chore: prepare 0.0.40 release

CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.40] - 2026-07-06
+
+### Added
+- Added non-extension session parity so managed and CDP-connected sessions can share the same runtime capability surface without requiring the Chrome extension path.
+
+### Changed
+- Aligned release-facing package, lockfile, extension manifest, extension package metadata, and evidence docs for `0.0.40`.
+- Tightened workflow readiness and shopping-report gates so authority sidecars, compact output tokens, and product-readiness evidence stay aligned with runtime behavior.
+
+### Fixed
+- Hardened Codex bundled skill sync so OpenDevBrowser skills coalesce through the shared Agents root and avoid duplicate `opendevbrowser-*` discovery entries.
+- Closed workflow-readiness review blockers around output authority, evidence gates, and stale runtime assertions.
+
 ## [0.0.39] - 2026-07-02
 
 ### Changed
@@ -307,7 +320,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Core browser management
 - Basic snapshot pipeline
 
-[Unreleased]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.39...HEAD
+[Unreleased]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.40...HEAD
+[0.0.40]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.39...v0.0.40
 [0.0.39]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.38...v0.0.39
 [0.0.38]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.37...v0.0.38
 [0.0.37]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.36...v0.0.37

README.md

@@ -94,7 +94,7 @@ export CLAUDECODE_HOME="$ISOLATED_ROOT/claudecode-home"
 export AMP_CLI_HOME="$ISOLATED_ROOT/ampcli-home"
 cd "$WORKDIR"
 npm init -y
-npm install <public-repo-root>/opendevbrowser-0.0.39.tgz
+npm install <public-repo-root>/opendevbrowser-0.0.40.tgz
 npx --no-install opendevbrowser --help
 npx --no-install opendevbrowser help
 ```

docs/AGENTS.md

@@ -96,7 +96,7 @@ When release-gate automation changes:
 - `docs/RELEASE_RUNBOOK.md`
 - `docs/EXTENSION_RELEASE_RUNBOOK.md`
 - `docs/DISTRIBUTION_PLAN.md`
-- the current version-scoped release evidence doc (for this release: `docs/RELEASE_0.0.39_EVIDENCE.md`)
+- the current version-scoped release evidence doc (for this release: `docs/RELEASE_0.0.40_EVIDENCE.md`)
 - older ledgers stay historical-only and should receive explicit status clarifications only
 - automation scripts:
   - `scripts/audit-zombie-files.mjs`

docs/ARCHITECTURE.md

@@ -485,7 +485,7 @@ When hub mode is enabled, the hub daemon is the **sole relay owner** and enforce
 - **Parity gate** via `tests/parity-matrix.test.ts` (contract coverage for CLI/tool/runtime surface checks + mode coverage).
 - **Provider performance gate** via `tests/providers-performance-gate.test.ts` (deterministic fixture SLO checks).
 - **Strict live release gates** via `node scripts/provider-direct-runs.mjs --release-gate` and `node scripts/live-regression-direct.mjs --release-gate` (active live release proof layer).
-- **Release checklist** in `docs/RELEASE_RUNBOOK.md` with evidence tracking in the current version-scoped release ledger (for this cycle: `docs/RELEASE_0.0.39_EVIDENCE.md`).
+- **Release checklist** in `docs/RELEASE_RUNBOOK.md` with evidence tracking in the current version-scoped release ledger (for this cycle: `docs/RELEASE_0.0.40_EVIDENCE.md`).
 - **Benchmark fixture manifest** in `docs/benchmarks/provider-fixtures.md`.
 - **First-run onboarding checklist** in `docs/FIRST_RUN_ONBOARDING.md`.
 

docs/CLI.md

@@ -62,7 +62,7 @@ export CLAUDECODE_HOME="$ISOLATED_ROOT/claudecode-home"
 export AMP_CLI_HOME="$ISOLATED_ROOT/ampcli-home"
 cd "$WORKDIR"
 npm init -y
-npm install <public-repo-root>/opendevbrowser-0.0.39.tgz
+npm install <public-repo-root>/opendevbrowser-0.0.40.tgz
 npx --no-install opendevbrowser --help
 npx --no-install opendevbrowser help
 ```
@@ -1919,7 +1919,7 @@ npm run test -- tests/providers-performance-gate.test.ts
 
 These commands are release guards, not the live release-proof lane. Use the direct-run harness commands above for release evidence.
 
