chore: release v0.7.90

[jrusso1020]

Summary

• publish HyperFrames v0.7.90 with the bounded video/HDR extraction fixes from fix: bound HDR and video extraction resources #2955
• prevent short compositions from decoding entire long sources, reserve concurrent raw-frame scratch against cgroup/disk limits, and clean resources on every exit path
• expose canonical outputDynamicRange: auto | hdr | sdr at the producer HTTP boundary while retaining the temporary legacy alias for a rolling migration
• include the catalog contribution guide refresh from docs(contributing): refresh the catalog contribution guide #2954
• include the reviewed release-integrity workflow from fix: require reviewed merge commits for stable releases #2959 so stable artifacts are cut only from this PR's exact merge commit and same-commit recovery is safe

Verification

• bun run test:scripts — 110 passed
• release-channel validation for release/v0.7.90 / latest
• end-to-end release-tag tests cover first creation, same-SHA retry, and mismatched-SHA rejection
• official two-phase release:prepare changelog review checkpoint and release commit hooks
• formatting, lint, and git diff --check

Release range

v0.7.89...bfd8037e5 contains #2954, #2955, #2959, and this release commit.

Release and rollout

Merging this reviewed release/v0.7.90 PR triggers the protected publish workflow. It checks out and verifies the exact merge SHA, creates v0.7.90 at that commit, publishes all packages to npm with the latest dist-tag, and creates the GitHub release.

After publication, update and deploy the HyperFrames producer fleet to v0.7.90 before deploying experiment-framework callers that send outputDynamicRange; the legacy hdrMode alias exists only to bridge that rolling deployment.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
hyperframes	🟢 Ready	View Preview	Aug 3, 2026, 3:29 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[miga-heygen]

Release v0.7.90 Review — 5138bb3a

Release range — CORRECT

v0.7.89...v0.7.90 contains exactly 2 content commits + 1 release commit:

1. 67ffafb1 — docs(contributing): refresh the catalog contribution guide (#2954)
2. 23397573 — fix: bound HDR and video extraction resources (#2955)
3. 5138bb3a — chore: release v0.7.90

No unintended commits.

Release notes — ACCURATE

Four fix bullets + one catalog bullet. All reference #2955 or #2954 correctly. The descriptions match the actual changes: bounded extraction, cgroup/disk scratch limits, resource cleanup, outputDynamicRange contract, catalog guide refresh.

Version bumps — COMPLETE

All 16 publishable artifacts bumped 0.7.89 → 0.7.90:

• 13 npm packages: @hyperframes/{aws-lambda, cli, core, engine, gcp-cloud-run, lint, parsers, player, producer, sdk, shader-transitions, studio, studio-server}
• 3 AI plugins: .claude-plugin, .codex-plugin, .cursor-plugin

@hyperframes/sdk-playground correctly stays at 0.6.106 ("private": true).

Publish pipeline — CORRECT

Merging release/v0.7.90 triggers: tag creation → npm publish with latest dist-tag → GitHub release. Standard protected release workflow.

Verdict: Approve.

— Miga

[vanceingalls]

R1 — mechanical release audit against head 5138bb3a4.

Axis 1 — commit range (PASS): v0.7.89...5138bb3a4 contains exactly 3 commits: #2954 (contributing guide refresh), #2955 (bounded HDR/video extraction + outputDynamicRange), and the release commit itself. No scope creep.

Axis 2 — version bumps (PASS): All 12 publishable packages at 0.7.90 (aws-lambda, cli, core, engine, gcp-cloud-run, lint, parsers, player, producer, sdk, shader-transitions, studio-server, studio). All 3 plugin manifests (.claude-plugin, .codex-plugin, .cursor-plugin) bumped 0.7.89 → 0.7.90. Private packages (sdk-playground, studio/frontend, e2e fixtures, root) correctly skipped. No stragglers.

Axis 3 — CHANGELOG accuracy (PASS with non-blocker): Both releases/v0.7.90.md and docs/changelog.mdx are consistent, cite both PRs, and capture the four #2955 bullets (bounded extraction, HDR raw-frame scratch reservation, held-tail engine fix, outputDynamicRange + legacy hdrMode alias). One nit — see follow-ups.

Axis 4 — release workflow (PASS): .github/workflows/publish.yml triggers on pull_request closed for release/v* heads merged to main, creates + pushes tag v0.7.90, publishes each package with --tag latest (no pre-release suffix in the version → dist_tag=latest), and creates the GitHub release from releases/v0.7.90.md. No --dry-run anywhere. CLI is correctly renamed to unscoped hyperframes before publishing. Idempotent on re-run (npm view skip + gh release view skip).

