# v0.0.18 Release Evidence

Status: historical release ledger with post-release parity audit
Release date: 2026-04-12
Last audited against repo: 2026-04-13

## Scope

Tracks the `0.0.18` release-prep and post-merge CI-repair gates for the repo state after the GitHub-published `v0.0.17` release, including version alignment, changelog/docs refresh, packaging outputs, website-sync readiness, and release/distribution handoff evidence for GitHub release, npm, and Chrome extension distribution.

## Baseline comparison

- Reference release: GitHub `v0.0.17`
  - URL: `https://github.com/freshtechbro/opendevbrowser/releases/tag/v0.0.17`
  - Published: `2026-03-14T02:35:18Z`
  - Target: `main`
  - GitHub assets:
    - `opendevbrowser-extension.zip`
    - `opendevbrowser-extension.zip.sha256`
- GitHub release notes for `v0.0.17` called out PRs `#7`, `#8`, and `#9`.
- Current `0.0.18` delta is based on the merged `main` line after `v0.0.17`, with first-parent PR merges `#10` through `#14`.

## Release summary

- Generated public-surface manifests, onboarding metadata, and direct-run release probes now back generated help, docs parity, release evidence, and mirrored website inputs.
- Canvas/runtime delivery is stronger than the original `v0.0.17` ship, with adapter-plugin validation, starter or inventory flows, framework-adapter code sync, review/session-inspector surfaces, and extended extension-editor coverage.
- Public read-only desktop observation now ships as a sibling runtime with dedicated audit and permission checks while staying outside the public relay or `/ops` plane.
- Release/distribution operations are tighter across GitHub artifacts, npm packaging, Chrome Web Store prep, and private-site sync triggers.

## Current repo note

- Historical CI-repair branches: `codex/release-0-0-18-fix` through `codex/release-0-0-18-fix-4`
- Final release source branch: merged `main`
- Final release source commit: `e6f2aac7e860e8fa2799df19f4243028385c2f2b`
- Final GitHub release workflow: `https://github.com/freshtechbro/opendevbrowser/actions/runs/24323858422`
- Release tag already pushed: `v0.0.18`
- Local version authority is `package.json` at `0.0.18`; extension version owners stay synced via `npm run extension:sync`.
- Release-version sweep confirmed `0.0.18` across active version owners and current-cycle docs. `tsconfig.json` and `eslint.config.js` contain no release-version strings, so they were reviewed and left unchanged.

## Mandatory release gates

- [x] `npm run extension:sync`
  - Result: synced `extension/manifest.json` and `extension/package.json` to `0.0.18`
- [x] `npm run version:check`
  - Result: passed with root + extension version owners aligned at `0.0.18`
- [x] `node scripts/audit-zombie-files.mjs`
  - Result: `{"ok":true,"scanned":915,"flagged":[]}`
- [x] `node scripts/docs-drift-check.mjs`
  - Result: passed; current generated source counts confirmed as `72` CLI commands, `65` tools, `59` `/ops`, and `35` `/canvas`
- [x] `node scripts/chrome-store-compliance-check.mjs`
  - Result: passed
- [x] `./skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh`
  - Result: passed
- [x] `npx opendevbrowser --help`
  - Result: generated successfully; output length `590` lines
- [x] `npx opendevbrowser help`
  - Result: generated successfully; output length `590` lines and matched `--help` via `cmp`
- [x] `npm run lint`
  - Result: passed
- [x] `npm run typecheck`
  - Result: passed
- [x] `npm run build`
  - Result: passed
- [x] `npm run extension:build`
  - Result: passed
- [x] `npm run test:release-gate`
  - Result: all `5` release-gate groups passed
- [x] `npm run test`
  - Result: passed on the post-merge CI-repair branch from `origin/main`; coverage remained above the required `97%` branch threshold

