Restore Dex 0.10.0 pins and simplified releases

.github/workflows/github-release-ui.yml

@@ -106,71 +106,3 @@ jobs:
 
           install_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${RELEASE_TAG}/${asset_name}"
           echo "Install with: npm install ${install_url} react" >> "${GITHUB_STEP_SUMMARY}"
-
-  notify-downstreams:
-    name: Request IaC and SuperVerse upgrades
-    if: github.event_name == 'release'
-    needs: attach
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event.release.tag_name }}
-      - name: Validate release compatibility declaration
-        id: release
-        env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          python3 script/check_dex_release.py
-          python3 - "${RELEASE_TAG}" "${GITHUB_OUTPUT}" <<'PY'
-          import json
-          from pathlib import Path
-          import re
-          import subprocess
-          import sys
-
-          tag, output_path = sys.argv[1:]
-          if re.fullmatch(r"v[0-9]+\.[0-9]+\.[0-9]+", tag) is None:
-              raise SystemExit("SuperAgent release tag is not stable semver")
-          lock = json.loads(Path("dex-release.lock.json").read_text(encoding="utf-8"))
-          commit = subprocess.run(
-              ["git", "rev-parse", "HEAD"], check=True, capture_output=True, text=True
-          ).stdout.strip()
-          with Path(output_path).open("a", encoding="utf-8") as output:
-              for name, value in {
-                  "dex_version": lock["release"],
-                  "manifest_url": lock["manifest"]["url"],
-                  "manifest_sha256": lock["manifest"]["sha256"],
-                  "open_flows_compatibility": lock["openFlowsCompatibility"],
-                  "superagent_commit": commit,
-              }.items():
-                  print(f"{name}={value}", file=output)
-          PY
-      - name: Create repository-scoped release automation token
-        id: app-token
-        uses: actions/create-github-app-token@v2
-        with:
-          app-id: ${{ vars.RELEASE_AUTOMATION_APP_ID }}
-          private-key: ${{ secrets.RELEASE_AUTOMATION_PRIVATE_KEY }}
-          owner: superdurable
-          repositories: iac,superverse
-      - name: Dispatch audited downstream upgrades
-        env:
-          DEX_MANIFEST_SHA256: ${{ steps.release.outputs.manifest_sha256 }}
-          DEX_MANIFEST_URL: ${{ steps.release.outputs.manifest_url }}
-          DEX_VERSION: ${{ steps.release.outputs.dex_version }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          OPEN_FLOWS_COMPATIBILITY: ${{ steps.release.outputs.open_flows_compatibility }}
-          SUPERAGENT_COMMIT: ${{ steps.release.outputs.superagent_commit }}
-          SUPERAGENT_RELEASE: ${{ github.event.release.tag_name }}
-        run: |
-          for repository in iac superverse; do
-            gh api --method POST "repos/superdurable/${repository}/dispatches" \
-              -f event_type=superagent-release-published \
-              -f "client_payload[dex_version]=${DEX_VERSION}" \
-              -f "client_payload[manifest_url]=${DEX_MANIFEST_URL}" \
-              -f "client_payload[manifest_sha256]=${DEX_MANIFEST_SHA256}" \
-              -f "client_payload[superagent_release]=${SUPERAGENT_RELEASE}" \
-              -f "client_payload[superagent_commit]=${SUPERAGENT_COMMIT}" \
-              -f "client_payload[open_flows_compatibility]=${OPEN_FLOWS_COMPATIBILITY}"
-          done

.gitignore

@@ -17,3 +17,4 @@
 /web/packages/*/node_modules/
 /web/playwright-report/
 /web/test-results/
+__pycache__/

CONTRIBUTING.md

@@ -12,25 +12,17 @@ against the installed released SDK and a version-matched runnable example or
 real-server compile-contract test.
 
 Snapshot, Stream, Channel size snapshot, and Attribute wait code target Dex Go
-SDK `v0.9.1` and Server `v0.10.0`. Workers negotiate the Server protocol before
-binding, so deployments upgrade the Server before the Worker. Recheck
+SDK `v0.10.0`. Workers negotiate the Server protocol before binding. Recheck
 the installed SDK source and the installed skill before changing resource
 projection or errors. Never infer an API from a design screenshot or unreleased
 branch.
 
-`dex-release.lock.json` binds the Server to its immutable compatibility manifest.
-It binds an independently released Go SDK patch to its tag, source commit, and
-Go module checksums. For a Server-only upgrade, run
-`script/update_dex_release.py` with `--server-only`, `--manifest-url`, and
-`--manifest-sha256`. This preserves either SDK lock form and requires the SDK
-and Server protocol intervals to overlap. Dex Go SDK `v0.9.1` registers RPCs
-explicitly and fixes their execution options at Flow registration.
-A Dex publication opens an automated upgrade PR with open Flow
-compatibility set to `cancel-required` for review. Publishing the subsequent
-SuperAgent release dispatches the reviewed IaC and SuperVerse upgrades.
-The automation opens the draft after asset validation and mechanical pin
-updates, before product compilation. Resolve breaking SDK API migrations in
-that draft; normal pull-request CI remains the merge gate.
+Dex Go SDK and dexcli are independent direct dependencies. Run
+`script/update_dex_versions.py` with explicit component versions, then run
+`script/check_dex_versions.py`. The updater reads dexcli's native
+`checksums.txt`; SuperAgent does not consume a cross-component compatibility
+manifest. Resolve SDK API changes in the same pull request. Normal compilation,
+real-Server integration, and browser E2E are the merge gates.
 