-Release gate source of truth: `docs/RELEASE_RUNBOOK.md` and `docs/RELEASE_0.0.39_EVIDENCE.md`.
+Release gate source of truth: `docs/RELEASE_RUNBOOK.md` and `docs/RELEASE_0.0.40_EVIDENCE.md`.
 Benchmark fixture manifest: `docs/benchmarks/provider-fixtures.md`.
 
 ---

docs/DEPENDENCIES.md

@@ -1,17 +1,17 @@
 # OpenDevBrowser Dependency Inventory
 
 Status: active  
-Last updated: 2026-07-02
+Last updated: 2026-07-06
 
 This document tracks runtime and build dependencies across the repository.
 
-## Source metadata audit (2026-07-02)
+## Source metadata audit (2026-07-06)
 
 Verified source files:
-- `package.json` version: `0.0.39`
-- `package-lock.json` top-level version and `packages[""]` version: `0.0.39`
-- `extension/manifest.json` version: `0.0.39`
-- `extension/package.json` version: `0.0.39`
+- `package.json` version: `0.0.40`
+- `package-lock.json` top-level version and `packages[""]` version: `0.0.40`
+- `extension/manifest.json` version: `0.0.40`
+- `extension/package.json` version: `0.0.40`
 - `eslint.config.js`: flat config for `src/**/*.ts` and `tests/**/*.ts`, using `@typescript-eslint/parser`, `ecmaVersion: "latest"`, module source type, and no custom rules
 - public repo config files found for this audit: `eslint.config.js`, `tsconfig.json`, `vitest.config.ts`, and `extension/tsconfig.json`
 - no public Vite config and no public `frontend/` application directory are present in this repo

docs/DISTRIBUTION_PLAN.md

@@ -1,6 +1,6 @@
 # OpenDevBrowser Distribution Plan
 
-Last updated: 2026-07-02
+Last updated: 2026-07-06
 
 This document is the active distribution plan for the split model:
 - public repo for runtime + release artifacts
@@ -17,10 +17,10 @@ Public repo no longer carries the `frontend/` application directory.
 
 ### Current public package baseline
 
-As of the 2026-07-02 package metadata audit:
-- root package version: `0.0.39`
-- root lockfile version and root package entry: `0.0.39`
-- extension manifest and extension package version: `0.0.39`
+As of the 2026-07-06 package metadata audit:
+- root package version: `0.0.40`
+- root lockfile version and root package entry: `0.0.40`
+- extension manifest and extension package version: `0.0.40`
 - package binary: `opendevbrowser` -> `dist/cli/index.js`
 - package file allowlist includes `dist`, bundled `skills`, native scripts, and built extension assets listed in `package.json`
 
@@ -174,7 +174,7 @@ npm run build --prefix frontend
 - [x] Public repo frontend source was extracted after private validation baseline.
 - [ ] Hosting production branch is enforced to `website-production`.
 - [x] Public first tagged release completed through new workflow path.
-- [x] Current public package metadata is aligned at `0.0.39` across root package, root lockfile, extension manifest, and extension package.
+- [x] Current public package metadata is aligned at `0.0.40` across root package, root lockfile, extension manifest, and extension package.
 
 ## Operational references
 

docs/EXTENSION_RELEASE_RUNBOOK.md

@@ -1,12 +1,12 @@
 # Extension Release Runbook
 
-Last updated: 2026-07-02
+Last updated: 2026-07-06
 
 Operational runbook for publishing extension artifacts from the public repo.
 
 ## Current source-backed extension reference
 
-As of the 2026-07-02 release prep, `package.json`, `package-lock.json`, `package-lock.json#packages[""]`, `extension/manifest.json`, and `extension/package.json` are all aligned at `0.0.39`. `extension/manifest.json` is MV3, names the extension `OpenDevBrowser Relay`, and packages the background service worker at `dist/background.js`.
+As of the 2026-07-06 release prep, `package.json`, `package-lock.json`, `package-lock.json#packages[""]`, `extension/manifest.json`, and `extension/package.json` are all aligned at `0.0.40`. `extension/manifest.json` is MV3, names the extension `OpenDevBrowser Relay`, and packages the background service worker at `dist/background.js`.
 
