Release: build and rehearse the immutable v1.5.0 candidate

[jeffhuber]

Part of #923 and #903.

Outcome

Produce the single immutable 1.5.0 candidate from the intended final public source commit, with accurate release notes and reproducible install, upgrade, disable, rollback, uninstall, package-inventory, and privacy evidence. This candidate is qualified by #918 and #920 before the unchanged source SHA is tagged and published through #923.

Dependencies

• Audit publication: verify repository-dispatch workflow identity correctly #1025 merged so exact-head audit publication is reliable.
• Slack: explicit private-workspace setup, readiness doctor and runbook #1024 merged so the minimal Slack setup/doctor/runbook surface is included.
• Public feature scope frozen to the owner-approved basic Slack boundary.

Scope

• Set source/package identity to 1.5.0; update current-facing README/install/quickstart/roadmap/release-history text while preserving historical v1.4.x evidence.
• Add v1.5 release notes and qualification record. Include PR Fix Graphify inventory limits and frontend test discovery #1007's four Graphify compatibility behaviors and instruct rebuild of affected/partial graphs.
• Reconcile all release text to: build an immutable wheel from the final release commit, run private acceptance and canaries, then tag and publish the unchanged source SHA.
• Build wheel and sdist once from a clean exact-SHA checkout; record SHA-256 and inspect inventory. Verify PR Fix Graphify inventory limits and frontend test discovery #1007 Graphify modules plus Slack: explicit private-workspace setup, readiness doctor and runbook #1024 Slack modules, hosted manifest, and documentation are present. Default dependencies remain Slack-free.
• Rehearse a fresh default install, explicit Slack opt-in, 1.4.2 to 1.5.0 upgrade, disable/uninstall, and disposable package rollback to exact 1.4.2. Preserve operational rollback rules for live durable v2 state.
• Pass release identity/readiness, package guards, privacy, lint, full tests, independent exact-head review, normal CI, and authoritative gate.

Acceptance

• One release-prep PR with one writer and immutable exact-head evidence.
• Source versions, CHANGELOG first versioned heading, README baseline, package manifest, release notes, and current installation docs agree on 1.5.0.
• Candidate artifacts are bound to the release PR merge SHA with recorded digests and inspected contents.
• Default install remains Slack-free and causes no Slack login, service, or network setup.
• Explicit Slack setup/doctor works from the candidate wheel without claiming live readiness from an offline snapshot.
• Fresh install, upgrade, rollback, disable, and uninstall rehearsals pass in disposable environments with state-preservation evidence.
• Historical v1.4.x qualification artifacts remain unchanged.
• CodeMower.com: single-workspace Slack OAuth installation and explicit policy binding #918 consumes this candidate for private administration/readiness evidence.
• Slack: Devin dispatch, clarification, completion, and cancellation bridge #920 consumes this candidate for one completion and one confirmed-cancellation canary only after explicit numeric authorization.
• Release: qualify and publish basic supervised Slack ingress in v1.5.0 #923 tags and publishes the unchanged source SHA only after those gates pass, then independently reinstalls the published package.

No paid provider work, tag, package publication, hosted deployment, or live Slack mutation belongs to the implementation PR for this issue.

[jeffhuber]

Release dependency update: #1029 is required in the v1.5.0 candidate before the #1027 package/rehearsal PR freezes. It consumes the already-merged #1007 reader changes, adds readiness/query parity and actionable compatibility diagnostics, and must preserve usable bounded-partial query semantics. No private graph data or adoption evidence enters public artifacts.

[jeffhuber]

Codex lane outcome: owner action — required release dependency is not merged

Checked the release prerequisites and current release tooling. The owner’s dependency update requires #1029 in the candidate before this package/rehearsal PR freezes. #1029 is still open and its implementation, PR #1031, remains open at 0d1973547329a59bd68706e1822100bb3fdfacc6. It is behind main; the owner’s requested disconnected-status fix, regression, merge from current main, and fresh exact-head audit are still pending on the observed head.

