Repository navigation
TRACKING — v0.5.1 release readiness and Product Hunt technical gate #101
Description
Master tracker for the CodexA v0.5.1 release candidate and the Product Hunt technical gate (target window: week of 2026-11-09, only if all gates pass).
Current verdict: NO-GO
Release-gate issues
- Release gate 1 — reconcile stabilization evidence and stale bug state #93 — Gate 1: reconcile stabilization evidence and stale bugs ([Bug] Quality and metrics commands emit missing sarif_om dependency errors #21–[Bug] Model benchmark cannot load Nomic embedding model without trust_remote_code #25, I4 — Test stabilization #57, I5 — Test quality #58) · CI & Test Architecture · depends on: — · target 2026-10-10
- Release gate 2 — add Python, Node, Rust, and docs checks behind ci-required #94 — Gate 2: Python / Node / Rust / docs checks behind
ci-required· CI & Test Architecture · depends on: Release gate 3 — restore reproducible VS Code install, lint, and build #95, Release gate 4 — remove tracked Rust artifacts and establish native hygiene #96 for aggregate relevance · target 2026-10-17 - Release gate 3 — restore reproducible VS Code install, lint, and build #95 — Gate 3: restore reproducible VS Code install, lint, build, package · v0.5.1 · depends on: — · target 2026-10-10 · in progress: fix(vscode): align TypeScript and typescript-eslint peer ranges #102
- Release gate 4 — remove tracked Rust artifacts and establish native hygiene #96 — Gate 4: remove tracked Rust artifacts, native hygiene · v0.5.1 · depends on: — · target 2026-10-14
- Release gate 5 — ship workspace trust, webview CSP, and targeted stabilization #97 — Gate 5: workspace trust, webview CSP, targeted stabilization · v0.5.1 · depends on: Release gate 3 — restore reproducible VS Code install, lint, and build #95 · target 2026-10-21
- Release gate 6 — prove platform and Python coverage before CI optimization #98 — Gate 6: platform / Python coverage + shadow validation (I6 — Platform coverage #59–I9 — Main/nightly lifecycle #62) · CI & Test Architecture · depends on: Release gate 1 — reconcile stabilization evidence and stale bug state #93, Release gate 2 — add Python, Node, Rust, and docs checks behind ci-required #94 · target 2026-10-31
- Release gate 7 — separate, test, and safely publish release artifacts #99 — Gate 7: separate, test, safely publish release artifacts (I10 — Release artifact validation #63) · v0.5.1 · depends on: Release gate 1 — reconcile stabilization evidence and stale bug state #93, Release gate 4 — remove tracked Rust artifacts and establish native hygiene #96, Release gate 6 — prove platform and Python coverage before CI optimization #98 PR1 · target 2026-10-28 · P0
- Release gate 8 — align versions, docs, landing page, and v0.5.1rc1 evidence #100 — Gate 8: versions, docs, landing page, rc1 evidence · v0.5.1 · depends on: Release gate 1 — reconcile stabilization evidence and stale bug state #93–Release gate 7 — separate, test, and safely publish release artifacts #99 · target 2026-11-04
Known P0/P1 blockers
- P0 — Release workflow publishes a merged artifact directory (including standalone executables) to PyPI with a long-lived token (Release gate 7 — separate, test, and safely publish release artifacts #99).
- P1 — Published
codexa==0.5.0MCP server crashes with the currently allowedmcpSDK ([Bug] MCP server crashes because Server.list_tools is unavailable with mcp 2.1.1 #23, Release gate 1 — reconcile stabilization evidence and stale bug state #93); fixed onmain, not yet released or regression-tested. - P1 — VS Code extension cannot be installed (
npm ci), linted, or packaged (vsce) from a clean checkout (Release gate 3 — restore reproducible VS Code install, lint, and build #95).
Baseline commit for issue evidence: f1cd131; main advanced to efccb5a via #92 (docs config only), which does not change any finding.
Immutable v0.5.1rc1 gates (all must be true)
-
ci-requiredenforced and truthful for Python, Node, Rust, and docs changes - Full Ubuntu/Windows × Python 3.11/3.12/3.13 required matrix green
- Coverage and scoped typing gates pass at documented baselines
- Clean Node install, compile/typecheck, lint, audit policy pass
- Rust fmt, clippy, tests, audit, and claimed optional-feature checks pass
- No tracked
codexa-core/targetfiles - Workspace trust and nonce CSP implemented and tested
- Clean installs of exact wheel and sdist pass runtime smoke tests
- MCP
initialize+tools/listpass from the exact release artifact - Release outputs segregated; publication cannot mix distributions/executables
- Public docs match actual artifacts, support, versions, limitations
- No unresolved P0/P1 release blocker
Maintainer approval checkpoints
Tagging/publishing v0.5.1rc1 or v0.5.1, any ruleset/required-check change, OS/Python coverage reduction, PyPI trusted-publishing account step, deleting assets/tags/branches/history, Product Hunt scheduling.
