Release pass 0.11.0: the version, and a published record that had been edited to match a claim

[arpanghoshal]

Item 6, the release pass for v0.11.0 "Evidence". Do not merge before #205, which is the first three commits here; do not tag. The tag is the maintainer's.

What the release pass found

adapters/PUBLISHED.toml said something PyPI contradicts, and the guard could not see it.

That file exists because the adapters' kernel range was widened at 0.7, 0.8, 0.9 and 0.10 and neither adapter was re-published, so ctrlrun-openai-agents 1.0.0 went on declaring ctrlrun<0.6 while the kernel reached 0.10.0. Its guard compares the range in the tree against the range recorded in the file and returns early when they agree.

This release pass widened the tree to <0.12 and edited the record to 1.1.0 = <0.12 in the same commit. The two sides agreed, the comparison returned early, and the adapter version never moved:

$ curl -s https://pypi.org/pypi/ctrlrun-langgraph/json | jq -r .info.requires_dist[]
ctrlrun<0.11,>=0.5

1.1.0 is on PyPI declaring <0.11 and cannot be re-uploaded, so pip install ctrlrun-langgraph beside a 0.11.0 kernel would refuse to resolve or pull the kernel back to 0.10.x. That is the v0.10 defect, one release later, inside the file written to prevent it.

Both adapters go to 1.2.0, the record goes back to what is published, and RECORDED in test_packaging.py freezes the range each released version declares, because a released version cannot change what it requires. Replaying the mistake against the new guard fails both adapters; recording a version nobody uploaded fails too.

The README said the chain detects alteration and stopped there. It is the sentence this milestone changes, and it now names the two things the chain does not detect and what closes them.

SPEC-v0.11.md §4.6 said "itself anchored" and did not say by whom, which is the reading the implementation took and #205 fixes. §4.6 now says which one is meant, and §13.4 records that review round and its seven defects.

The release checks, each run rather than described

Both shipped examples, and each guarantee graded the same alone as in a full run:

examples/policies/payments.yaml   exit 0  16/16  N/A 16   catalogue 32   mismatched: none
examples/authority/payments.yaml  exit 0  29/29  N/A 3    catalogue 32   mismatched: none

0.10.0 reported 24/24 on the second; the five new ones are G28 to G32, all graded.

The upgrade path, against the released 0.10.0 from PyPI, not a fixture:

0.10.0 (0.10.0) wrote 4 receipts; chain ok=True
       schemas: ['ctrlrun.receipt/v7']
       ledger ends at 0007_budget_ledger
this build:  opened it: 4 receipts, chain ok=True, breaks=[], HEAD 0008_anchor_checkpoint_hold
             anchors () checkpoint None holds ()
             tables gained: anchors, holds, prune_checkpoint
this build wrote 4 more: 8 receipts total, chain ok=True, verified=8, breaks=[]
0.10.0 again: REFUSED -- SchemaMismatch: This database was written by a newer build of
              CTRLRun and records a migration this one does not know.

This milestone adds no receipt schema version: RECEIPT_SCHEMA stays ctrlrun.receipt/v7, so §6's five stay five and the boundary crossed above is the migration, not the schema.

ctrlrun demo with the network taken away, from a fresh pip install -e ., with the block itself checked rather than assumed:

$ python -c "import socket; socket.socket()"
OSError: the network is taken away for this run
$ time ctrlrun demo
0.14s user 0.02s system  0.140 total          # the budget is 60s

Release verification from a fresh git clone of this branch into a temp directory, never the working tree: install, full suite with Postgres, verify, demo, build.

wheel:  0.10.0 56 files -> 0.11.0 59 files
        ADDED   anchor.py, coverage.py, retention.py
        REMOVED (none)
sdist:  260 files, no adapters/ path, scripts/ pruned, 72 example files

Gate

All checks passed!            (ruff, ruff format, mypy --strict: 52 files)
4576 passed, 6 warnings in 160.72s

Postgres tests ran against a real server.

One note rather than a silent pass: an earlier run of the same suite under -n auto failed test_cookbook.py::test_every_recipe_runs_offline_and_is_repeatable[verify-in-github-actions] once. It passed on re-run, passed 19/19 in isolation, and passed in the fresh-clone run. I am recording it as an unexplained flake under parallel execution rather than as fixed, because I did not find its cause.

Pairing

Docs are release/0.11.0, which stacks on ctrlrun-docs#36.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ce94a4eb-b44c-4e31-b879-f5e88a80931b

📥 Commits

Reviewing files that changed from the base of the PR and between 07adf30 and e3eb3a7.

📒 Files selected for processing (13)

• CHANGELOG.md
• CITATION.cff
• README.md
• adapters/PUBLISHED.toml
• adapters/langgraph/README.md
• adapters/langgraph/pyproject.toml
• adapters/langgraph/src/ctrlrun_langgraph/__init__.py
• adapters/openai-agents/README.md
• adapters/openai-agents/pyproject.toml
• adapters/openai-agents/src/ctrlrun_openai_agents/__init__.py
• docs/SPEC-v0.11.md
• pyproject.toml
• tests/test_packaging.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}