#1025 and #1024 are merged, and merged #1007 is present in this checkout. The checked source HEAD is 4c2cd6219656e5f80dcce7bfe5a6cb3f8c0b3d68. It does not yet contain the required #1029 work, so it cannot be the final v1.5.0 candidate source.

Required actions:

1. Have the owning Claude lane finish the owner-requested changes on Graphify: validate query-reader compatibility before reporting search available #1031, update that same branch from current main, and obtain fresh exact-head independent review, green CI, and the authoritative gate.
2. Merge Graphify: validate query-reader compatibility before reporting search available #1031 through the normal authorized merge process so Graphify: validate query-reader compatibility before reporting search available #1029 is included in the release source. This Codex builder did not write to or merge the other lane’s branch.
3. Remove needs-owner from Release: build and rehearse the immutable v1.5.0 candidate #1027 and redispatch this issue after the dependency is merged. Prepare the single release PR, then bind the candidate artifacts to that PR’s actual merge SHA. Private acceptance (CodeMower.com: single-workspace Slack OAuth installation and explicit policy binding #918), explicitly capped canaries (Slack: Devin dispatch, clarification, completion, and cancellation bridge #920), and owner-controlled publication (Release: qualify and publish basic supervised Slack ingress in v1.5.0 #923) retain their stated order.

Release-prep PR: none opened. Candidate wheel/sdist and digests: not created. Tests/rehearsals: not run; no product or documentation changes were made. Checks performed: GitHub prerequisite/PR/owner-comment inspection, source ancestry, clean working-tree check, and release runbook/workflow inspection. Historical v1.4.x evidence is unchanged. No paid provider work, tag, publication, hosted deployment, or live Slack mutation occurred.

Recorded .code-mower/lane-outcome.json with outcome: owner_action. All #1027 implementation and qualification acceptance remains outstanding; this is a prerequisite stop, not a release or test pass.

[jeffhuber]

Mac lane runner (codex): bounded delivery outcome owner_action on this issue.

Required dependency #1029 remains open in Claude-owned PR #1031 with owner-requested changes and fresh audit pending; merge it before redispatching #1027 to prepare and freeze the immutable v1.5.0 candidate.

[jeffhuber]

Dependency #1029 is complete: PR #1031 merged as ea2b775a7d0760985b902bdcd9c4b999015d9069 after final head e6b623a57e6f93e1470269280932163ff41d514f passed full CI, 453 focused Graphify tests (1 skipped), and an independent exact-head Codex audit with zero findings. The release candidate must include both merged #1007 and #1031 and execute the candidate checks already listed in this issue. Removing the temporary owner-action stop and redispatching the Code Mower builder.

[jeffhuber]

Immutable v1.5.0 candidate retained

Release-preparation PR #1033 merged as d66e01db952e2528f0b5693508808cd068fbf718. The exact-SHA, first-attempt-only candidate workflow completed successfully on its initial run: https://github.com/codemower-ai/code-mower/actions/runs/35317161869

Downloaded candidate evidence was independently rehashed after the run:

• wheel code_mower-1.5.0-py3-none-any.whl: 08c8b44cdb4795e1bae939d190b2058b0c73084a856169734111898b9c868001
• sdist code_mower-1.5.0.tar.gz: 91ab9b1407f6c482122338323f94ea7c66335e3dedded10b583bd44d33685313
• candidate manifest: d83605848f2bfb13ed94bc19c87805b5261bbbb8b46664f95c3fce0d9ec2a389
• rehearsal evidence: ae955e84821a6a60aaab98b26d7555504f3d19cb161732bf7c74a5d5e5fe33cd

candidate.json records kind=candidate, version 1.5.0, release PR 1033, and the exact merge SHA. The manifest digests match the downloaded wheel and sdist. rehearsal.json binds the same SHA and wheel digest, reports status=pass, and records all ten required offline checks as passed, including Slack-free defaults, explicit private Slack setup, all three Graphify compatibility cases, upgrade from 1.4.2, digest-verified rollback to 1.4.2, uninstall, and synthetic-state preservation.