 ## Deployment boundary
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: audit-web build-api build-web check check-agent-rules check-flow-definition \
+.PHONY: audit-web build-api build-web check check-agent-rules check-dex-versions check-flow-definition \
 	check-generated copyright-check flow-visualize format-check fuzz generate \
 	generate-go generate-web governance-check install-dexcli install-osv-scanner install-temporal lint lint-go lint-web lint-workflows \
 	test test-agent test-api test-app test-config test-dex-integration test-mcp test-model test-openai-live \
@@ -48,6 +48,9 @@ copyright-check:
 
 governance-check: check-agent-rules copyright-check
 
+check-dex-versions:
+	@python3 script/check_dex_versions.py
+
 install-dexcli: $(DEXCLI_BINARY)
 
 $(DEXCLI_BINARY): script/install-dexcli.sh
@@ -168,4 +171,4 @@ test-web:
 test-openai-live:
 	@GOCACHE=$(GO_BUILD_CACHE) GOWORK=off go test -tags=live -count=1 -run '^TestLiveOpenAIResponses$$' ./internal/model
 
-check: governance-check check-generated format-check build-api build-web vet lint test test-race test-web vulnerability-check audit-web
+check: governance-check check-dex-versions check-generated format-check build-api build-web vet lint test test-race test-web vulnerability-check audit-web

