / 0.1.7 integration and release-qualification gate.
What to build
After every stability-chain blocker is complete, freeze one dev commit as the sole 0.1.7 candidate and qualify that exact tree. Align version metadata and release notes, run the complete local release-equivalent gates, execute one final reusable 12-case real-client E2E, then use exact-SHA GitHub Actions once as the final merge safeguard rather than as a development loop.
Acceptance criteria
- One immutable candidate SHA is recorded after the dependency frontier, local checks, diff-scope audit, and bounded review have no blocker.
- Every user-visible version field and artifact identity reports 0.1.7 consistently, and release notes open with CodexHub's positioning as a model-access console that is stable, visible, and reversible.
- The locally selected Python, Rust, script, packaging, bootstrap, preflight, and report-only gates are green for the frozen tree before its final push.
- Exactly one final 12-case real-client qualification run is retained for the frozen SHA, covering Official Responses and the qualified third-party Native Responses path with Desktop/ZCode manual evidence where required.
- Evidence is durable, bounded, sanitized, and includes route/model identity, tools, streaming, cancellation, cleanup, and reusable workspace state without credentials.
- One bounded review follows Bound PR Reviewer wall-clock and reuse exact-SHA CI evidence #201, then exact-SHA Actions runs as the final remote gate; an infrastructure retry may reuse the same SHA, while a code failure must return to local reproduction before a new candidate exists.
- A testable dev build from this exact tree is made available for user acceptance before promotion to
main.
Activity
NOirBRight commentedon Jul 25, 2026
{ "contract": { "acceptance": [ "One immutable 0.1.7 candidate SHA and tree are recorded after the dependency frontier, version audit, local gates, final E2E, diff-scope audit, and strict review have no blocker.", "frontend package metadata, Rust package and lock metadata, Tauri metadata, release tests, Windows smoke artifact naming, README examples, and release notes agree on version 0.1.7; historical evidence remains historically accurate.", "Local Python, Rust, frontend, script, release-manifest, packaging bootstrap, preflight, and report-only gates are green before the candidate is pushed, with exact commands and bounded results retained.", "Exactly one final 12-case run passes on the frozen tree: Official Responses and Ollama Cloud Native Responses across Codex Desktop, Codex CLI, OpenCode, ZCode, Pi, and OMP, including required GUI evidence and reusable case-local setup.", "All twelve cases prove canonical provider/model/protocol identity, text, SSE completion, tool call/result continuity, cancellation and terminal-error accounting, zero forbidden fallback, bounded cleanup, and no credential/path leakage.", "A #201-compliant strict review reports no blocker, then exactly one exact-SHA GitHub Actions run passes. No intermediate SHA receives the full real-client matrix or remote CI as a development loop.", "A testable dev artifact is bound to the candidate SHA with integrity metadata and is delivered for user acceptance; main, tag, and public release remain unchanged until #228." ], "change_claims": { "paths": [ "frontend/package.json", "frontend/package-lock.json", "src-tauri/Cargo.toml", "src-tauri/Cargo.lock", "src-tauri/tauri.conf.json", "tests/test_release_channel_scripts.py", "scripts/Run-Issue160VirtualBoxSmoke.ps1", "README.md", "README.zh-CN.md", "docs/releases/0.1.7.md" ], "resources": [ "dev-integration-branch", "0.1.7-version-identity", "0.1.7-release-notes", "0.1.7-dev-artifact", "final-real-client-qualification", "user-acceptance-evidence" ] }, "dependencies": { "dispatch_after": [ 17, 18, 19, 20, 114, 141, 220, 223, 224, 225, 226, 236 ], "merge_after": [ 17, 18, 19, 20, 114, 141, 220, 223, 224, 225, 226, 236 ] }, "design": [ "Start only after every listed Phase 0 stability and qualification dependency is closed. Issue #104 has an evidence-backed 0.1.9 needs-info disposition and is not a 0.1.7 blocker unless a current-version CodexHub-specific reproduction reopens that decision. Reconcile origin/dev and create one clean release-candidate worktree without touching the user's dirty stable workspace.", "Apply only the 0.1.7 version alignment and release-note delta to the fully integrated dev tree. The release notes open with CodexHub as a model-access console