[AAASM-2343] 🔧 (release): Bump agent-assembly workspace to 0.0.1-alpha.4

[Chisanan232]

Description

Fourth pre-release in the v0.0.1 dry-run series. Bumps workspace + 22 path-dep version literals across 9 publishable crates from 0.0.1-alpha.3 to 0.0.1-alpha.4. Cuts the release tag that lets us verify the three release-infra fixes that landed since alpha-3 work in real CD (not just locally).

Headline: cargo install aasm works for the first time

PR #843 (AAASM-2340) replaced the broken single-crate publish flow with cargo-workspaces topological publish for all 9 transitive deps of aa-cli, plus _embedded/ mirror staging for the dashboard SPA, the gRPC proto contract, and the BPF probe source. This alpha is the first tag that actually exercises that pipeline.

Fixes verified by this tag

• AAASM-2340 (PR [AAASM-2340] ✨ (release): Publish workspace to crates.io via cargo-workspaces topological publish #843) — cargo-workspaces topological publish; _embedded/ mirrors; new aasm sandbox run / aasm sandbox info CLI; held-back dev-tool surface via .ci/strip-for-publish.sh.
• AAASM-2339 (PR [AAASM-2339] 🔧 (smoke): Gate curl-installer with if: false until get.agent-assembly.io ships #841) — smoke-curl-installer gated if: false.
• AAASM-2336 (PR [AAASM-2336] ♻️ (release): Add notify-downstream — repository_dispatch to node-sdk + python-sdk after Release publishes #842 + companion node-sdk#66 + companion python-sdk#73) — notify-downstream job → repository_dispatch to BOTH node-sdk and python-sdk. Supersedes AAASM-2328 retry workaround.

Files updated

 CHANGELOG.md                                | +60
 Cargo.lock                                  | regenerated
 Cargo.toml                                  | workspace version 0.0.1-alpha.4
 9 publishable crates' Cargo.toml            | 22 path-dep literals → alpha.4
 docs/release/v0.0.1-alpha.4.md              | new (alpha-4 release notes)
 docs/src/compatibility.md                   | new AAASM-2343 row

Local verification

• ✅ cargo build --workspace → exit 0
• ✅ cargo publish --dry-run -p aa-core (leaf crate) → "aborting upload due to dry run"
• ✅ cargo ws publish --dry-run --yes → progresses to manifest verification (the expected "no matching package named aa-core" terminus matches PR [AAASM-2340] ✨ (release): Publish workspace to crates.io via cargo-workspaces topological publish #843's documented dry-run behaviour for the first publish — real publish chains via crates.io between steps)
• ✅ bash .ci/strip-for-publish.sh on a tmp branch → cargo check -p aa-cli → exit 0

Operator gates (pre-tag confirmed)

• ✅ CRATES_IO_TOKEN secret configured
• ✅ CROSS_REPO_DISPATCH_PAT secret configured covering both node-sdk and python-sdk
• Note: npm deprecate @agent-assembly/sdk@0.0.1-alpha.3 is optional once alpha.4 ships and is confirmed working. alpha.1 and alpha.2 never reached npm (404), so AAASM-2335's deprecation list collapses to just alpha.3.

After this PR + tag

1. Merge this PR — master ends with [workspace.package].version = "0.0.1-alpha.4".
2. Push tag v0.0.1-alpha.4 (or trigger via the GH UI).
3. Observe the release pipeline:
   • publish creates the GH Release object with platform binaries.
   • publish-crates lands all 9 crates on crates.io (FIRST publish ever — establishes ownership).
   • notify-downstream fires repository_dispatch → node-sdk + python-sdk consume it.
   • node-sdk publishes @agent-assembly/sdk@0.0.1-alpha.4.
   • python-sdk publishes wheels with bundled aasm binary on PyPI.
4. Clean-machine smoke test (closes the standing AAASM-2340 post-merge ACs):
   • cargo install aasm → version reports aasm 0.0.1-alpha.4
   • pip install --pre agent-assembly==0.0.1a4 → wheel ships with bundled aasm
   • npm install @agent-assembly/sdk@0.0.1-alpha.4 → installs without retry
5. Transition AAASM-2340, AAASM-2336, AAASM-2339, AAASM-2342, AAASM-2343 → Done.

