release: prepare 0.40.0-beta.6 for npm next

[mohanagy]

Summary

• Prepare exactly @lubab/madar@0.40.0-beta.6 from authorized protected-next base 68729161699b7592bea6984e1aa22c7b4b0833e8.
• Seal the npm candidate at 102 files / 155,257 packed / 653,996 unpacked bytes, shasum 4c98dd99cd321e741cabd689f0803d99e519f389, integrity sha512-o6L/BiJ1wrTWCaK537p60pGUC5i8zY0Zqz7NqD1zW4fJl/ewjF3cgysf4dbOkY4y49DkYDTG2qoUh1DGvq2Q0Q==, and tarball SHA-256 12d8abe1ac3d0945c654f4df2582ac1de63f2aeee55d82d4bf5b053d92036074.
• Keep production code, dependencies, graph/index/query semantics, CLI, MCP, and retrieval budgets unchanged.
• Permit publication only through the protected-next trusted-publishing workflow under npm dist-tag next.
• Do not publish stable/latest, create a GitHub Release, publish Registry metadata, create a tag, or target main.

Owner authorization: #631 receipt, #629 receipt.

Testing

• npm run test:coverage — 83 files / 914 tests; thresholds passed
• npm run typecheck — Node 22 and Node 20
• npm run build and npm run build:eval — Node 22 and Node 20
• npm run release:verify
• npm run registry:validate
• node tools/eval/core-reset/benchmark.mjs — 14/14 ready, all four handoffs and terminal persistence, 100 warm samples
• npx vitest run tests/unit/core-reset-baseline.test.ts
• npm run verify:pack-parity — installed package and checkout match
• node tools/eval/core-reset/verify-isolation.mjs — exact package metrics, zero evaluation leakage
• npm audit --audit-level=high — zero vulnerabilities
• npm audit signatures — 75 signatures / 27 attestations verified
• Exact tarball install, madar --version, and madar generate smoke
• Actual npm pack is stronger than npm pack --dry-run; exact artifact identity matches the sealed receipt

Core Reset contract

• RFC requirement: accepted RFC [RFC]: Madar Core Reset — narrow TypeScript semantic-path engine #577 release governance; exact beta.6 authorization on [P0][Quality]: Gate no-fallback retrieval against 0.32, beta.4, pinned Graphify, and control #631 and [P0][Architecture]: Build answer-ready semantic execution retrieval without source fallback #629
• Parent issue: [P0][Quality]: Gate no-fallback retrieval against 0.32, beta.4, pinned Graphify, and control #631
• Removal-manifest IDs: no-fallback-qualification-631
• Exit gate: release-only package gates; formal [P0][Quality]: Gate no-fallback retrieval against 0.32, beta.4, pinned Graphify, and control #631 qualification remains open and is not claimed
• Production LOC added: 0
• Production LOC removed: 0
• Net production LOC: 0
• Superseded paths deleted: none; this is an approved release-only candidate

Reset scope checks

• This PR is governed by accepted RFC [RFC]: Madar Core Reset — narrow TypeScript semantic-path engine #577
• Approved reason to add release metadata: exact beta.6 owner authorization
• No permanent fallback or parallel implementation was added
• No evaluation-repository-specific production logic was added under src/
• Production does not import development-only evaluation tooling
• The removal manifest and scorecard were updated

Checklist

• User-visible release docs are updated
• Governance and release tests are updated
• No private corpora, secrets, credentials, proprietary prompts, sensitive raw logs, or accidental generated artifacts are included
• The PR is focused on the beta.6 release candidate

Related issues

Tracks #631 and #629. Formal #631 qualification remains open.

Summary by CodeRabbit

• Release

  • Updated the package to version 0.40.0-beta.6.
  • Authorized beta.6 publication on the npm next channel for corrective manual testing.
  • Updated package verification and release checks for the new beta version.

• Documentation

  • Updated changelog, README, release guidance, roadmap, and status documentation to reflect beta.6.
  • Clarified that stable release, comparative evaluation, and broader publication remain restricted.

• Testing

  • Updated governance and release-hygiene checks for beta.6 metadata and package integrity.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 63d4f7ec-7120-42f2-aafa-e5a47257eaa5

📥 Commits

Reviewing files that changed from the base of the PR and between 6872916 and a8c8455.

📒 Files selected for processing (17)

• .github/scripts/verify-forbidden-release-artifacts.mjs
• .github/scripts/verify-packed-retrieval-parity.mjs
• .github/workflows/release.yml
• CHANGELOG.md
• README.md
• docs/claims-and-evidence.md
• docs/core-reset/removal-manifest.yml
• docs/core-reset/scorecard.md
• docs/designs/2026-07-19-core-reset.md
• docs/mcp-registry/server.json
• docs/release.md
• docs/roadmap.md
• package-lock.json
• package.json
• sbom.cdx.json
• tests/unit/core-reset-governance.test.ts
• tests/unit/release-hygiene.test.ts

---

📝 Walkthrough

Walkthrough

This PR advances the authorized corrective prerelease from 0.40.0-beta.5 to 0.40.0-beta.6. It updates package metadata, release controls, Core Reset governance records, package verification logic, documentation, and tests.