## Post-merge CI repair summary

- `scripts/cli-onboarding-smoke.mjs`
  - `loadQuickStartGuide` now accepts an injected `SkillLoaderCtor`, so tests no longer require a prebuilt `dist/skills/skill-loader.js`.
- `tests/daemon-autostart.test.ts`
  - Linux temp-dir fixture now lives under `tmpdir()` instead of `resolve(tmpdir(), "..")`.
- `tests/desktop-runtime-audit.test.ts`, `tests/desktop-runtime-permission.test.ts`
  - macOS-only `/usr/sbin/screencapture` assumptions are now injected through `statImpl`.
- `tests/system-chrome-cookies.test.ts`
  - direct SQLite assertion now uses the explicit Darwin path in the test helper, and the Linux-fragile wrapper warning expectation was removed.
- `scripts/login-fixture-live-probe.mjs`
  - direct-execution guard prevents `main()` from running on import during tests.
- `src/providers/workflows.ts`
  - refreshed generic retailer titles such as `Amazon.com` are now treated as marketplace chrome instead of overwriting a valid product title.
- `tests/desktop-runtime-audit.test.ts`, `tests/desktop-runtime-permission.test.ts`
  - follow-up success-path capture tests now stub `statImpl` for `/usr/sbin/screencapture`, so Linux CI exercises the mocked capture path instead of the host filesystem.
- Supporting regression coverage was added in:
  - `tests/cli-onboarding-smoke-script.test.ts`
  - `tests/providers-product-video-workflow.test.ts`

## Packaging gates

- [x] `npm run extension:pack`
  - Result: `opendevbrowser-extension.zip` generated successfully
- [x] `npm pack`
  - Result: `opendevbrowser-0.0.18.tgz` regenerated successfully from the final post-fix tree during `prepack` validation/build flow

## Repo sanity checks

- [x] `git diff --check`
  - Result: passed
- [x] `git status --short`
  - Result: only intended release-prep files remain modified; generated artifacts stay ignored

## Artifacts

- [x] Local pre-release `opendevbrowser-extension.zip`
  - Size: `173853` bytes
  - SHA-256: `9b3569bef1888b5e9b18a7e48cf44629856b130b73d669c99350f348f2801c76`
- [x] Published GitHub release asset `opendevbrowser-extension.zip`
  - URL: `https://github.com/freshtechbro/opendevbrowser/releases/download/v0.0.18/opendevbrowser-extension.zip`
  - Size: `173853` bytes
  - SHA-256: `8ee50198ec2043ac5b02bec7338a640e7daf3567ecce47279f9f76ae6432c3b8`
- [x] Published GitHub release checksum `opendevbrowser-extension.zip.sha256`
  - URL: `https://github.com/freshtechbro/opendevbrowser/releases/download/v0.0.18/opendevbrowser-extension.zip.sha256`
  - Contents: `8ee50198ec2043ac5b02bec7338a640e7daf3567ecce47279f9f76ae6432c3b8  opendevbrowser-extension.zip`
- [x] `opendevbrowser-0.0.18.tgz`
  - Size: `1724897` bytes
  - SHA-1 (`npm pack` / `shasum`): `4a56110d586d974f8c3420493d856470de8b286d`
  - Integrity (`npm pack --json`): `sha512-n0QByy9noOaHxQpePG2Yhdud9CQErVfTlCaiyv35OznOmK6Jk3E+2vswzbkQ62WpTSv3H2+01ZXqZ3dZVqrceg==`

## Optional release-environment gates

- [x] `node scripts/provider-direct-runs.mjs --release-gate --out artifacts/release/v0.0.18/provider-direct-runs.json`
  - Result: rerun on the rebased final candidate; strict gate exited non-zero because non-pass lanes remain, but the artifact recorded `19` pass, `11` env_limited, `0` fail, `0` skipped
  - Environment-limited lanes: community challenge shells, JS-required/social verification shells, policy-blocked posting probes, Costco env limits, Temu timeout, and generic `others` shopping fallback
- [x] `node scripts/live-regression-direct.mjs --release-gate --out artifacts/release/v0.0.18/live-regression-direct.json`
  - Result: rerun on the rebased final candidate with the extension connected; artifact recorded `6` pass, `0` env_limited, `0` fail, `2` skipped and returned overall `ok=true`
  - Pass lanes: daemon preflight, `feature.canvas.managed_headless`, `feature.canvas.managed_headed`, `feature.canvas.extension`, `feature.canvas.cdp`, and `feature.cli.smoke`
  - Skipped lanes: `feature.annotate.relay` and `feature.annotate.direct` (`manual_probe_boundary_observed:*_annotation_timeout`)
- [x] First-run onboarding dry run from `docs/FIRST_RUN_ONBOARDING.md`
  - Result: isolated temp-home install from the packed `0.0.18` tarball succeeded, `--help` and `help` matched, `opendevbrowser version` reported `opendevbrowser v0.0.18`, `--global --full --no-prompt` succeeded, extension assets extracted under the isolated home, daemon start/status passed, and the managed launch/goto/snapshot/disconnect happy path completed
  - Expected note observed: transient temp-workspace install warned that daemon autostart repair was skipped because the CLI path was transient