Spot-checks: no debug leftovers, no .env files, no private packages accidentally flipped to public.

Follow-up (non-blocker):

• CHANGELOG mentions "temporarily accepting the legacy hdrMode field for rolling migrations" but doesn't spell out the explicit HF-first-then-EF ordering that PR #2955's body documents (publish HF across full producer fleet before deploying experiment-framework PR #44255). Consider adding a one-liner to releases/v0.7.90.md so operators reading the release page see the ordering without hopping to the PR body.

Ship it.

— Via

[miguel-heygen]

The mechanical release audit is clean: v0.7.89..5138bb3a4 contains only #2954, #2955, and the release commit; the notes match those changes; all 13 npm artifacts and 3 plugin manifests are at 0.7.90.

One release-integrity blocker remains:

• [P1] Pin merged releases to the immutable merge SHA — .github/workflows/publish.yml:35-43, :82-88. On a merged pull_request/closed event, GitHub defines GITHUB_REF as the target branch (refs/heads/main), not the PR merge commit (event documentation). This workflow explicitly checks out that mutable branch and then creates v0.7.90 at the checked-out HEAD. If another PR merges after #2958 but before this job checks out, the tag, npm artifacts, and GitHub release come from that later main commit. That violates the requested v0.7.89...v0.7.90 range and the guarantee that the tag targets #2958's actual merge commit. Please use github.event.pull_request.merge_commit_sha for merged-PR runs (and github.sha for tag-push runs), or add an equivalent immutable-SHA checkout plus guard before tagging.

CI at the reviewed head has no failures, though Windows and regression shards are still running.

Audited: release range, release notes, package/plugin version ledger, and publish/tag/release workflow. Trusting the already-reviewed and merged implementation in #2954/#2955.

Verdict: REQUEST CHANGES

Reasoning: The release contents are correct, but the current publish path can tag and publish a different commit under normal concurrent merges, so the exact-release invariant is not yet enforced.

— Magi

[miga-heygen]

Release v0.7.90 Re-review — bfd8037e

Rebased onto merged #2959. Fresh verification against the exact current head.

Release range — CORRECT

v0.7.89...v0.7.90 contains exactly 3 content commits + 1 release commit:

1. 67ffafb1 — docs(contributing): refresh the catalog contribution guide (#2954)
2. 23397573 — fix: bound HDR and video extraction resources (#2955)
3. d6191965 — fix: pin release publishing to merge commit (#2959)
4. bfd8037e — chore: release v0.7.90

No unintended commits.

Release notes — ACCURATE

Four fix bullets (#2955), one rollout note (deploy ordering: producer fleet first, then EF callers), one catalog bullet (#2954), one internal bullet (#2959). All references correct.

The rollout section is new since the first review — correctly documents that HF v0.7.90 must be fully deployed before EF callers start sending outputDynamicRange.

Version bumps — COMPLETE

All 16 publishable artifacts bumped 0.7.89 → 0.7.90: 13 npm packages + 3 AI plugins. sdk-playground excluded (private: true).

Publish pipeline — NOW IMMUTABLE

With #2959 merged, merging this release PR triggers:

1. Checkout at merge_commit_sha (immutable)
2. Verify checkout SHA matches expected
3. Create tag v0.7.90 at the verified commit (idempotent, fail-closed on mismatch)
4. Publish to npm with latest dist-tag
5. Create GitHub release

Recovery: rerun the merged-PR workflow event. Tag creation is idempotent for the same commit.

---

Verdict: Approve.

— Miga

[vanceingalls]

Re-verified at HEAD bfd8037e5663a4508ac0c751206df5096e751d49 after rebase onto merged #2959 — all five axes clean.

Axis 1 — commit range v0.7.89..bfd8037 (4 commits, zero scope creep):

• 67ffafb11 docs(contributing): refresh the catalog contribution guide (#2954)
• 233975737 fix: bound HDR and video extraction resources (#2955)
• d6191965c fix: pin release publishing to merge commit (#2959) — matches #2959 merge commit
• bfd8037e5 chore: release v0.7.90

#2959 confirmed MERGED (2026-08-03T04:32:09Z, mergeCommit d6191965cf4d, by @jrusso1020).

Axis 2 — version bumps (13 publishable packages + 3 plugin manifests):
All 16 non-private version-carrying files at 0.7.90. Private packages (sdk-playground at 0.6.106, root monorepo, studio/frontend, e2e fixtures, remotion test-corpus) untouched as expected. No stragglers.

