chore(release): prepare 0.40.0-beta.7

[mohanagy]

Summary

Prepare exactly @lubab/madar@0.40.0-beta.7 for npm dist-tag next from protected-next corrective anchor e84d266734344397eec9a6bcd2e1a3a5070dc3ea, tree 5ffed3bc25cb537aafd3bb905ed9df08a7143d69.

Owner authorization is recorded on #631 and #629.

This is release/governance preparation only: exactly 17 existing metadata, documentation, workflow, and test paths; no src/**, evaluation source, dependency, graph/index/query, CLI, MCP, schema, or retrieval-budget change.

Exact merge candidate

• Head: e1f94f0a839867f6f6ab2d56196872c65010726d
• Tree: e93074eb7065878c7c1529c48aafe938cf731b04
• Sole release-branch base: protected next anchor e84d266734344397eec9a6bcd2e1a3a5070dc3ea
• Package: 102 files / 155,339 packed bytes / 654,026 unpacked bytes
• shasum: 1aafe5952aea2f353711d5af36fa564a147312f5
• integrity: sha512-K5CEUr2lRR1IoNCS9O74jMA7PDDgQMkdx3QM/cF+h17jyAj6Gt3Gpk8vkzKSz7SKFR44KgpnJeLkV5lXyzdgYw==
• tarball SHA-256: f4b33dacda9261eb0af8fa9302d5e51dd47e07235a7af9072b4dbfe5a50a21ca

The checked-in CycloneDX SBOM was freshly generated under npm 12.0.1; its UUID/timestamp are post-PR-641 and covered by a freshness regression. The release checklist now requires Node.js 22.22.3 or newer within Node 22, pins npm 12.0.1, generates the SBOM before the test gate, and regression-tests that ordering.

Local gates

• release hygiene, Registry validation, forbidden-artifact fail-closed and live absence checks: pass
• typecheck, production build, evaluation build: pass
• full coverage: 83 files / 958 tests; 85.7% statements, 79.96% branches, 92.02% functions, 89.07% lines
• focused governance/release/isolation: 35/35 pass
• portable benchmark: 14/14 ready; 100 warm samples, p95 4.011 ms
• packed retrieval parity and fresh install/version/generate smoke: pass
• isolation: 44 production TypeScript files / 15,871 LOC; zero forbidden evaluation paths/imports
• npm audit: 0 vulnerabilities; 75 verified signatures; 27 verified attestations
• exact-head independent reviews: governance, semantic, and test review all PASS with no blocker on e1f94f0a839867f6f6ab2d56196872c65010726d

Review corrections

CodeRabbit identified that the checklist originally generated the SBOM after the tests. That finding was verified, minimally fixed, answered, and its thread resolved. Independent review then identified the missing npm 12 compatible-Node prerequisite and stale PR candidate metadata. Both were corrected in the current exact head/body. No blocker was waived; all six exact-head CI jobs and all three independent review axes now pass.

Merge and publication gate

Target is protected next only. Squash merge is permitted only if this exact head has all six required CI jobs green, independent review finds no blocker, CodeRabbit is disposed honestly, and zero unresolved review threads remain. The protected-next release workflow is the publication boundary and publishes only beta.7 under npm next through OIDC Trusted Publishing.

#631 remains open and unqualified. This PR does not authorize or claim stable/latest, a GitHub Release, MCP Registry publication, a git tag, comparative qualification, provider traffic/spend, main, or any product-semantic change.

Summary by CodeRabbit

• New Features

  • Added terminal-language improvements for finished-report and done-report questions.
  • Preserved the complete authenticated response flow for these scenarios.
  • Updated the package to version 0.40.0-beta.7 as an authorized, unpublished manual-test candidate.

• Documentation

  • Updated release notes, roadmap, registry metadata, and package references.
  • Documented beta.7’s manual-testing status and pending qualification.

• Tests

  • Expanded validation for beta.7 packaging, artifacts, release checks, and qualification metadata.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR advances the release from beta.6 to beta.7. It updates package metadata, release verification, terminal-language receipt lookup, governance records, documentation, SBOM data, and unit tests.

Changes

Beta.7 release preparation

Layer / File(s)	Summary
Package identity and release verification package.json, package-lock.json, sbom.cdx.json, .github/workflows/release.yml, .github/scripts/*, docs/release.md, docs/mcp-registry/server.json, CHANGELOG.md, README.md, tests/unit/release-hygiene.test.ts	Release metadata, workflow authorization, npm artifact hashes, SBOM references, package receipt lookup, documentation, and hygiene tests now target beta.7.
Authorization and governance records docs/core-reset/removal-manifest.yml, docs/core-reset/scorecard.md, docs/designs/2026-07-19-core-reset.md, docs/claims-and-evidence.md, docs/roadmap.md, tests/unit/core-reset-governance.test.ts	Governance records and assertions document the merged terminal-language correction, beta.7 manual-test authorization, pending publication, and unqualified status.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• mohanagy/madar#631: The beta.7 package is prepared for the installed-package retrieval-parity and qualification work described by this issue.

Possibly related PRs

• mohanagy/madar#641: Supplies the terminal-language corrective recorded in the beta.7 release state.
• mohanagy/madar#637: Introduced related package-receipt fallback logic extended by this PR.
• mohanagy/madar#628: Updated successive prerelease workflow authorization and npm artifact verification.