## Deferred artifacts

- [x] `artifacts/release/v0.0.18/provider-direct-runs.json`
- [x] `artifacts/release/v0.0.18/live-regression-direct.json`

## External release workflow evidence

- [x] Release workflow failure evidence
  - Run: `https://github.com/freshtechbro/opendevbrowser/actions/runs/24322225760`
  - Workflow: `Public Release`
  - Head: `v0.0.18` -> `f001dac9cd7fdcc60ce3a6384f76985d3e7c039e`
  - Result: failed during the pre-publish `npm run test` gate; the CI-only owner failures patched on `codex/release-0-0-18-fix` came from this run
- [x] Release workflow rerun failure evidence
  - Run: `https://github.com/freshtechbro/opendevbrowser/actions/runs/24322765905`
  - Workflow: `Public Release`
  - Head: `main` -> `6a51954dfbe883797b270735c7a73e5ac1a375fb`
  - Result: failed during `Run release quality gates` after the first fix merged; both `tests/desktop-runtime-permission.test.ts:302` and `tests/desktop-runtime-audit.test.ts:306` still expected a successful capture result without stubbing the screencapture path check on Linux CI
- [x] Release workflow second rerun failure evidence
  - Run: `https://github.com/freshtechbro/opendevbrowser/actions/runs/24323004511`
  - Workflow: `Public Release`
  - Head: `main` -> `ad2262513c0a75a42e4b7969903a185d6f94dfac`
  - Result: failed during `Run release quality gates`; `tests/desktop-runtime-audit.test.ts` was fixed, but `tests/desktop-runtime-permission.test.ts:307` still used the unstubbed success path and returned `{ ok: false }` on Linux CI before the mocked `screencapture` call
- [x] Release workflow third rerun failure evidence
  - Run: `https://github.com/freshtechbro/opendevbrowser/actions/runs/24323350212`
  - Workflow: `Public Release`
  - Head: `main` -> `283c4387fc0dadff240c9528df3ff54d19503117`
  - Result: failed during `Run release quality gates`; the prior follow-up patched the unsupported-status case, but the actual screencapture success-path block in `tests/desktop-runtime-permission.test.ts:312` still lacked the Linux-safe `statImpl` stub
- [x] Release workflow fourth rerun failure evidence
  - Run: `https://github.com/freshtechbro/opendevbrowser/actions/runs/24323653032`
  - Workflow: `Public Release`
  - Head: `main` -> `e6f2aac7e860e8fa2799df19f4243028385c2f2b`
  - Result: `Run release quality gates`, `Pack extension artifact`, and `Compute extension checksums` all passed, but `Publish npm package` failed because `NODE_AUTH_TOKEN` was empty and the step exited with `NPM_TOKEN is required when publish_npm=true`; `Publish GitHub release` was skipped in that run
- [x] Release workflow final GitHub-release-only success evidence
  - Run: `https://github.com/freshtechbro/opendevbrowser/actions/runs/24323858422`
  - Workflow: `Public Release`
  - Head: `main` -> `e6f2aac7e860e8fa2799df19f4243028385c2f2b`
  - Inputs: `publish_npm=false`, `publish_github_release=true`, `draft_release=false`, `run_release_live_gates=false`
  - Result: `Run release quality gates`, `Pack extension artifact`, `Compute extension checksums`, and `Publish GitHub release` all succeeded; `Publish npm package` was intentionally skipped
- [x] GitHub release URL
  - URL: `https://github.com/freshtechbro/opendevbrowser/releases/tag/v0.0.18`
  - Verified via `gh release view v0.0.18 --json url,isDraft,tagName,targetCommitish,publishedAt,name`
  - Published: `2026-04-13T03:14:55Z`
  - Target: `main`
- [x] npm publish verification
  - `npm view opendevbrowser version` now returns `0.0.18`
  - Local npm auth is available for manual publish operations: `npm whoami` -> `bishopdotun`
  - Workflow-based npm publish remains blocked until the public repo gets `NPM_TOKEN`
- [x] Chrome Web Store publish blocker evidence
  - Run: `https://github.com/freshtechbro/opendevbrowser/actions/runs/24322237855`
  - Workflow: `Chrome Store Publish`
  - Result: failed before upload because repository secrets `CWS_CLIENT_ID`, `CWS_CLIENT_SECRET`, `CWS_REFRESH_TOKEN`, and `CWS_EXTENSION_ID` are absent
  - Secret inventory check: `gh secret list` currently returns only `PRIVATE_REPO_DISPATCH_TOKEN`
- [x] Private website sync dispatch evidence
  - Run: `https://github.com/freshtechbro/opendevbrowser/actions/runs/24322215822`
  - Workflow: `Dispatch Private Website Sync`
  - Head: `main` -> `f001dac9cd7fdcc60ce3a6384f76985d3e7c039e`
  - Result: completed successfully

