Repository navigation

Release list

v0.3.46 Latest

Latest

Linux2010 released this 29 Oct 10:27

v0.3.46

2bccc47

@orion-agents/orion-code v0.3.46

Released 2026-10-29. Squash-merged PR #303 → main merge 2bccc47, tag v0.3.46.
npm published @orion-agents/orion-code@0.3.46 at 2026-10-29T10:25:59.871Z (dist-tag latest).

What changed

CHANGELOG: corrected the 0.3.45 delivery status from candidate to published (tagged v0.3.45, npm registry latest, npm publish timestamp and GitHub Release link backfilled).
docs: added docs/plan/evidence/v0.3.46/status-audit.md — a three-version (0.3.43–0.3.45) delivery-status audit cross-checking git tags, registry versions and the latest dist-tag, plus the v0.3.45 release facts (PR #302, merge 4216ab0, tag v0.3.45, registry latest=0.3.45).
README / README.zh-CN: header summary and install pin updated to 0.3.46.

No production code changes. This is the receipt-backfill / delivery-status-audit slice (PR4 automatable portion of the v0.3.27 review loop). The human-labeled paid quality benchmark and real Host + Chrome full-chain E2E remain honestly not_run (no model credentials in the automation environment).

CI gate (run 40851844422 — all green)

#	Job	Conclusion
1	Build the exact release tgz once	✅ success
2	Release gate (release:check)	✅ success
3	TypeScript type-check	✅ success
4	Dependency health report (offline)	✅ success
5	Lean Harness benchmark and confluence	✅ success
6	Node 26 verification	✅ success
7	Node 22 verification	✅ success
8	Node 24 verification	✅ success
9	Dependency security audit	✅ success
10	Web E2E full suite three consecutive runs	✅ success
11	Web E2E critical journey on Node 24.0.0 floor	✅ success
12	Web E2E critical journey on Node 26.0.0 floor	✅ success
13	Web E2E critical journey on Node 22.12.0 floor	✅ success
14	Exact tgz on Node 24.0.0 floor	✅ success
15	Exact tgz on Node 22.12.0 floor	✅ success
16	Exact tgz on Node 26.0.0 floor	✅ success
17	Aggregate exact-artifact Web E2E receipt	✅ success
18	Aggregate fail-closed v0.3.x release receipt	✅ success

Artifact integrity

Tarball: orion-agents-orion-code-0.3.46.tgz
SHA-256: 8957263be4d816f11870e95f57123ee8cc725d8e69bfad5f369a1e0921578a92
npm integrity: sha512-T+gezFqJefC/8PgHjZKSBKAQI7quxolUrsz3AzvLEjJw8DwxRyzmh+3kVgqFpNDMrxs+wsXU2ocBwL1OMwK6Cw==
CI Build the exact release tgz once recorded tarball sha256 8957263be4d816f11870e95f57123ee8cc725d8e69bfad5f369a1e0921578a92 — byte-identical to the published tarball.

Install

npm install -g @orion-agents/orion-code@0.3.46

Assets 3

v0.3.45

Linux2010 released this 28 Oct 23:15

v0.3.45

4216ab0

Orion Code v0.3.45 — Release Notes

Summary

Docs-only delivery-status cycle (PR4 automatable portion of the v0.3.27 review loop).
This release:

Settles the v0.3.44 open-version debt: the CHANGELOG [0.3.44] entry is corrected
from candidate → published, with the real npm publish timestamp
2026-10-28T06:08:32.080Z and the GitHub Release v0.3.44 link backfilled.
Adds the [0.3.45] candidate entry and a rolling three-version delivery-status audit
(0.3.42–0.3.44) in docs/plan/evidence/v0.3.45/status-audit.md.
Six-place version bump to 0.3.45 + tests/coding-task-eval.test.ts packageVersion pin.
No production code changes (src/, web/, tests/ untouched).

Changed

CHANGELOG: corrected the 0.3.44 delivery status from candidate to published
(tag v0.3.44, npm registry latest, npm publish timestamp and GitHub Release link
backfilled).
docs: added docs/plan/evidence/v0.3.45/status-audit.md — a three-version
(0.3.42–0.3.44) delivery-status audit cross-checking git tags, registry versions and
the latest dist-tag, plus the v0.3.44 release facts (PR #301, merge 95d5aa3,
tag v0.3.44, registry latest=0.3.44).
README / README.zh-CN: header summary and install pin updated to 0.3.45.

