[v0.3.2] release — ship compatible merged fixes #151

Vision — automated project maintainer

Context and user problem

Published 0.3.1 users cannot install the already-merged canonical retrieval fixes and supported MCP v1 dependency floor through a normal package update. Follow AGENTS.md, the ownership amendment in AGENT-EXECUTION-PIPELINE.md, and .github/RELEASE.md. This is the single implementation lane; #138 remains paused behind its separate review-evidence blocker, and no seventh tool is included.

Dated evidence and baseline

Observed 2026-10-10: GitHub comparison contains 39 merged commits. PyPI, GitHub releases and the MCP Registry still report 0.3.1. Current main c97600e has five successful workflows. The six-tool API remains unchanged; patch semver is appropriate.

Goal and target

Ship compatible 0.3.2 fixes within 48 hours of full readiness, without waiting for unrelated features. Readiness has not been reached; no release deadline starts until the gates below pass.

Acceptance

• Prepare only pyproject.toml project.version, uv.lock root-project version, server.json root/package versions and a new CHANGELOG top section.
• Preserve dependencies, historical changelog text, all runtime files, tests, workflows and frozen corpus/baseline. Owner static inspection confirms the four-file diff and 34 packaged runtime files equal main.
• Developer validation: locked sync/lint/types, 609 tests, 50-question corpus, build/metadata, clean installed-wheel stdio (4 tests), network-denied six-tool/version-isolation smoke; retained full-index regression 65 cases/35 hits/no regressions.
• Mandatory independent prepublication review, fresh pinned-source full-index evidence, then exact published-head verifier App success, required CI against current main and review triage.
• SHA-gated broker merge, confirmed GitHub MERGED and successful resulting-main checks.
• Eligible immutable release via pdctl; all release workflow jobs pass; same version/artifacts visible on PyPI, MCP Registry and GitHub; clean installed package verification.

Scope and non-goals

Release notes cover canonical ranking and page-level text (#137), single-symbol empty-search recovery (#139), append-only spare-slot targets (#146), security lock (#128), MCP >=1.30,<2 (#145), and development maintenance. No new runtime feature, dependency resolution, MCP v2, Python 3.15 support, paid benchmark, answer-quality superiority or named real-client compatibility claim. Preserve MIT/free distribution and canonical, version-aware offline read-only documentation queries.

Prepared evidence and limitations

Worker commit f2cfabc965a7a0676c6c8daf19c5c13e7109ec9e, tree 795cdfd7aa6be5a8fb240b1cb6e6a1c24b5bfcf7, on the exact main above is retained privately as a committed bundle, not a published branch. Bundle SHA256: 08a3ea06695d87809fd652013d70c92c759e7fc84d98ef96228a4f970b816c5a. Diff: 4 files, 33 insertions, 4 deletions. Developer evidence is not independent approval. An initial regression run failed on an incomplete index; both it and the successful complete-index run are preserved. Retained-index historical/current hash discrepancy is disclosed; fresh independent pinned-source rebuilding remains mandatory. No publication, merge or release has occurred.

Validation and recovery

Use the locked canonical commands in AGENTS.md and the full release runbook. Do not retry rejected evidence unchanged, bypass an independent review, weaken tests, invent checks or force a release. The existing internal maintenance request must yield actual reviewed/installed evidence-protocol repair, not merely queue admission. The candidate is checkpointed because this cycle no longer has the required 27-minute review window.

PR contents and review

The eventual PR must link this issue, the exact broker-published SHA, command exits and limitations, independent/hosted results and review triage. Preparation effort: one bounded 900-second worker, completed. Review date: 2026-10-11. Revisit scope/version when main changes or compatibility/dependency equality fails; never delay ready patch fixes for unrelated roadmap work.