 Use `npm run extension:sync` before release prep to write extension version metadata from the root package version. Use `npm run version:check` after sync to verify the root package, lockfile, manifest, and extension package agree.
 
@@ -55,7 +55,7 @@ Configure in public GitHub repo secrets:
 1. Run tag-driven public release flow (`docs/RELEASE_RUNBOOK.md`).
 2. Confirm the release workflow completed the registry-consumer smoke lane for the published npm package before treating the extension artifact as fully released.
 3. Confirm GitHub release includes extension zip + checksum.
-4. Confirm the active release evidence ledger, currently `docs/RELEASE_0.0.39_EVIDENCE.md` for package version `0.0.39`, records whether external release workflow evidence is complete or deferred.
+4. Confirm the active release evidence ledger, currently `docs/RELEASE_0.0.40_EVIDENCE.md` for package version `0.0.40`, records whether external release workflow evidence is complete or deferred.
 5. Verify checksum locally if required:
 
 ```bash

docs/FIRST_RUN_ONBOARDING.md

@@ -27,7 +27,7 @@ This guide is the shipping checklist for validating OpenDevBrowser as a new user
 ```bash
 cd <public-repo-root>
 npm pack
-# -> opendevbrowser-0.0.39.tgz
+# -> opendevbrowser-0.0.40.tgz
 ```
 
 ## 2) Simulate a brand-new isolated user workspace
@@ -44,7 +44,7 @@ export AMP_CLI_HOME="$WORKROOT/amp-home"
 mkdir -p "$WORKDIR" "$HOME" "$OPENCODE_CONFIG_DIR" "$OPENCODE_CACHE_DIR" "$CODEX_HOME" "$CLAUDECODE_HOME" "$AMP_CLI_HOME"
 cd "$WORKDIR"
 npm init -y
-npm install <public-repo-root>/opendevbrowser-0.0.39.tgz
+npm install <public-repo-root>/opendevbrowser-0.0.40.tgz
 npx --no-install opendevbrowser version --output-format json
 ```
 

docs/README.md

@@ -34,7 +34,8 @@ Generated help is the canonical first-contact discovery surface and must keep th
 
 ## Version-scoped evidence
 
-- `<public-repo-root>/docs/RELEASE_0.0.39_EVIDENCE.md` - current release evidence ledger for the active ship cycle confirmed by `package.json` version `0.0.39`
+- `<public-repo-root>/docs/RELEASE_0.0.40_EVIDENCE.md` - current release evidence ledger for the active ship cycle confirmed by `package.json` version `0.0.40`
+- `<public-repo-root>/docs/RELEASE_0.0.39_EVIDENCE.md` - historical v0.0.39 release evidence ledger
 - `<public-repo-root>/docs/RELEASE_0.0.38_EVIDENCE.md` - historical v0.0.38 release evidence ledger
 - `<public-repo-root>/docs/RELEASE_0.0.37_EVIDENCE.md` - historical v0.0.37 release evidence ledger
 - `<public-repo-root>/docs/RELEASE_0.0.36_EVIDENCE.md` - historical v0.0.36 release evidence ledger