Post-gate sequence
RC evidence packet → approval → RC via protected workflow → ≥7-day soak → final go/no-go → approval for publication/launch.
This issue is updated after every merged PR or changed blocker and stays open until the RC soak and final go/no-go review complete.
Activity
M9nx commentedon Oct 3, 2026
Phase 0 baseline — 2026-10-03
Repository:
origin = https://github.com/M9nx/CodexA, default branchmain, localmain=origin/main=f1cd131a47f3a44760776538da4d89e64a844a0f(matches audit baseline). Local worktree has unrelated uncommitted docs/config files; not touched.GitHub state
ci-required(24007391): active,refs/heads/main, strict, requires contextci-required. RulesetPR(22446691): disabled.mainCI: success — https://github.com/M9nx/CodexA/actions/runs/36201208932CI & Test Architecture Restructure(Welcome to CodexA Discussions! #1, 9 open / 8 closed);v0.5.1 Release Readiness(Depedencies missing in pip package codexa-0.4.2 #2, created today).Add Google Analytics script to config, maintainer, touches onlydocs/.vitepress/config.mts) — difference from baseline recorded.Packages / releases
codexalatest 0.5.0:codexa-0.5.0-py3-none-any.whl,codexa-0.5.0.tar.gz.v0.5.0: 0 assets.Versions
Python 0.5.0 · Rust
codexa-core0.1.0 · VS Code 0.2.0 · docspackage.json0.29.0 · docs nav v0.5.0 · site footer v0.4.5 · MCPserverInfo.versionempty.Repository hygiene
git ls-files codexa-core/target | wc -l→ 1694git count-objects -vHsize-pack → 120.53 MiBReproductions (clean temp environments)
npm ci --ignore-scriptsinvscode-extension@typescript-eslint/eslint-plugin@6.21.0requires parser^6, lock has parser8.70.1codexa==0.5.0→codexa init+codexa mcpmcp==2.3.0Fatal error: 'Server' object has no attribute 'list_tools'main(f1cd131) → same handshakemcp==2.3.0initializeOK;tools/list→ 13 toolsHandshake probe: raw JSON-RPC over stdio (
initializeprotocol2025-06-18→notifications/initialized→tools/list).Release-workflow dry run: not yet executed (deferred to #99 PR 4, needs a non-publishing path first).
Verdict
NO-GO. Next PR:
fix(vscode): align TypeScript and typescript-eslint peer ranges(#95) in parallel withtest(mcp): cover initialize and tools/list against supported SDK(#93).M9nx commentedon Oct 3, 2026
Update 2026-10-03 — #92 (Google Analytics) merged;
mainis nowefccb5a. Opened #102 (refs #95):npm ciexit 0 andtscexit 0 with TypeScript 6.0.3 + typescript-eslint 8.71.0. Found an additional gap:vscode-extensionhas no ESLint config file, sonpm run lintcannot pass under ESLint 10 — covered by #95 PR 2. Dependabot dispositions posted on #80–#91. Verdict: NO-GO.M9nx commentedon Oct 3, 2026
Update 2026-10-03 (post independent review) — Reviewer verified all Phase 0 findings and #102's toolchain fix. Applied fixes: (1) #102 commits rebuilt without
Co-authored-bytrailers (runbook violation) and force-pushed to the PR branch only — trees identical; (2) #99 now carries confirmed evidence that the tag-triggered release job publishes a mergedartifacts/directory, including PyInstaller binaries, to PyPI withPYPI_API_TOKEN— marked P0; (3) #95 extended with the missing ESLint config,vsce packagefailure (@types/vscode ^1.138.0>engines.vscode ^1.85.0), and a Dependabot TypeScript ignore rule; (4) this tracker's checklist converted to a renderable task list with a P0/P1 blocker section. Verdict: NO-GO.M9nx commentedon Oct 3, 2026
Update 2026-10-03 (Phase 0 re-test) — independent re-test confirmed all baseline claims (one correction:
codexa-core/target/is in.gitignore; the 1694 files were committed before the rule). New P1: CI installs onlyrequirements.txt(nomcp), so all MCP tests are skipped on every job — root cause of the shipped 0.5.0 MCP crash (recorded on #94, #93). Also: 0.5.0 PyPI files were not produced by the release workflow, whose run had a failed Linux wheel build and a skipped release job (recorded on #99). Main still reports version 0.5.0 despite containing the MCP fix. Verdict: NO-GO.