## Notes

- This ledger is the historical `0.0.18` proof record with the appended parity audit.
- `docs/RELEASE_0.0.19_EVIDENCE.md` is now the active release-prep ledger.
- `docs/RELEASE_0.0.17_EVIDENCE.md` remains historical and should not be rewritten during later release prep.
- Historical proof from `codex/release-0-0-18-fix` remained green across the broader release gate set.
- Final `codex/release-0-0-18-fix-3` revalidation after the desktop permission test correction:
  - `node scripts/docs-drift-check.mjs`
  - `npm run lint`
  - `npm run typecheck`
  - `npm run test -- tests/desktop-runtime-permission.test.ts`
  - `npm run test`
  - `npm run build`
- Post-fix blocker closure for this release:
  - `feature.canvas.managed_headless` cleared after widening preview navigation fallback from `data:text/html` timeout into `setContent`/document-write recovery.
  - `feature.canvas.managed_headed` cleared after increasing managed-headed daemon launch budget to `60000ms`.
  - `feature.cli.smoke` cleared after removing the harness-only `review` timeout override of `15000ms`.
- Post-merge CI-only blocker closure for this release:
  - onboarding smoke no longer depends on built `dist`
  - daemon autostart test uses a Linux-safe tmp fixture
  - `tests/desktop-runtime-audit.test.ts` no longer assumes a macOS-only binary exists in CI
  - system Chrome cookie tests no longer assert Darwin-only behavior from Linux
  - login-fixture probe no longer exits the process when imported in tests
  - product-video title refresh now resists generic marketplace chrome
- Final external release closure for this cycle:
  - npm package is publicly visible at `0.0.18`
  - GitHub release `v0.0.18` is published with extension zip and checksum assets
  - Chrome Web Store remains the only unshipped distribution lane because the required `CWS_*` repository secrets are still absent
- Post-release parity investigation on `2026-04-13` confirmed the published npm tarball matched the release-aligned local packed tarball used during that audit, a fresh registry install succeeded, an isolated serial `npx --package` run succeeded, and the remaining alignment risk is semver-based consumer dependency drift rather than stale published source
- Release artifact note:
  - the published GitHub release zip checksum differs from the earlier local pre-release zip checksum because the public release workflow rebuilt the extension artifact in CI before upload
- Both strict live-gate scripts currently return non-zero when `env_limited` or `skipped` lanes remain, even with `0` true `fail` results. Release readiness should therefore be read from the recorded counts and scenario details, not the raw process exit code alone.
- Final rebased candidate status:
  - provider direct proof still contains honest `env_limited` lanes but no true failures
  - live regression proof is fully green apart from the two explicit manual annotation boundaries