docs/RELEASE_0.0.40_EVIDENCE.md

@@ -0,0 +1,160 @@
+# v0.0.40 Release Evidence
+
+Status: release prep complete; external publish pending
+Release date: 2026-07-06 UTC, pending final publish
+Tag: `v0.0.40`
+Release URL: pending
+
+## Scope
+
+Tracks the `0.0.40` release cycle from local release preparation through npm publish, registry smoke, GitHub release, and Chrome Web Store manual release evidence or exact browser-visible blocker.
+
+## Final Release State
+
+- npm package: pending
+- npm `latest`: pending
+- npm tarball shasum: pending
+- npm tarball integrity: pending
+- Release tag: pending
+- Tag target: pending
+- GitHub release: pending
+- Successful release workflow run: pending
+- Chrome Web Store: pending manual browser release or exact auth/session blocker.
+
+## Release History
+
+- Release prep branch: `codex/release-0.0.40`.
+- Release prep base: `fe15388eae1ad260341877b2feb9d58da019f2d6`.
+- npm publish: pending local-auth publish for `opendevbrowser@0.0.40`.
+- GitHub release workflow: pending dispatch with `publish_npm=false`, `publish_github_release=true`, `draft_release=false`, and `run_release_live_gates=false`.
+- Chrome Web Store manual release: pending browser dashboard flow.
+
+## Version Alignment
+
+- `package.json`: `0.0.40`
+- `package-lock.json`: `0.0.40`
+- `extension/package.json`: `0.0.40`
+- `extension/manifest.json`: `0.0.40`
+
+## Dependency And Audit Evidence
+
+- `package.json` dependency ranges were not changed for this release prep.
+- `npm ci`: passed from the current lockfile.
+- `npm audit --omit=dev`: passed with `found 0 vulnerabilities`.
+- `npm audit --audit-level=moderate`: passed. Residual advisory is one low-severity dev-only `esbuild` advisory from the current toolchain range, below the release audit gate.
+
+## Local Release Prep Gates
+
+- [x] `npm version 0.0.40 --no-git-tag-version`
+- [x] `npm run extension:sync`
+- [x] `npm run version:check`
+- [x] `node scripts/docs-drift-check.mjs`
+- [x] `git diff --check`
+- [x] `npm ci`
+- [x] `node scripts/chrome-store-compliance-check.mjs`
+- [x] `npm run test:release-gate`
+- [x] `npm run lint`
+- [x] `npm run typecheck`
+- [x] `npm run build`
+- [x] `npm run extension:build`
+- [x] `npm run test`
+- [x] `node scripts/audit-zombie-files.mjs`
+- [x] `./skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh`
+- [x] `./skills/opendevbrowser-motion-design/scripts/validate-skill-assets.sh`
+- [x] `npx opendevbrowser --help`
+- [x] `npx opendevbrowser help`
+- [x] `npm run extension:pack`
+- [x] `npm pack --dry-run`
+
+## Full Gate Matrix Rerun
+
+Evidence directory: `artifacts/release/v0.0.40/`
+
+- Formatter: not available. `package.json` has no formatter script.
+- `git status --short --branch`: release-prep branch dirty only with intended tracked release files plus preserved unrelated untracked investigation/review docs.
+- `git diff --check`: passed in the local gate set and rerun after review-driven doc edits.
+- `npm ci`: passed.
+- `npm audit --omit=dev`: passed with `found 0 vulnerabilities`.
+- `npm audit --audit-level=moderate`: passed with only the existing low-severity dev-only `esbuild` advisory.
+- `npm run lint`: passed.
+- `npm run typecheck`: passed.
+- `npm run version:check`: passed with `0.0.40`.
+- `npm run build`: passed.
+- `npm run extension:build`: passed.
+- `npm run test`: passed, 302 files passed, 1 skipped; 5802 tests passed, 1 skipped; branch coverage `26831/27655 = 97.02043030193454%`.
+- `node scripts/docs-drift-check.mjs`: passed.
+- `node scripts/audit-zombie-files.mjs`: passed.
+- `node scripts/chrome-store-compliance-check.mjs`: passed.
+- `./skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh`: passed.
+- `./skills/opendevbrowser-motion-design/scripts/validate-skill-assets.sh`: passed.
+- `npx opendevbrowser --help`: passed.
+- `npx opendevbrowser help`: passed.
+- `npm run extension:pack`: passed and produced `opendevbrowser-extension.zip` locally for packaging proof.
+- `npm pack --dry-run`: passed through `prepack`, `npm run version:check`, `npm run build`, and `npm run extension:build`; dry-run tarball inventory reported `opendevbrowser-0.0.40.tgz`, package size `3.0 MB`, unpacked size `15.2 MB`, total files `1390`, shasum `47a2437ec3853e471b68eae3791207deb11e66dd`.
+
+## Live Release Gate Evidence
+
+- Strict live release gates are deferred unless explicitly enabled for this release run. If deferred, record that `run_release_live_gates=false` was used for GitHub release workflow dispatch and keep this distinct from grouped contract gates.
+
+## npm Publish Evidence
+
+Prepublish baseline captured before local release prep publish:
+
+- Evidence path: `.omo/ulw-loop/release-0-0-40-2026-07-06/evidence/prepublish-absence-and-auth.txt`.
+- `npm view opendevbrowser version dist-tags --json`: reported version `0.0.39` and `latest` `0.0.39`.
+- `npm view opendevbrowser@0.0.40 version`: returned `E404` before publish, confirming the version was absent.
+- `gh release view v0.0.40`: returned release not found.
+- `git ls-remote --tags origin v0.0.40`: returned no refs.
+- `npm whoami`: authenticated successfully with identity redacted.
+
+Final duplicate-release recheck after release prep merge and immediately before `npm publish`: pending.
+
+Publish result: pending.
+
+## Registry Consumer Smoke
+
+- Result: pending.
+- Evidence path: `artifacts/release/v0.0.40/registry-consumer-smoke.json`.
+- Purpose: verify a registry consumer can install and smoke `opendevbrowser@0.0.40` from npm after publish.
+
+## GitHub Release Evidence
+
+Workflow dispatch after npm publish:
+
+```bash
+gh workflow run release-public.yml \
+  -f release_ref=main \
+  -f release_tag=v0.0.40 \
+  -F publish_npm=false \
+  -F publish_github_release=true \
+  -F draft_release=false \
+  -F run_release_live_gates=false
+```
+
+- Release URL exists for `v0.0.40`: pending.
+- Release is draft: pending.
+- Release is prerelease: pending.
+- Release published at: pending.
+- Tag `v0.0.40` points to: pending.
+- Release target commitish: pending.
+- Asset `opendevbrowser-extension.zip`: pending.
+- Asset `opendevbrowser-extension.zip.sha256`: pending.
+- Checksum verification: pending.
+
+## GitHub Workflow Evidence
+
+- Successful release workflow: pending.
+- Workflow job: pending.
+- Workflow head SHA: pending.
+- Workflow inputs: `release_ref=main`, `release_tag=v0.0.40`, `publish_npm=false`, `publish_github_release=true`, `draft_release=false`, `run_release_live_gates=false`.
+
+## Chrome Web Store Release Lane
+
+- Status: pending manual browser flow.
+- Required artifact: GitHub release `opendevbrowser-extension.zip` for `v0.0.40`.
+- Required proof: redacted Chrome Web Store Developer Dashboard screenshot or action log showing uploaded/submitted version `0.0.40`, or an exact browser-visible auth/account/session blocker.
+- Secrets and private account identifiers must not appear in screenshots, logs, or copied JSON.
+
+## Out Of Scope For This Evidence Update
+
+- Website deploy cutover, governed by `docs/CUTOVER_CHECKLIST.md` and the private website repository.

