chore: release 0.3.7

[steipete]

Prepare remindctl 0.3.7 with the finalized changelog and synchronized package, CLI, and embedded bundle versions. The patch includes list mutation validation, calendar time-zone handling, CLI argument parsing, geofence and reminder-index validation, and tooling updates already landed on main.

Validated locally with formatting, lint, tests and the coverage gate (94.1%), release build, docs build, release harness, and v0.3.7 release preflight. Independent review found no actionable P0–P2 findings. Signing, notarization, native draft and published verification, and Homebrew verification follow after exact-commit CI passes.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 13, 2026, 10:02 PM ET / September 14, 2026, 02:02 UTC.

ClawSweeper review

What this changes

Finalizes the 0.3.7 release notes and synchronizes the package, CLI, and embedded macOS bundle versions.

Merge readiness

✅ Ready for maintainer review

The release preparation remains necessary: main and the latest published release are still at 0.3.6. The synchronized metadata follows the repository’s release procedure, with no actionable patch defects found.

Priority: P3
Reviewed head: f3dfa57aeeab5770a9d94488b8c41f44194af51c

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, internally consistent release preparation with reported local validation and no blocking findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored release metadata patch is exempt from contributor runtime proof; native artifact and upgrade verification remain documented post-merge release gates.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored release metadata patch is exempt from contributor runtime proof; native artifact and upgrade verification remain documented post-merge release gates.
Evidence reviewed	6 items	Verified introduced patch: The complete pinned base-to-head diff changes only release notes and version values; all five version values across four metadata files agree on 0.3.7. No dependency, permission, signing, or workflow changes are introduced. Release preparation contract: Gate 0 explicitly requires finalizing the changelog and synchronizing these four metadata files. Gate 1 begins after the release commit lands on main; signing, native verification, and publication follow later. Current main still needs the version bump: The live main SHA matches the supplied base, whose version declaration remains 0.3.6.
Findings	None	None.
Security	None	None.

How this fits together

remindctl manages Apple Reminders from the terminal. Its release metadata supplies the CLI version, embedded executable identity, and notes consumed by packaging and release verification.

flowchart LR
  A[Version declaration] --> B[Version generator]
  B --> C[CLI version]
  B --> D[Embedded bundle metadata]
  E[Package version and release notes] --> F[Release preflight]
  C --> F
  D --> F

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Land the synchronized release preparation, then follow the documented signed-tag, notarization, native upgrade verification, and publication gates.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR prepares a release rather than introducing a bug fix; source inspection confirms consistent version metadata.

Is this the best way to solve the issue?

Yes: the patch follows the existing release-preparation contract and preserves the separate post-merge publication safeguards.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 3e561b6524ee.

Labels

Label changes:

• add P3: This is bounded release metadata preparation without new runtime behavior.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored release metadata patch is exempt from contributor runtime proof; native artifact and upgrade verification remain documented post-merge release gates.

Label justifications:

• P3: This is bounded release metadata preparation without new runtime behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored release metadata patch is exempt from contributor runtime proof; native artifact and upgrade verification remain documented post-merge release gates.

Evidence

What I checked:

• Verified introduced patch: The complete pinned base-to-head diff changes only release notes and version values; all five version values across four metadata files agree on 0.3.7. No dependency, permission, signing, or workflow changes are introduced. (version.env:1, f3dfa57aeeab)
• Release preparation contract: Gate 0 explicitly requires finalizing the changelog and synchronizing these four metadata files. Gate 1 begins after the release commit lands on main; signing, native verification, and publication follow later. (docs/RELEASING.md:24, f3dfa57aeeab)
• Current main still needs the version bump: The live main SHA matches the supplied base, whose version declaration remains 0.3.6. (version.env:1, 3e561b6524ee)
• Published release check: GitHub identifies v0.3.6, published September 7, as the latest release. (972357da9e14)
• Release-area routing history: Available main-branch history shows Peter Steinberger across prior version preparations and recent release-verifier maintenance. Deeper pickaxe/blame and historical blob inspection encountered unavailable-object fetch failures, so no source-line introduction attribution is claimed. (version.env, 972357da9e14)
• Validation and proof scope: The complete supplied PR body reports local formatting, lint, tests, 94.1% coverage, release build, docs build, release harness, and preflight. These were not rerun in this read-only review. The collaborator-authored metadata patch does not trigger an authority-chain proof requirement. (f3dfa57aeeab)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.