Related

• Jira: AAASM-2343
• Parent: AAASM-1234 (F118 release-notes authoring)
• Predecessors: AAASM-2103 (alpha-2), AAASM-2312 (alpha-3)
• Companion: AAASM-2342 (python-sdk listener)

— Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

Claude Code review — AAASM-2343

CI state — green across the board (37/37 SUCCESS)

Every workflow check passed including the gates that had been red on prior PRs:

• codecov/patch: SUCCESS — was FAILURE on PR [AAASM-2340] ✨ (release): Publish workspace to crates.io via cargo-workspaces topological publish #843 because of restored-from-history lines; this PR adds no new code (only version-bump literals + release-notes docs), so patch coverage stays clean.
• SonarCloud analysis: SUCCESS — confirms the AAASM-2340 staging fix ($RUNNER_TEMP/aasm-bin + rm -rf target/debug before llvm-cov) holds up on a clean PR.
• Test: SUCCESS — the AASM_BIN_PATH pre-build optimization paying off again.
• Coverage: SUCCESS, Integration tests (ubuntu + macOS): SUCCESS — same.

mergeable: MERGEABLE, mergeStateStatus: CLEAN. Nothing to fix.

Scope vs. acceptance criteria

AAASM-2343's "Files updated" checklist maps 1:1 to the diff:

AC bullet	Status	Evidence
Cargo.toml [workspace.package].version → 0.0.1-alpha.4	✅	Line 38
Cargo.lock regenerated	✅	Diff shows the regenerated lock
9 publishable crates' Cargo.toml — 20+ path-dep literals bumped	✅	22 literals across aa-cli, aa-gateway, aa-proxy, aa-runtime, aa-sandbox, aa-ebpf, aa-devtool, aa-devtool-codex, aa-devtool-windsurf
CHANGELOG.md — new [0.0.1-alpha.4] section	✅	New section above alpha.3, formatted per Keep-a-Changelog convention
docs/release/v0.0.1-alpha.4.md — new release notes	✅	Also satisfies the standing AAASM-2340 documentation AC ("v0.0.1-alpha.4.md documents the new install path")
docs/src/compatibility.md — alpha-4 row	✅	New AAASM-2343 row appended

Pre-flight verification recorded in commit 79952f80:

• cargo build --workspace → exit 0
• cargo publish --dry-run -p aa-core → "aborting upload due to dry run" (success signal)
• bash .ci/strip-for-publish.sh → cargo check -p aa-cli → exit 0

Cross-PR coordination check

Three release-infra fixes will be verified by tagging v0.0.1-alpha.4:

Fix	This-PR-side merged?	Companion repos ready?
AAASM-2340 (cargo-workspaces topo publish)	✅ landed via PR #843	n/a — single-repo
AAASM-2339 (curl smoke gating)	✅ landed via PR #841	n/a — single-repo
AAASM-2336 (notify-downstream dispatch)	✅ landed via PR #842	✅ node-sdk#66 merged; python-sdk#73 OPEN (companion listener AAASM-2342)

Recommend merging python-sdk#73 before tagging so python-sdk's release-python.yml listens for the dispatch on the same release cycle. If tagged before #73 merges, python-sdk still works (falls through to workflow_dispatch-only / silent-degradation tag-push fallback won't fire because tag-push trigger removed in #73 — actually that's only after #73 merges, so the previous 2>/dev/null workaround still operates if alpha.4 ships before python-sdk#73). Either order works; same release cycle is cleaner.

Operator gates (confirmed by user before this prep)

• ✅ CRATES_IO_TOKEN
• ✅ CROSS_REPO_DISPATCH_PAT covering node-sdk + python-sdk
• 📝 npm deprecate @agent-assembly/sdk@0.0.1-alpha.3 is the only remaining AAASM-2335 leftover; optional post-tag and only one version (alpha.1/alpha.2 never reached npm). Decide after observing alpha.4 lands cleanly.

Verdict

Ready for human approval and merge. All in-tree ACs satisfied. CI clean on every gate. Two post-merge ACs from AAASM-2340 (live publish-crates verification + clean-machine cargo install aasm smoke) will be discharged the moment the v0.0.1-alpha.4 tag fires.

— Claude Code (Opus 4.7, 1M context)