Axis 3 — releases/v0.7.90.md rollout order:

• HF-first line PASS: "Upgrade the HyperFrames producer fleet to v0.7.90 before deploying callers that send outputDynamicRange"
• EF-second line PASS: same sentence, "before deploying callers that send outputDynamicRange" covers the EF caller cohort
• hdrMode-alias line PASS: "the legacy hdrMode field remains accepted only to bridge the rolling deployment"
• docs/changelog.mdx consistent — same Rollout/Fixes/Catalog/Internal sections with the same rollout-order line.

The rollout-order follow-up from the prior verify is now landed in both the release notes and docs/changelog.mdx — closed.

Axis 4 — release workflow protections inherited from #2959 through the rebase:

• verify_remote_tag() function present in the Create-release-tag step of publish.yml: PASS
• Immutable checkout ref: ${{ env.EXPECTED_RELEASE_SHA }} + "Verify immutable release checkout" fail-closed step: PASS
• Guard-step assertions in scripts/publish-workflow.test.mjs: PASS — asserts config.on.push.tags === ["v*-*"], config.on.workflow_dispatch === undefined, checkoutGuard.if === undefined, verify_remote_tag() shape, startsWith(head.ref, 'release/v') gate
• validatePrereleaseTagPush unconditional reject for stable (expectedDistTag(version) === "latest" → "Stable tag publishing is disabled"): PASS
• on.workflow_dispatch absent: PASS
• on.push.tags: ["v*-*"] only (pre-release hyphen required): PASS
• on.pull_request.types: [closed] with branches: [main] and startsWith(head.ref, 'release/v') if-gate: PASS

Axis 5 — no scope creep from rebase:
Diff files (48) − union of #2954/#2955/#2959 (30) = 18 files, every one release-mechanical:

• 3 plugin manifests (.claude-plugin, .codex-plugin, .cursor-plugin)
• 13 publishable packages/*/package.json bumps
• docs/changelog.mdx
• releases/v0.7.90.md

Every union file is present in the diff; every non-union file is release-mechanical. Zero strays.

— Via

[miguel-heygen]

Exact-head re-review at bfd8037e5663a4508ac0c751206df5096e751d49 after rebasing onto merged #2959 — the release is internally consistent and the prior integrity blocker is closed.

• releases/v0.7.90.md:9 accurately captures the bounded extraction/HDR fixes, and releases/v0.7.90.md:14 now makes the producer-first, experiment-framework-second rollout order explicit while limiting hdrMode to the migration window. docs/changelog.mdx:18 carries the same operator-facing contract.
• .github/workflows/publish.yml:25 pins merged releases to the event's immutable merge SHA, .github/workflows/publish.yml:44 verifies that checkout unconditionally, and .github/workflows/publish.yml:86 creates or reuses v0.7.90 only when it resolves to that exact commit. The package and GitHub-release stages then consume the same verified checkout (.github/workflows/publish.yml:125, .github/workflows/publish.yml:192).
• The release ledger is complete: all 13 npm artifacts listed by the publish workflow (.github/workflows/publish.yml:152) and all three plugin manifests move from 0.7.89 to 0.7.90; private packages remain excluded.

Audited: the complete v0.7.89..bfd8037e5 commit graph; all 18 release-mechanical files introduced beyond the union of #2954/#2955/#2959; every package/plugin version; releases/v0.7.90.md; docs/changelog.mdx; and the inherited publish/validation/test workflow.

Trusting: the implementation internals already reviewed and merged through #2954, #2955, and #2959; I rechecked their presence and release integration, not every implementation line again.

Independent verification found exactly four commits in range (#2954, #2955, #2959, release), no unexplained files, an exact 13-of-13 match between non-private npm packages and the workflow's publish list, release-channel tests 10/10, clean syntax/diff checks, and byte-for-byte inheritance of #2959's hardened workflow/tests. The current primary CI, CodeQL, docs, performance, preview, build, test, typecheck, and CLI lanes are green. GitHub still displays a required regression failure from cancelled superseded run 30784843387; its replacement run 30784915611 and the replacement Windows run are in progress, with no current-run failures observed.

Verdict: APPROVE

Reasoning: The exact release contents, versions, notes, and rollout order agree, and stable tag/npm/GitHub release production is now anchored fail-closed to this reviewed PR's immutable merge commit. The only non-green required signal is stale output from a cancelled superseded run; fresh replacements are already running.

— Magi