Release OpenEnv 0.6.1

[cursor]

Release PR: v0.6.1

Planned release: Thursday, October 1, 2026 at 10:00 Europe/Brussels (08:00 UTC).

Candidate base: 9e0fd9ba (main tip). 3 commits since v0.6.0. This is the rolling release PR for the week and will be refreshed onto the final candidate head before merge.

Version: 0.6.1, and no decision is needed. Unlike 0.6.0 this week adds no public surface — one bug fix plus an internal refactor whose declared API is unchanged (evidence below). That is a patch under the same standard used for 0.5.0 and 0.6.0.

Release notes

• Novita Dockerfile ARG substitution no longer corrupts FROM: ARG BASE declared before ARG BASE_IMAGE used to rewrite FROM $BASE_IMAGE to python:3.12_IMAGE, because defaults were substituted name by name. Substitution is now longest-name-first, so declaration order no longer matters (#1235).

Not in the wheel, but shipped to the repo this week:

• The novita_tbench2_simple example now waits for readiness inside its try, so a readiness timeout stops the paid sandbox instead of leaking it, and a new parse-level test asserts that invariant for every examples/novita_*.py (#1235).
• openenv.core.harness is now a package, with the rollout implementation moved to openenv.core.harness.rollout (#1097).

API compatibility of the harness split

Checked rather than assumed, by installing openenv==0.6.0 and this candidate's wheel side by side and diffing openenv.core.harness:

• __all__ is identical in both: the same 20 declared names.
• 21 names stopped leaking from the module: incidental imports (ABC, Any, Callable, Generic, Protocol, TypeVar, TypedDict, abstractmethod, annotations, dataclass, field, json, math, runtime_checkable) and seven types that were never declared there — JsonRpcErrorCode, JsonRpcResponse, Tool (canonical home openenv.core.env_server.mcp_types), State (…env_server.interfaces), StepResult (openenv.core.client_types), plus LLMResponse and SessionT. All seven remain importable from openenv.core.harness.rollout.

So nothing in the declared API moved. Anyone who relied on an undeclared transitive import such as from openenv.core.harness import json is affected; that seems acceptable for a patch, but say so if you disagree and I will restore the re-exports instead.

Full candidate comparison: v0.6.0...9e0fd9b

Release-maintenance changes in this PR

• 0.6.1.dev0 → 0.6.1 in pyproject.toml, plus the matching editable-openenv pin in envs/grid_world_env/uv.lock and tests/validation_runtime/uv.lock (the only two locks that track the current version; without them validate-env-locks fails).

Outstanding blockers

• Dispatch and pass TestPyPI from this exact branch. workflow_dispatch is 403 for the release token, so this goes through a testpypi/0.6.1 branch carrying the push: trigger, as for 0.5.0 and 0.6.0.
• Reconcile main immediately before merge and rerun required checks if the head moves.

Not in this candidate: #1181 (Level 2 runtime probes, still awaiting zkwentz), #1098–#1100 (approval-gated CI plus open findings), and the fork PRs that still cannot run repository CI. #1222 (FastMCP 4) stays blocked: v4 keys session state by ctx.session_id and our server-side connection is rebuilt per call, so that is a scheduled migration rather than a cap bump.

Local verification already done

• uv sync --frozen --all-groups --all-extras --dry-run --no-install-project passes in both touched lock directories (the validate-env-locks command).
• Wheel and sdist build clean; a fresh 3.11 venv installs the wheel and reports 0.6.1 for both importlib.metadata and openenv.__version__, and openenv --help works.

Release Checklist

Before opening this PR

• pyproject.toml version changed from 0.6.1.dev0 → 0.6.1
• hf-staging/ is NOT in this PR's diff
• No print(), breakpoint(), or TODO added to release-critical paths
• Release notes include user-facing changes and linked PRs

CI gates (must be green before merge)

• test passes on Python 3.11
• test passes on Python 3.12
• lint passes (usort + ruff)
• Package CI builds, checks, and smoke-tests wheel/sdist installs

TestPyPI validation (before merging)

• 0.6.1.devN published from this candidate head
• Published wheel byte-compared against a local build of the same head
• Fresh-venv install, imports, CLI, and a real Echo reset/step smoke

Post-merge steps

• Tag v0.6.1 against the exact merge commit on main
• publish-pypi.yml completed (expect Open post-release bump PR to fail — GitHub Actions cannot create PRs in this org; open it by hand)
• GitHub Release created, assets byte-identical to PyPI
• pip install openenv==0.6.1 verified from production PyPI
• Next development-version bump PR opened and processed

RFC Status

• Not required (release maintenance)