Quality Gate (CI run 40680689814 — 18/18 success)

Every conclusion below is taken from the actual job conclusion of this round's CI run.

#	Job	Conclusion
1	Release gate (release:check)	success
2	Build the exact release tgz once	success
3	Dependency security audit	success
4	Dependency health report (offline)	success
5	TypeScript type-check	success
6	Exact tgz on Node 22.12.0 floor	success
7	Exact tgz on Node 24.0.0 floor	success
8	Exact tgz on Node 26.0.0 floor	success
9	Node 22 verification	success
10	Node 24 verification	success
11	Node 26 verification	success
12	Web E2E critical journey on Node 22.12.0 floor	success
13	Web E2E critical journey on Node 24.0.0 floor	success
14	Web E2E critical journey on Node 26.0.0 floor	success
15	Web E2E full suite three consecutive runs	success
16	Lean Harness benchmark and confluence	success
17	Aggregate exact-artifact Web E2E receipt	success
18	Aggregate fail-closed v0.3.x release receipt	success

Dependency security audit: 0 vulnerabilities (green).
Web E2E full suite: three consecutive runs (25m31s), all passed — no flake, no rerun.

Tarball Integrity (hard safety net — must match)

Local build sha256: a8079e2cbd0a266d3c0a6577df2f70fe62592ce8dc74488b9d12e9588abab5cc
CI-built release-package tgz sha256: identical (byte-for-byte match) ✅
CI web-e2e-receipt.json tarballSha256: identical (decision: GO) ✅
npm registry shasum (SHA-1): cd499a01c076a2cf79b927051cd07efded4d76e1

Install

npm install -g @orion-agents/orion-code@0.3.45

Not run (honest)

The human-labeled paid quality benchmark and the real Host + Chrome full-chain review E2E
remain not_run (no model credentials in the automation environment). Not fabricated.

Note on versioning (flagged for maintainer)

This is a docs-only cycle with no product-code delta. Per the automation's main instruction
("advance one version per round → v0.3.99") it still consumes a version number and goes
through the full release pipeline (bump / tag / publish / Release), consistent with
v0.3.38–v0.3.44. Quality clause C ("docs-only cycles should not consume a version number")
conflicts with the main instruction; this tension is flagged here for the maintainer's
decision.

Assets 2

Orion Code v0.3.44 — receipt backfill & delivery-status audit

Linux2010 released this 28 Oct 06:18

v0.3.44

95d5aa3

Orion Code v0.3.44 — Receipt backfill & delivery-status audit

Docs-only slice of the v0.3.27 review loop (PR4 automatable portion). No production code changes.

Changes

CHANGELOG 0.3.43 → published (Step 0 debt settlement): tag v0.3.43 and npm latest=0.3.43 already existed, but the main CHANGELOG entry was still candidate/UNRELEASED. Flipped to published with the real npm publish timestamp 2026-10-27T19:02:04.278Z and the GitHub Release v0.3.43 link.
Three-version delivery-status audit (0.3.41–0.3.43): docs/plan/evidence/v0.3.44/status-audit.md cross-checks git tags (annotated tag peel → main merge commit), npm registry versions, and dist-tags.latest. All three satisfy tag + registry + latest.
Version bump to 0.3.44 (six places): package.json, npm-shrinkwrap.json (top + packages[""]), CHANGELOG.md, README.md, README.zh-CN.md; plus tests/coding-task-eval.test.ts packageVersion pin (0.3.44).
Plan: docs/plan/v0.3.44-plan.md.

Quality gate (CI run 40638305758 — all 18 jobs `success`)

Job	Conclusion
Release gate (release:check)	success
Build the exact release tgz once	success
Dependency health report (offline)	success
Dependency security audit	success
Lean Harness benchmark and confluence	success
TypeScript type-check	success
Node 22 verification	success
Node 24 verification	success
Node 26 verification	success
Exact tgz on Node 22.12.0 floor	success
Exact tgz on Node 24.0.0 floor	success
Exact tgz on Node 26.0.0 floor	success
Web E2E critical journey on Node 22.12.0 floor	success
Web E2E critical journey on Node 24.0.0 floor	success
Web E2E critical journey on Node 26.0.0 floor	success
Web E2E full suite three consecutive runs	success
Aggregate exact-artifact Web E2E receipt	success
Aggregate fail-closed v0.3.x release receipt	success

Local release:check: 10/10 pass (Version consistency all 0.3.44; tsc 0 errors; ESLint 0 errors; Jest 382 suites / 4587 passed / 5 skipped).