docs/RELEASE_RUNBOOK.md

@@ -1,12 +1,12 @@
 # Public Release Runbook
 
-Last updated: 2026-07-02
+Last updated: 2026-07-06
 
 Canonical runbook for shipping OpenDevBrowser public releases (npm package + GitHub release artifacts) from this repository.
 
 ## Current source-backed release reference
 
-As of the 2026-07-02 release prep, the checked-in release version is `0.0.39` across `package.json`, root `package-lock.json`, `package-lock.json#packages[""]`, `extension/manifest.json`, and `extension/package.json`. The current version-scoped release ledger is `docs/RELEASE_0.0.39_EVIDENCE.md`; `docs/RELEASE_0.0.38_EVIDENCE.md` and older ledgers are historical.
+As of the 2026-07-06 release prep, the checked-in release version is `0.0.40` across `package.json`, root `package-lock.json`, `package-lock.json#packages[""]`, `extension/manifest.json`, and `extension/package.json`. The current version-scoped release ledger is `docs/RELEASE_0.0.40_EVIDENCE.md`; `docs/RELEASE_0.0.39_EVIDENCE.md` and older ledgers are historical.
 
 Use `npm run version:check` as the authoritative local parity check for those five version fields before tagging or publishing.
 
@@ -242,7 +242,7 @@ npm deprecate opendevbrowser@X.Y.Z "deprecated: use <fixed-version>"
 
 ## Evidence to retain
 
-- Active version-scoped release evidence ledger path, currently `docs/RELEASE_0.0.39_EVIDENCE.md` for package version `0.0.39`
+- Active version-scoped release evidence ledger path, currently `docs/RELEASE_0.0.40_EVIDENCE.md` for package version `0.0.40`
 - Release workflow run URL
 - npm published version output (or explicit publish deferral for manual dry runs)
 - `artifacts/release/vX.Y.Z/registry-consumer-smoke.json`