README.md

@@ -102,7 +102,7 @@ make build-api
 make build-web
 ```
 
-Start a compatible Dex server. Dex Go SDK `v0.9.1` Workers require the Server
+Start a compatible Dex server. Dex Go SDK `v0.10.0` Workers require the Server
 compatibility RPC, so upgrade the Server before the Worker. Then run the API and
 Worker:
 

docs/adr/0012-watermark-and-input-consumption-reconciliation.md

@@ -75,7 +75,7 @@ Consumed IDs suppress stale queue data until durable history replaces the
 temporary projection. Snapshot remains the only authoritative durable
 reconciliation model.
 
-Deployments must use Dex Server `v0.10.0` and Go SDK `v0.9.1`, and the matching
+Deployments must use Dex Server `v0.10.0` and Go SDK `v0.10.0`, and the matching
 Worker and browser behavior together. The Server must be upgraded first because
 Workers reject Servers without protocol negotiation. Deployments must stop or
 clear Agent Flows created with the removed schema before rollout; there is no

docs/adr/0014-registered-rpc-options.md

@@ -6,7 +6,7 @@ Accepted on 2026-09-17.
 
 ## Context
 
-Dex Go SDK `v0.9.1` replaces reflected RPC discovery with explicit `GetRPCs`
+Dex Go SDK `v0.10.0` replaces reflected RPC discovery with explicit `GetRPCs`
 definitions. Timeout, locks, transactional execution, and selective collection
 loads belong to the registered RPC definition. Callers can impose a shorter
 context deadline, but cannot change those options per invocation.
@@ -28,9 +28,8 @@ only the requested immutable ten-message chunk. It still excludes current
 messages and pending Channels. Retention remains the bound on loaded archive
 state. Integration-only RPCs use the same explicit registration contract.
 
-The release lock records Server `v0.10.0` through its compatibility manifest.
-Because `sdk-go/v0.9.1` is an SDK-only release without a Server manifest, the
-lock records its tag, source commit, and Go module checksums separately.
+The Go SDK and dexcli use their native version pins and checksums. Component
+upgrades use ordinary pull requests and application validation.
 
 ## Consequences
 
@@ -39,7 +38,7 @@ or locks fail during registry construction. Call sites cannot accidentally
 weaken transactional behavior or select undeclared state.
 
 An archive page now hydrates every retained archive chunk before returning one
-page. This is a known cost of the released `v0.9.1` contract, not an SLA change.
+page. This is a known cost of the released `v0.10.0` contract, not an SLA change.
 A future bounded design requires a new durable storage boundary or a released
 SDK facility for input-derived instance selection; it must not emulate mutable
 per-call options in application code.

docs/dex-v0.10-upgrade.md

@@ -1,29 +1,21 @@
 # Dex Server v0.10.0 upgrade
 
-Status: implementation and verification in progress.
+Status: released SDK and Server integration.
 
 ## Scope
 
-Upgrade Server and CLI to v0.10.0 and Go SDK to v0.9.1. The SDK explicitly
+Upgrade Server and CLI to v0.10.0 and Go SDK to v0.10.0. The SDK explicitly
 registers RPCs and fixes their execution options at registration. It removes
 invocation-specific selective loads, including the former single-instance load
 used by `GetArchivedMessages`.
 
-The Server lock uses its immutable compatibility manifest. The SDK-only patch
-has no Server manifest, so its lock records the release tag, source commit, and
-Go module checksums. Validation also requires the SDK and Server protocol
-intervals to overlap.
-
-## Release prerequisite
-
-The missing Server v0.10.0 manifest was backfilled after the Dex partial-release
-workflow was corrected. SuperAgent pins that asset and its SHA-256. The
-`sdk-go/v0.9.1` release is pinned independently because compatibility manifests
-are Server release contracts and the patch published only the Go SDK.
+Components are independently published. SuperAgent directly pins the released
+Go SDK in `go.mod` and dexcli in its installer. The CLI installer verifies native
+release checksums. Application upgrades use ordinary pull requests.
 
 ## Tests
 
-The published CLI v0.10.0 archive checksums and SDK v0.9.1 module checksums are
+The published CLI v0.10.0 archive checksums and SDK v0.10.0 module checksums are
 locked. Unit compilation verifies the explicit RPC registration API. Real
 Server integration, visualization, complete checks, and browser E2E must pass
 before release.
@@ -36,9 +28,9 @@ regression gate.
 
 ## Documentation
 
-CONTRIBUTING documents the mixed Server/SDK lock. The Flow model and ADR 0014
+CONTRIBUTING documents component pins and the local version updater. The Flow model and ADR 0014
 document immutable registered RPC options and the whole-map archive load imposed
-by the v0.9.1 contract.
+by the v0.10.0 contract.
 
 ## UI/UX
 

docs/flow-model.md

@@ -14,7 +14,7 @@
   `GetArchivedMessages`
 - Browser synchronization Attribute: `WaitingInputRound`
 
-The implementation requires Dex Go SDK `v0.9.1` and Server `v0.10.0`. Each
+The implementation requires Dex Go SDK `v0.10.0` and Server `v0.10.0`. Each
 `WaitFor`, `Execute`, and RPC invocation is an independent Dex atomic commit.
 Provider and MCP calls are external effects and are not part of a Dex
 transaction.
@@ -184,7 +184,7 @@ the Flow's ASYNC default. A long-running definition explicitly selects SYNC.
 ASYNC fallback changes where the attempt runs; it does not change that resolved
 durability.
 
-Dex Server `v0.10.0` and Go SDK `v0.9.1` expose Channel size metadata in `WaitFor` and
+Dex Server `v0.10.0` and Go SDK `v0.10.0` expose Channel size metadata in `WaitFor` and
 `Execute`. `AwaitUser.WaitFor` reads the
 sizes of `SteeredUserMessages`, `QueuedUserMessages`, and the current
 `PlanExecutions` instance without loading message payloads. It increments
@@ -288,7 +288,7 @@ description, and pending Channels. It returns `WaitingInputRound` and stable
 application message IDs. Snapshot contains application state only; it does not
 project Dex lifecycle or terminal failure metadata. Archive paging returns exactly one immutable chunk and
 the bounded sequence metadata needed for continuation. Its registered
-`v0.9.1` RPC options load the retained archive map because the requested chunk
+`v0.10.0` RPC options load the retained archive map because the requested chunk
 key is an RPC input and invocation-specific selective loads no longer exist.
 
 The browser begins with the Snapshot round, waits for `round > watermark`, uses

go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/ogen-go/ogen v1.24.0
 	github.com/openai/openai-go/v3 v3.55.0
 	github.com/superdurable/dex/blob-cache-go v0.1.0
-	github.com/superdurable/dex/sdk-go v0.9.1
+	github.com/superdurable/dex/sdk-go v0.10.0
 	golang.org/x/net v0.58.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -54,4 +54,5 @@ require (
 )
 
 tool github.com/ogen-go/ogen/cmd/ogen
+
 tool github.com/ogen-go/ogen/cmd/jschemagen

go.sum

@@ -62,8 +62,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/superdurable/dex/blob-cache-go v0.1.0 h1:+c3H5YBWG3DlICOHbgT9IUM5vTlfLYGP5Vd5sWr7WTY=
 github.com/superdurable/dex/blob-cache-go v0.1.0/go.mod h1:Atepb7+sztvDCztVKmlvEKCSKFCkHKtDhoFYjaFmtEw=
-github.com/superdurable/dex/sdk-go v0.9.1 h1:j7q+gpS1E8i0JvrR1gmpBUnWBHDZr6iTqYAOiwPzC2U=
-github.com/superdurable/dex/sdk-go v0.9.1/go.mod h1:8Wj5wPf9dyb7hDnA40j8xISR/zjhX57NrUDVcXgf5x8=
+github.com/superdurable/dex/sdk-go v0.10.0 h1:TtXm17mxRE3ZdXI9hltIWDb3v6UsboHj/K5gEncO4Xg=
+github.com/superdurable/dex/sdk-go v0.10.0/go.mod h1:8Wj5wPf9dyb7hDnA40j8xISR/zjhX57NrUDVcXgf5x8=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
 github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=