Changes

Beta.6 corrective release

Layer / File(s)	Summary
Release identity and publication controls .github/workflows/release.yml, package.json, package-lock.json, sbom.cdx.json, docs/mcp-registry/server.json, CHANGELOG.md, README.md, docs/release.md	Release metadata, workflow validation, artifact digests, registry metadata, and release references now target beta.6.
Corrective candidate governance docs/core-reset/removal-manifest.yml, docs/core-reset/scorecard.md, docs/designs/2026-07-19-core-reset.md, docs/claims-and-evidence.md, docs/roadmap.md	Governance records describe beta.5 history, beta.6 authorization, package measurements, publication restrictions, and pending qualification.
Release and package verification .github/scripts/verify-forbidden-release-artifacts.mjs, .github/scripts/verify-packed-retrieval-parity.mjs	Forbidden-artifact self-tests use beta.6 fixtures. Package parity checks prioritize the corrective release candidate before fallback candidates.
Governance and release validation tests/unit/core-reset-governance.test.ts, tests/unit/release-hygiene.test.ts	Tests validate beta.6 metadata, authorization records, governance restrictions, package measurements, and publication integrity.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• mohanagy/madar#631 — The PR updates the beta.6 package and governance data required for installed-package qualification.

Possibly related PRs

• mohanagy/madar#636 — This PR is a corrective follow-up that advances the same release scripts, workflow, documentation, and tests to beta.6.
• mohanagy/madar#637 — Both PRs support corrective package fallbacks and release-governance receipt handling.
• mohanagy/madar#635 — Both PRs modify package-candidate handling in verify-packed-retrieval-parity.mjs.

Suggested labels: roadmap, type:docs, core-reset

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the beta.6 release preparation and the intended npm next publication channel.
Description check	✅ Passed	The description covers the change, testing, Core Reset contract, scope checks, checklist, and related issues with sufficient detail.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/release-0.40.0-beta.6

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

Independent exact-head release-safety review — PASS, no content or implementation blocker

Reviewed candidate head a8c8455bfe732a07b5d374cad7900de1977189e3, tree ff57246a55e51459836946d6b5b9853d0cdcc372, against protected-next parent 68729161699b7592bea6984e1aa22c7b4b0833e8.

Verified:

• release-only diff; no production or evaluator source change and no dependency change
• exact beta.6 artifact receipt and package ceilings
• protected next ruleset: PR-only, squash-only, six strict checks, resolved threads, no force-push or deletion
• trusted-publishing workflow is the only publication path
• beta.6 version is absent; npm next remains beta.5 and latest remains 0.32.0
• no beta.6 tag or GitHub Release; no Registry publication or main action
• local release, Registry, typecheck/build, packed parity, isolation, audit/signature, and focused governance gates pass

This review does not waive any merge gate. Merge remains forbidden until all six exact-head CI jobs are green, CodeRabbit reaches a final honest disposition with no actionable blocker, zero review threads remain, and the final live collision/branch/exclusion checks are repeated.

[mohanagy]

CodeRabbit exact-head disposition

CodeRabbit completed on a8c8455bfe732a07b5d374cad7900de1977189e3 with status SUCCESS and stated: “No actionable comments were generated.” It did run against all 17 changed files; this is not a non-default-base skip.

Its summary includes one non-blocking docstring-coverage warning. That warning does not identify a correctness, security, release, or contract defect: this release-only PR adds no production API or production source, and adding docstrings to governance/test/release helpers would widen the exact authorized release diff without product value. No code change is warranted.

Review-thread query at this head reports 0 total / 0 unresolved threads. CI remains independently gated; merge still waits for all six required jobs.

[mohanagy]

Independent exact-head packed-runtime review — PASS, no blocker

Reviewed a8c8455bfe732a07b5d374cad7900de1977189e3 / tree ff57246a55e51459836946d6b5b9853d0cdcc372.

• No src/**, graph/index/query, schema, dependency, build-config, or retrieval-budget drift from fix(retrieval): close beta.5 fallback gaps #637.
• Checkout MCP, installed MCP, CLI, and direct runtime packed parity passed.
• Exact package is 102 files / 155,257 packed / 653,996 unpacked bytes; shasum, integrity, and tarball SHA-256 match the sealed receipt and every ceiling passes.
• Installed-package GoValidate incident is ready 7/7 at 3,981 tokens; the control is ready 7/7 at 3,977 tokens with identical packed flow/evidence.
• Packed MCP preserves the fix(retrieval): close beta.5 fallback gaps #637 client guidance to answer from the dossier and avoid repository-tool fallback.
• Focused tests 143/143, typecheck, release hygiene, Registry validation, forbidden-artifact probes, and packed parity pass.

No files were edited during review. This is a content review only; the protected merge still requires the separate CI, CodeRabbit, exact-head, and zero-thread gates.

[mohanagy]

Publication complete

@lubab/madar@0.40.0-beta.6 is public under npm next from protected-next merge 66b795e76a76c6946b85e5eb878e3f576b4e3dbb, preserving reviewed tree ff57246a55e51459836946d6b5b9853d0cdcc372.

The release workflow is fully green on attempt 2: https://github.com/mohanagy/madar/actions/runs/30746816714. Attempt 1 published once with Trusted Publishing/provenance, then encountered a temporary npm attestation-endpoint propagation 404. Attempt 2 explicitly detected the immutable version as already public, did not republish, and passed final artifact, dist-tag, provenance, and signature verification.

Exact tarball SHA-256: 12d8abe1ac3d0945c654f4df2582ac1de63f2aeee55d82d4bf5b053d92036074. npm tags remain next=0.40.0-beta.6 and latest=0.32.0. No GitHub Release, Registry publication, git tag, or main update was created.

Durable tracking receipts: #631 and #629 remain open; this publication does not claim final qualification.