Live private Slack readiness, live disable/uninstall, and paid canaries remain intentionally not_run. The retained pair must not be rebuilt. Next gate is #918 private workspace acceptance, followed by explicitly capped #920 canaries and publication of these exact bytes.

[jeffhuber]

Candidate invalidated before live Slack mutation

Live #918 preflight found a contract mismatch in the retained candidate: its generated Slack manifest sends OAuth directly to the application callback, while the reviewed privacy boundary requires the dedicated query-scrubbing relay as Slack's sole redirect. The current candidate therefore cannot pass both manifest matching and the OAuth telemetry privacy gate.

Candidate run 35317161869 and its wheel/sdist remain immutable evidence, but they are invalid for publication and must not be tagged, uploaded, or used for #918/#920. No Slack app was created and no paid provider work was spent before this stop.

Corrective PR: #1035

The PR pins the relay redirect and separately pins the application command/interactivity routes in unit and installed-wheel rehearsal checks. After exact-head independent review, green CI, and the authoritative gate, merge it and build one new immutable candidate from that merge SHA. Resume #918 and the authorized two-canary campaign only against those replacement bytes.

[jeffhuber]

Replacement immutable v1.5.0 candidate verified after the Slack OAuth relay correction.

• Source merge: 027a249115d77ba7ce576a854cc1e817b119d0f6 (PR Slack: route OAuth through the privacy relay #1035)
• Candidate run: 35330007032, first attempt, success
• Wheel SHA-256: b76519639391cd2a8cac9828d08401f92c785b75334bd665f8ef73d1dcf871db
• Sdist SHA-256: 0ed172c1950133bbca19c9a990dc3dc96933ca05de576d08f09818e3294d01fa
• Manifest kind/version: candidate / 1.5.0, release PR 1035
• Rehearsal: PASS for fresh install, explicit private Slack setup, offline disabled state, the three required Graphify checks, 1.4.2 upgrade, disposable rollback, and uninstall; synthetic state preserved.

The earlier candidate from d66e01db remains invalid and must not be published or installed. Private acceptance, live Slack lifecycle, paid canaries, and publication remain pending against this replacement candidate.

[jeffhuber]

Candidate run 35330007032 is now invalidated and must not be published or installed for live acceptance.

The replacement candidate correctly fixed the Slack OAuth redirect, but release convergence exposed a separate release-critical defect: the trusted local-audit publication workflow cannot write its reservation/verdict comment on pull requests with its current read-only Pull requests permission. PR #1036 carries the narrow permission correction and a generated-workflow regression.

After #1036 passes an independent exact-head audit, CI and the authoritative gate, one new immutable candidate must be built from its merge SHA. No paid canary has run and no provider spend has occurred.

[jeffhuber]

Replacement v1.5.0 immutable candidate verified

The prior candidate invalidations are superseded by a new immutable candidate built from merged PR #1036.

• Source commit: 59fe054498ec2db5a43b782b75f5070f44a51320
• Candidate run: https://github.com/codemower-ai/code-mower/actions/runs/35331968778
• Wheel SHA-256: b8c1c0cec1fe33996df985beae53235f652ad069cc123f289d42ca148eb5888e
• sdist SHA-256: 953ae03884d421e5dca3e315fcca4d69444b69a86162ebee61401be6554e2d65
• Rehearsal: PASS; 10/10 fresh install, setup, Graphify, upgrade, rollback, and uninstall checks passed with synthetic state preserved.
• Independent local verification: artifact manifest and digests match; hash-locked Python 3.12 installation from the canonically named retained wheel passed; the exact installed package passed the hosted-worker no-provider qualification with zero provider and GitHub calls.

This is the candidate to use for the remaining private-host qualification, Slack lifecycle, paid completion/cancellation canaries, and release audit. The earlier candidates remain invalidated.