that is stable, visible, and reversible, and distinguish qualified routes from known limits.", "Run the repository-equivalent Python, Rust, frontend, script, release-manifest, packaging bootstrap, preflight, and report-only checks locally. Any failure is reproduced and fixed locally; no candidate push or GitHub Actions run is used for development diagnosis.", "Build the testable Windows dev artifact and execute exactly one authoritative 12-case real-client qualification on the same frozen local commit. The matrix is six Official Responses plus six Ollama Cloud Native Responses cases, with the four bounded Desktop and ZCode GUI actions and reusable case-local state from #218 and #226.", "Retain sanitized evidence for source identity, artifact identity, route/model/protocol identity, text, SSE, tools, cancellation, terminal errors, cleanup, process bounds, and exactly-once request completion. Never retain credentials, raw provider payloads, or host-specific absolute paths.", "After all local gates and the final real-client run pass, obtain one bounded exact-local-SHA strict review. Freeze that commit, update dev without changing its source identity, then run one exact-SHA GitHub Actions gate. Infrastructure failure may retry the same SHA; code failure invalidates the freeze and returns to local TDD.", "Make the exact qualified dev build available for user acceptance. Do not promote to main, create the stable tag, or publish the release in this Issue; those actions belong exclusively to #228 after explicit user acceptance." ], "difficulty": "heavy", "done_when": [ "All dependency dispositions are durably reconciled and the release-candidate worktree is clean at the fully integrated dev base.", "Version and historical-reference audit passes for all declared metadata and documentation paths.", "python -m pytest -q --ignore=tests/test_real_client_e2e.py --junitxml=.pytest-results/junit-core.xml --durations=0", "python tests/fixtures/real_client_e2e/run-with-windows-watchdog.py --timeout-seconds 3600 -- python -m pytest -q tests/test_real_client_e2e.py --junitxml=.pytest-results/junit-synthetic.xml --durations=0", "python scripts/ci/check_python_test_partitions.py", "Push-Location src-tauri; cargo fmt --check; cargo clippy --all-targets --all-features -- -D warnings; cargo test --all-targets --all-features -- --test-threads=1; Pop-Location", "Push-Location frontend; npm ci; npm run build; npm run test:ui-contract; npm run test:provider-comparison; Pop-Location", "PowerShell parsing and the documented release-channel, manifest, bootstrap, preflight, and Windows packaging checks pass locally for both normal and debug artifact identities where applicable.", "python scripts/report_quality_gates.py (report-only)", "The sole final 12-case real-client run and its four bounded GUI confirmations pass on the exact local candidate SHA, with sanitized durable evidence.", "Exact-local-SHA Standards and Spec reviews report no blocker under #201 before the candidate is pushed.", "The exact frozen commit is published to dev without source-tree drift and one exact-SHA GitHub Actions run passes.", "The resulting 0.1.7 dev artifact, integrity metadata, known limits, and candidate SHA are delivered to the user for acceptance before #228." ], "priority": "P1", "risk": "strict", "sha256": "c0efc6738345dbb1fccc9dfa7a38e46fada7269c6d499d3fbfe43f97c34fba2c", "unresolved_decisions": [] }, "dispatch": null }NOirBRight commentedon Jul 26, 2026
Pre-freeze read-only version audit
This is preparatory evidence only. It does not start #227, freeze a candidate, run CI, or consume the sole final E2E.
Audited
devsource:1758b830130ac3bf4a0d55f08b69fce342f4a969(clean local/remote integration tree at audit time).Current release-identity findings:
frontend/package.jsonand the root entries infrontend/package-lock.json:0.1.6src-tauri/Cargo.tomlpackage version:0.1.6src-tauri/tauri.conf.json:0.1.6tests/test_release_channel_scripts.pycurrent-release expectation:0.1.6scripts/Run-Issue160VirtualBoxSmoke.ps1artifact names:0.1.6README.mdandREADME.zh-CN.mdrelease-command examples:0.1.5docs/releases/0.1.7.md: absent and must be created by Freeze and qualify the 0.1.7 dev release candidate #227The numerous older versions in historical fixtures, archived review references, dependency lock entries, and deliberately parameterized tests are not blanket replacement targets. #227 must update only current release identity and examples, then prove historical evidence remains accurate.
