[mvalancy]

Prepares the first tag-gated release, v0.4.0-alpha. The release workflow (#241) refuses a tag unless every workspace manifest carries the tag version.

• Version contract (new): tests/toolchain/version-contract.mjs lists every recorded copy of the version and fails if any differs from the root package.json. It covers:

  • all manifests and their package-lock.json entries;
  • the web APP_VERSION and .env.example;
  • the MCP server and its health endpoint, plus both MCP tests;
  • the server start-up log;
  • the installer fallback;
  • the local gd-core-* image tags;
  • the README badge.

  Negative control: bumping only the root version fails it.

• Script fix: scripts/update-version-minimal.sh used to:

  • miss the workspace manifests, which the release gate checks;
  • miss four other copies;
  • match only -alpha versions.

  It now edits manifests and lockfile entries in place. npm version re-resolved the lockfile and dropped dev flags from three packages, so it isn't used. Every other copy gets an exact-string replacement, and the script runs the contract at the end. It validates its input and is idempotent.

• Bump: 0.3.1-alpha → 0.4.0-alpha across 19 files. The lockfile diff is exactly 6 version fields.

• Local, Node 22:

  • npm run build 4/4;
  • test:unified:lib 289/289;
  • tests/toolchain/*.mjs 13/13;
  • lint clean;
  • MCP health-server.test.ts 13/13.

Next, after merge: promote dev → main with a merge PR, let main CI (including the production gate) pass, then tag v0.4.0-alpha on that main merge commit.

🤖 Generated with Claude Code

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Maintainer verification of 156f336 (my own PR, merged under the owner's delegation)

• CI: 18 pass, including the 4 required checks and the full Smoke Gate; the main-only prod job is skipped. Lint & Type Check runs version-contract.mjs: ok 4 - every workspace manifest and the lockfile carry the root version and ok 5 - runtime-reported versions, image tags and the badge carry the root version.
• Branch: 0 commits behind dev.
• Negative control: bumping only the root version fails the contract.
• Lockfile: the diff is exactly 6 version fields.
• Local, Node 22:
  • build 4/4;
  • test:unified:lib 289/289;
  • toolchain 13/13;
  • lint clean;
  • MCP health tests 13/13.

Merging.