Tarball integrity

tarball sha256: bc0f6e52bf46ddaf21868224fe8b671e7580bb2b0d51babaff9b1e52984b14ae (791 files)
npm registry SHA-1 shasum: e9a334780e65ca0d8f62ddc22143ab94d2561f68
Verified: local tarball == CI release-package tarball == web-e2e-receipt.tarballSha256 (all bc0f6e52…b14ae, decision GO).

Install

npm install -g @orion-agents/orion-code@0.3.44
orion --version
orion doctor

Honest `not_run`

Human-labeled paid quality benchmark (12 defects + 8 clean samples, 3 runs): no model credentials in the automation environment — not_run.
Real Host + Chrome full-chain review E2E: same — not_run.

Assets 2

v0.3.43

Linux2010 released this 27 Oct 19:03

v0.3.43

fa03965

v0.3.43

Docs-only release: receipt backfill and delivery-status audit (the automatable portion of PR4 of the v0.3.27 review-loop plan). No production code changes (src/, web/, tests/ unchanged).

Changes

CHANGELOG 0.3.42 → published: corrected delivery status from candidate to published with the real npm publish timestamp (2026-10-27T06:27:35.184Z) and the GitHub Release link (https://github.com/orion-agents/orion-code/releases/tag/v0.3.42).
New evidence docs/plan/evidence/v0.3.43/status-audit.md: a three-version (0.3.40–0.3.42) delivery-status audit cross-checking git tags, npm registry versions and the latest dist-tag, plus the v0.3.42 release facts (PR #299, squash merge 50628a7, tag v0.3.42, npm latest=0.3.42).
README / README.zh-CN: header summary and install pin updated to 0.3.43.

Quality gate (per-job, from CI run `40502417532`)

All 18 jobs are success on the merge commit fa03965 (squash of PR #300). The full E2E suite had previously flaked on the known environmental WEB32-P0-08 OpenAI-fixture 45s timeout; a single gh run rerun --failed (rule 3.3) cleared it and the run went green.

Job	Conclusion
Web E2E full suite three consecutive runs	✅ success
Web E2E critical journey on Node 22.12.0 floor	✅ success
Web E2E critical journey on Node 24.0.0 floor	✅ success
Web E2E critical journey on Node 26.0.0 floor	✅ success
Aggregate exact-artifact Web E2E receipt	✅ success
Aggregate fail-closed v0.3.x release receipt	✅ success
Exact tgz on Node 22.12.0 floor	✅ success
Exact tgz on Node 24.0.0 floor	✅ success
Exact tgz on Node 26.0.0 floor	✅ success
Build the exact release tgz once	✅ success
Release gate (release:check)	✅ success
TypeScript type-check	✅ success
Node 22 verification	✅ success
Node 24 verification	✅ success
Node 26 verification	✅ success
Lean Harness benchmark and confluence	✅ success
Dependency health report (offline)	✅ success
Dependency security audit	✅ success (0 vulnerabilities)

Tarball integrity (fail-closed, four-way match):

Local tarball sha256: be091eb49c0268b1c258d4ae830a9a598f0821823ef95f0a91549259155455f6
CI release-receipt.json tarballSha256: be091eb49c0268b1c258d4ae830a9a598f0821823ef95f0a91549259155455f6
CI web-e2e-receipt.json tarballSha256: be091eb49c0268b1c258d4ae830a9a598f0821823ef95f0a91549259155455f6
CI release-package artifact sha256: be091eb49c0268b1c258d4ae830a9a598f0821823ef95f0a91549259155455f6
npm registry SHA-1 shasum: 87f24a01a9331c1137e62815f8a31ce1ea4b8bcc
Files: 791

Install

npm install -g @orion-agents/orion-code@0.3.43

Dependabot

9 dependabot PRs remain open (#267 #263 #212 #211 #210 #119 #118 #117 #116). The audit gate is green (0 vulnerabilities), so none are required for this release.

