Code Mower v1.6.0

Code Mower v1.6.0 Release Notes

v1.6.0 improves operational clarity and adds the minimum metadata-only
telemetry needed to observe work requested through the basic private-workspace
Slack control surface. It does not add Slack-to-Board links, rich interactive
cards, per-user analytics, orchestration authority, or a new background
service.

What changed

• Doctor results are consistent and scoped. Human-readable warnings now
  agree with their JSON state, hosted-only posture does not appear in an
  ordinary local adoption check, and remediation names the command that can
  establish the missing evidence (#1064 / #1099).
• Managed Board replacement is atomic and truthful. Replacement captures
  the prior definition, applies the new one once, and reconciles the actual
  definition, supervisor, process, listener, repository, arguments, and version.
  It reports success only when the new binding is proved, reports rollback only
  when the previous binding is proved, and otherwise returns one recovery action
  (#1082 / #1100, hardened by #1103).
• Board inventory identifies the process the current CLI is operating.
  board list --repo includes only listeners whose identity verifies the
  repository. Board inventory and lane status expose invoking, serving,
  installed, managed-service, and restart state consistently. Stale managed
  services and verified transient Boards receive exact restart or promotion
  commands (#1063 / #1109).
• Unmanaged pull requests remain observable. An ordinary pull request with
  no Code Mower provenance is neutral unmanaged; the Board and lane status
  preserve its readable pull-request and gate state. A visible malformed Code
  Mower claim remains actionable and fail-closed (#1083 / #1097).
• Adoption diagnostics are share-safe by default. Concise, advanced, and
  JSON adoption reports omit private local paths and identifiers unless the
  operator explicitly selects the local-only view (#1084 / #1102).
• The Slack control surface has a closed lifecycle summary. The additive
  code_mower.controlSurfaceSessionSummary.v1 event carries bounded state,
  lifecycle reason, operation counts, owner-action class, pull-request presence,
  terminal duration, and normalized usage availability. It carries no command
  or message prose, answers, source, diffs, prompts, transcripts, response URLs,
  Slack identities, credentials, private paths, graph data, or raw provider
  output (#921 / #1098).
• Emission remains capability-gated. A client emits only after the hosted
  service advertises the exact contract version and fixture-manifest digest.
  It emits the first observation and meaningful transitions while suppressing
  timestamp-only polling and changing nonterminal elapsed-time or usage samples.
  Old clients remain compatible and an unrecognized hosted capability fails
  closed.
• Cross-repository cost coverage is isolated and attributable. Shared
  builder and reviewer ledgers separate explicitly different repositories, and
  a pre-PR builder record links only when its branch exactly matches one fetched
  pull request. Missing, ambiguous, malformed, and same-repository unattributable
  evidence remains fail-closed. The change adds no upload fields and exports no
  subscription access, elapsed time, token counts, source, diffs, prompts,
  transcripts, issue bodies, raw output, credentials, or local paths
  (#1106 / #1108).
• Audit-comment history is bounded and complete. Local audits, hosted
  labelers, lane status, gate health, and the generated gate share one
  payload-aware reader. It reduces page size and restarts safely, proves a
  stable terminal page, and fails closed on oversized items, exhausted budgets,
  omissions, duplicate or changed IDs, and incomplete history. Lineage controls
  are recognized only as exact standalone HTML comments outside fenced
  Markdown; explanatory prose is ignored while malformed controls from trusted
  authorities remain fail-closed (#1104 / #1107).

Upgrade

Install or upgrade one stable tool environment, then confirm its identity:

uv tool install --python 3.12 --reinstall --refresh-package code-mower \
  code-mower==1.6.0
code-mower --version
code-mower doctor --adoption --repo OWNER/REPO --concise

Existing repositories should preview code-mower migration setup-drift before applying generated files. See Install and Bootstrap and the v1.6.0 qualification contract.

Published identity and qualification

• Release source: ac585cb65ab910a48866ae784e09dab193dc8ec6
• Release PR: #1110; exact reviewed head 98eea9a793cd3e2739175016693d2e447b852ac8
• Independent exact-head Claude and Codex audits: PASS with no P0/P1/P2 findings
• Immutable candidate: 35679417608, first attempt
• No-publish verification: 38681139801, PASS
• Production PyPI publication: 38681220409, PASS
• Wheel SHA-256: 3dfa8ac0c5c72fce2d18c186153820e97e01ad35ac756cccf665b5f0e59f4698
• Source distribution SHA-256: 58165ebc84eb31f6444d7865d2b803e782f21cd168b7fa3cb08b493b77346ce4
• PyPI wheel and source distribution match the retained candidate byte-for-byte.
• Candidate qualification covered Python 3.12–3.14, fresh install, v1.5.2 upgrade and digest-bound rollback, uninstall preservation, Graphify, Board, basic Slack, audit-history hardening, privacy, capability gating, and two independent installation/adoption passes.
• The accepted bounded private Slack canary emitted 10 meaningful metadata-only transitions. Hosted totals matched the exact delta, the Board exposed one complete final terminated projection, every durable attempt had a receipt, aggregate freshness was current, provider exit was independently reconciled, and settled usage was 0.0 ACU. The campaign was disabled and production safety flags were restored.
• The unchanged candidate completed the required 24-hour post-canary soak at 2026-10-15T01:33:41Z.
• Canonical PyPI reinstall: PASS on Python 3.12 with caches and ambient package indexes disabled; package identity, all v1.6 release documents, easy initialization, offline fail-closed Slack readiness, and the 28-step/10-check first-user package rehearsal passed.
• Sanitized canary evidence manifest SHA-256: 53be3acd28714a60091606ef271dfb9f53507214a3686b006e433195bc06800c.
• Release-event verification: 38681598190, PASS; both publication jobs remained disabled.