Suggested labels: roadmap, type:docs, core-reset

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies preparation of the 0.40.0-beta.7 release.
Description check	✅ Passed	The description documents the release scope, testing evidence, Core Reset constraints, publication limits, and related issues in sufficient detail.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/release-0.40.0-beta.7

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/unit/release-hygiene.test.ts`:
- Around line 131-145: Update the release procedure in docs/release.md to pin
npm CLI version 12.0.1 before invoking npm sbom, then generate the SBOM before
running npm run test:run. Ensure the documented order produces the beta.7
metadata required by the release-hygiene test.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 111cb80e-4041-4a94-99d2-7ab13d398ddb

📥 Commits

Reviewing files that changed from the base of the PR and between e84d266 and 1fed2c9.

📒 Files selected for processing (17)

• .github/scripts/verify-forbidden-release-artifacts.mjs
• .github/scripts/verify-packed-retrieval-parity.mjs
• .github/workflows/release.yml
• CHANGELOG.md
• README.md
• docs/claims-and-evidence.md
• docs/core-reset/removal-manifest.yml
• docs/core-reset/scorecard.md
• docs/designs/2026-07-19-core-reset.md
• docs/mcp-registry/server.json
• docs/release.md
• docs/roadmap.md
• package-lock.json
• package.json
• sbom.cdx.json
• tests/unit/core-reset-governance.test.ts
• tests/unit/release-hygiene.test.ts

[mohanagy]

Exact-head merge-gate receipt

• Target: protected next only
• Authorized base: e84d266734344397eec9a6bcd2e1a3a5070dc3ea, tree 5ffed3bc25cb537aafd3bb905ed9df08a7143d69
• Exact reviewed head: e1f94f0a839867f6f6ab2d56196872c65010726d
• Exact reviewed tree: e93074eb7065878c7c1529c48aafe938cf731b04
• CI: all six required exact-head jobs succeeded in https://github.com/mohanagy/madar/actions/runs/30762212923
• Independent review: governance, semantic, and test review each PASS with no blocker on the exact head/tree
• CodeRabbit: SUCCESS. Its one actionable finding about SBOM/test ordering was verified, minimally fixed, answered, and resolved; the later independent Node prerequisite/stale-metadata findings were also fixed and re-reviewed
• Review threads: 1 total, 0 unresolved
• Scope: exactly 17 authorized release/governance/test paths; no production or evaluation source changes
• Artifact: unchanged at 102 files / 155,339 packed bytes / 654,026 unpacked bytes; shasum 1aafe5952aea2f353711d5af36fa564a147312f5; tarball SHA-256 f4b33dacda9261eb0af8fa9302d5e51dd47e07235a7af9072b4dbfe5a50a21ca
• Protected-next ruleset: active, PR required, squash only, exact six checks required, resolved threads required, force-push and deletion prohibited

All authorized merge gates pass. #631 and #629 remain open and unqualified. This receipt authorizes no stable/latest, GitHub Release, MCP Registry publication, git tag, main, or comparative qualification.

[mohanagy]

Beta.7 publication completion receipt

Exactly @lubab/madar@0.40.0-beta.7 is public under npm dist-tag next.

Merge and review:

• Release PR: chore(release): prepare 0.40.0-beta.7 #642
• Authorized protected-next anchor: e84d266734344397eec9a6bcd2e1a3a5070dc3ea, tree 5ffed3bc25cb537aafd3bb905ed9df08a7143d69
• Exact reviewed head: e1f94f0a839867f6f6ab2d56196872c65010726d
• Exact reviewed tree: e93074eb7065878c7c1529c48aafe938cf731b04
• Exact-head CI: all six required jobs succeeded in https://github.com/mohanagy/madar/actions/runs/30762212923
• Independent exact-head governance, semantic, and test reviews: PASS, no blocker
• CodeRabbit: SUCCESS; its one actionable SBOM/test-order finding was fixed, answered, and resolved; zero unresolved threads
• Protected squash merge: d52fec4f0bb7aedcb7e9519ce258b2606122046c
• Sole merge parent: authorized anchor e84d266734344397eec9a6bcd2e1a3a5070dc3ea
• Merged tree: e93074eb7065878c7c1529c48aafe938cf731b04, identical to the reviewed tree

Publication:

• Protected-next release workflow: https://github.com/mohanagy/madar/actions/runs/30762745297
• Exact workflow SHA: d52fec4f0bb7aedcb7e9519ce258b2606122046c
• Result: all release gates succeeded, one Trusted Publishing publication, and post-publish artifact/dist-tag/provenance/signature verification succeeded
• Published at: 2026-08-02T19:22:21.127Z

Exact public artifact:

• 102 files / 155,339 packed bytes / 654,026 unpacked bytes
• npm shasum: 1aafe5952aea2f353711d5af36fa564a147312f5
• integrity: sha512-K5CEUr2lRR1IoNCS9O74jMA7PDDgQMkdx3QM/cF+h17jyAj6Gt3Gpk8vkzKSz7SKFR44KgpnJeLkV5lXyzdgYw==
• independently downloaded tarball SHA-256: f4b33dacda9261eb0af8fa9302d5e51dd47e07235a7af9072b4dbfe5a50a21ca
• fresh install reports 0.40.0-beta.7; fresh one-file TypeScript generation completed with 9 nodes / 9 edges
• fresh audit: 0 vulnerabilities
• signature audit: 3 packages with verified registry signatures; beta.7 has a verified provenance attestation
• npm tags: next=0.40.0-beta.7; latest=0.32.0

Forbidden outcomes remain absent: no stable/latest publication, GitHub Release, MCP Registry publication, git tag, or main update. main remains 647c2912e9ff000b5d92cae3fc61395d9e556062; the latest MCP Registry publication workflow remains the July 28 run.

This is a beta publication receipt only. It does not qualify or close #631 or #629; both remain open and unqualified.