Assets 2

v0.3.41 — receipt backfill and delivery-status audit

Linux2010 released this 27 Oct 00:31

v0.3.41

2abc8e3

Orion Code v0.3.41 — 发布收据回填与交付状态审计（Docs-Only Slice）

This release is a docs-only delivery-status audit & receipt-backfill slice (PR4 automatable portion of the v0.3.27 review loop). No product code changes (src/, web/, tests/ untouched).

Changes

CHANGELOG 0.3.40 corrected to published (Step 0 debt cleared): tag v0.3.40 and npm latest=0.3.40 already existed; real npm publish timestamp 2026-10-26T18:21:55.395Z and GitHub Release v0.3.40 link backfilled.
Added docs/plan/evidence/v0.3.41/status-audit.md — a three-version (0.3.38–0.3.40) delivery-status audit cross-checking git tags, registry versions and the latest dist-tag, plus the v0.3.40 release facts (PR #297, merge ef45214, tag v0.40, registry latest=0.3.40, GitHub Release v0.3.40).
README / README.zh-CN header summary + install pin updated to 0.3.41.
tests/coding-task-eval.test.ts packageVersion pin updated to 0.3.41.

Quality gate table (CI run 40422765672 — every job conclusion pulled from `gh pr checks` / `gh run view`)

#	Job	Conclusion
1	Release gate (release:check)	✅ success
2	Build the exact release tgz once	✅ success
3	Dependency health report (offline)	✅ success
4	Dependency security audit	✅ success (0 vulnerabilities)
5	Exact tgz on Node 22.12.0 floor	✅ success
6	Exact tgz on Node 24.0.0 floor	✅ success
7	Exact tgz on Node 26.0.0 floor	✅ success
8	Lean Harness benchmark and confluence	✅ success
9	Node 22 verification	✅ success
10	Node 24 verification	✅ success
11	Node 26 verification	✅ success
12	TypeScript type-check	✅ success
13	Web E2E critical journey on Node 22.12.0 floor	✅ success
14	Web E2E critical journey on Node 24.0.0 floor	✅ success
15	Web E2E critical journey on Node 26.0.0 floor	✅ success
16	Web E2E full suite three consecutive runs	✅ success (30m8s)
17	Aggregate exact-artifact Web E2E receipt	✅ success
18	Aggregate fail-closed v0.3.x release receipt	✅ success

All 18/18 jobs success. No flake rerun required. The "Web E2E full suite three consecutive runs" job encapsulates the three consecutive runs (3×) required by the release policy; it passed on the first execution.

Artifact integrity

Local tarball SHA-256: de9c811d37065d45d0496b32f8863ecc3a63c8efbd22ed72d96ffd5758eb3e8e (791 files, 1.79 MB)
CI release-receipt.json tarball SHA-256: de9c811d37065d45d0496b32f8863ecc3a63c8efbd22ed72d96ffd5758eb3e8e — byte-for-byte match, decision GO
CI web-e2e-receipt.json tarball SHA-256: de9c811d37065d45d0496b32f8863ecc3a63c8efbd22ed72d96ffd5758eb3e8e — match, decision GO
npm registry SHA-1 (integrity): a8556876c957687bc8c2f3c868d198fe881cf160

Install

npm install -g @orion-agents/orion-code@0.3.41
# or
npx @orion-agents/orion-code@0.3.41

Publish record

npm publish timestamp (registry time): 2026-10-27T00:30:30.123Z
PR: #298 · squash merge 2abc8e3 · tag v0.3.41 (annotated 83822c6, peel → 2abc8e3)

Assets 2

v0.3.40

Linux2010 released this 26 Oct 18:31

v0.3.40

ef45214

v0.3.40 — Receipt backfill & delivery-status audit

Docs-only release (PR4 automatable portion of the v0.3.27 review loop). No production code changes (src/, web/, tests/ untouched).