Issue #236 is now durably included in this Issue's
dispatch_afterandmerge_after; the updated validated V2 contract hash isc0efc6738345dbb1fccc9dfa7a38e46fada7269c6d499d3fbfe43f97c34fba2c.NOirBRight commentedon Jul 26, 2026
Release signing preflight
Read-only preflight on the stable release host confirms:
Before the frozen #227 build, inject the signing password through the approved local secret flow (never Issue/PR text or artifacts), then run the normal and debug signed build once. Fail before building if the password is absent; do not discover this only after the final E2E candidate has been frozen. No key material or credential value was recorded here.
NOirBRight commentedon Jul 26, 2026
0.1.7 release-note skeleton (pre-freeze; do not publish yet)
Opening positioning statement:
Candidate user-visible highlights already present on
devPending before this text can become final
Add only after merge and verification: #17 idempotency-safe main-generation retries; #236 version-independent reversible OpenCode/Pi restore; #226 Official + Ollama Cloud Native Responses 12-case matrix; #114 bounded disconnect recovery; #141 current-version Desktop restart/Task evidence; #227 one final frozen-candidate E2E and signed artifacts.
Publication guard
Generate the final
docs/releases/0.1.7.mdfrom the frozen #227 SHA, not from this pre-freeze skeleton. Every statement must map to a merged commit and durable verification evidence; remove internal implementation detail that has no user-observable effect.release: freeze and qualify CodexHub 0.1.7 (#243)
NOirBRight commentedon Jul 28, 2026
Qualified dev candidate delivered for user acceptance
5f73ab1707c7b75c9e0c0760f367aa8b21e121f2c103fd5faa20da9318c9a545c6c02ab78b359d14devcommit:ae927c687390017903435cd9bf4314610b6da229devtree:c103fd5faa20da9318c9a545c6c02ab78b359d14(exact tree match)39c1a3c77296d3ca5c6ef471d72717eb9a820a046c853cc21d834b9fb65a7d4acf3db82ab26a0d4323fcedcff69663ce191e20a8f077d0603826f550027410c718361ef9943a3339d7613af714927121a3bbcf978c11bd8a44aa37a58c4a9c18dc2121a8d47182206c0e7e4d9498567617194262d36d0c8e66277a29ea94a808The local qualified dev portable ZIP has been delivered to the repository owner in the current Codex task for explicit acceptance. Issue #227 remains open and
main, tagv0.1.7, and public release assets remain unchanged until that acceptance is recorded.Post-release runner improvements requested during qualification are tracked separately in #244 and do not modify this candidate.
NOirBRight commentedon Jul 28, 2026
Merged dev push CI also passed on
ae927c687390017903435cd9bf4314610b6da229/ treec103fd5faa20da9318c9a545c6c02ab78b359d14: https://github.com/NOirBRight/CodexHub/actions/runs/30385698316. User acceptance remains the only open #227 gate.NOirBRight commentedon Jul 29, 2026
User acceptance recorded
The repository owner explicitly accepted the qualified 0.1.7 dev artifact in the active release task and authorized formal promotion to main and public release.
Accepted identity:
5f73ab1707c7b75c9e0c0760f367aa8b21e121f2c103fd5faa20da9318c9a545c6c02ab78b359d14ae927c687390017903435cd9bf4314610b6da229c103fd5faa20da9318c9a545c6c02ab78b359d14cf3db82ab26a0d4323fcedcff69663ce191e20a8f077d0603826f550027410c7#227 is complete. Publication proceeds exclusively through #228 without any product, dependency, protocol, provider, client, or documentation delta.