[v1.0] Publish the post-0.4.3 fixes under a new package version

[codeforester]

Goal

Ship the validated changes on main as the immutable 0.5.0 release while keeping the published 0.4.3 artifact unchanged.

Background

PyPI and the latest GitHub release publish 0.4.3 from tag v0.4.3. Current main contains user-visible lifecycle, portability, Click 8.5, release-toolchain, typing, coverage, compatibility, and security hardening changes, but both VERSION and base_cli.__version__ still report 0.4.3.

The Package workflow builds review artifacts from main while that version remains unchanged. As a result, source documentation and validation results describe behavior that pip install base-cli==0.4.3 does not contain, and main artifacts reuse an already-published distribution identity.

Scope

• Prepare and publish the next minor release as 0.5.0; keep 0.4.3 immutable.
• Review the pre-1.0 SemVer/API impact and document any compatibility or migration notes.
• Include all post-0.4.3 user-visible fixes under [Unreleased], then cut the dated 0.5.0 changelog section.
• Resolve the open P1 release blocker from [v1.0] Gate releases on protected main lineage and independent approval #271 before tagging.
• Rehearse TestPyPI, publish the exact reviewed artifact, and create the GitHub release.
• Record checksums, SPDX SBOM, attestations, and installed-wheel validation.

Acceptance criteria

• VERSION, package metadata, tag v0.5.0, GitHub release, changelog, and PyPI all agree on 0.5.0.
• The release notes explain the 0.4.x to 0.5.0 compatibility boundary and link migration guidance where needed.
• The published wheel includes the Click 8.5 compatibility range and every claimed post-0.4.3 fix.
• No 0.4.3 artifact or tag is replaced.
• TestPyPI and PyPI verification install from empty environments and pass the public lifecycle/JSON smoke tests.
• The final release commit is protected and independently approved per [v1.0] Gate releases on protected main lineage and independent approval #271.
• The release artifact, provenance, SBOM, and GitHub release all correspond to the same reviewed commit and tag.

Dependencies

• [v1.0] Gate releases on protected main lineage and independent approval #271
• [v1.0] Preserve single-envelope JSON output for Click-derived activation #304
• [v1.0] Bound lifecycle JSON capture end to end #305
• [v1.0] Make published changelog sections immutable #306
• [v1.0] Calibrate the WSL performance budget as its own platform class #308
• [v1.0] Make the authoritative validation gate fail closed on security tools #310
• [v1.0] Keep dependency support docs synchronized with package metadata #314

Project fields

• Status: Backlog
• Priority: P1
• Area: Packaging
• Initiative: v1.0 Readiness
• Size: M

Ownership

• Assignee: @codeforester

[codeforester]

Implementation prerequisites are now merged: #318, #319, #320, #321, #322, #323, #324, #325, #326, #327, and #328. Post-train tests/full_validate.sh passes locally (505 tests, 193 subtests, 87.4% coverage, strict mypy/Ruff, docs/contracts/changelog, benchmark, and pip-audit). Release execution remains gated by #271 (protected main lineage and independent production approval).

[codeforester]

2026-09-12 repository review refresh

Main is now 33 commits ahead of v0.4.3 while VERSION and the public package identity remain 0.4.3. The latest public GitHub release is v0.4.3. The reviewed main passes the authoritative local gate (518 tests, 193 subtests, 87.22% combined statement/branch coverage) but new findings #338-#343 also need triage before the next release. Publish current fixes under a new immutable version through the separate release authorization boundary.

Validated against current main (7faf347a5b90969e169c88f3ac18e7202d142dd0). This review files and scopes work; it does not claim implementation or authorize release/admin changes.

[codeforester]

Release decision recorded: the next release is 0.5.0, not 0.4.4. The issue body and acceptance criteria now target the 0.5.0 minor release, including an explicit pre-1.0 compatibility/migration review.