Changes

CHANGELOG: corrected the 0.3.39 delivery status from candidate to published — backfilled the real npm publish timestamp (2026-10-26T03:17:19.937Z) and the GitHub Release link. 0.3.40 opened as Status: candidate.
Delivery-status audit: added docs/plan/evidence/v0.3.40/status-audit.md — a three-version (0.3.37–0.39) cross-check of git tags, registry versions and the latest dist-tag, plus the v0.3.39 release facts (PR #296, merge 5a51932, tag v0.3.39, registry latest=0.3.39, GitHub Release v0.3.39).
README / README.zh-CN: header summary and install pin updated to 0.3.40.
Plan: docs/plan/v0.3.40-plan.md recorded (task-decomposition / files / acceptance).

The human-labeled paid quality benchmark and real Host + Chrome full-chain E2E remain honestly not_run (no model credentials in the automation environment).

Quality gate (per-job conclusions from CI run `40292157785`)

All 18 jobs reported success after a single rerun --failed of the Web E2E full suite three consecutive runs job (historical WEB32-P0-08 OpenAI-fixture timeout flake — rerun green, = transient flake, merge allowed per policy).

Job	Conclusion
Web E2E full suite three consecutive runs	success
Web E2E critical journey on Node 22.12.0 floor	success
Web E2E critical journey on Node 24.0.0 floor	success
Web E2E critical journey on Node 26.0.0 floor	success
Exact tgz on Node 22.12.0 floor	success
Exact tgz on Node 24.0.0 floor	success
Exact tgz on Node 26.0.0 floor	success
Build the exact release tgz once	success
Release gate (release:check)	success
Dependency security audit	success (0 vulnerabilities)
TypeScript type-check	success
Node 22 verification	success
Node 24 verification	success
Node 26 verification	success
Lean Harness benchmark and confluence	success
Dependency health report (offline)	success
Aggregate exact-artifact Web E2E receipt	success
Aggregate fail-closed v0.3.x release receipt	success

Three consecutive E2E runs: GO (rerun resolved the single flake).
Audit: 0 vulnerabilities.
tarball sha256: b56e79a4677333e84380a5cf2a79c4b80a86e4f5b3cfc2508fbb3225fa1f489a (3-way match: local tarball = CI release-package artifact = release-receipt.json tarballSha256 → release:check decision GO).
npm SHA-1: 5ab9c3e3c76d4224340736f0351c5e48b1f74f3b.
Published: 2026-10-26T18:21:55.395Z (dist-tags.latest = 0.3.40).

Install

npm install -g @orion-agents/orion-code@0.3.40

Assets 2

v0.3.39 — receipt backfill & delivery-status audit

Linux2010 released this 26 Oct 03:19

v0.3.39

5a51932

v0.3.39 — 发布收据回填与交付状态审计（Docs-Only Slice）

Docs-only 切片（docs/plan/v0.3.27-plan.md §8 PR4 的可自动化子切片），零生产代码改动。Plan：docs/plan/v0.3.39-plan.md。

改动说明

CHANGELOG：0.3.38 条目 candidate → published（npm registry 入库 2026-10-25T20:50:25.203Z，回填 GitHub Release v0.3.38 链接）；新增 0.3.39 candidate 条目。
交付状态审计：新增 docs/plan/evidence/v0.3.39/status-audit.md —— 0.3.36 / 0.3.37 / 0.3.38 三版「tag + registry + latest」三项核对全部满足；回填 v0.3.38 发布事实（PR #295、squash merge 4cb727e、tag v0.3.38、registry shasum 5c15a054…d18f）；勘误上轮审计对 v0.3.36 tag 指向的记录（实测为注释 tag 重指向 ebbbaa4，非 6ea1d16，树差异仅 shrinkwrap 3 行，内容等价）。
版本 bump 六处：package.json、npm-shrinkwrap.json（顶层 + packages[""]）、CHANGELOG.md、README.md、README.zh-CN.md（install pin + 首部摘要）→ 0.3.39；tests/coding-task-eval.test.ts packageVersion pin 同步 0.3.38→0.3.39。

质量门禁表（CI run 40257670040，rerun --failed 一次后）

作业	结论
Release gate (release:check)	success
Build the exact release tgz once	success
Dependency health report (offline)	success
Dependency security audit	success
TypeScript type-check	success
Node 22 / 24 / 26 verification	success ×3
Exact tgz on Node 22 / 24 / 26 floor	success ×3
Web E2E critical journey ×3	success ×3
Web E2E full suite three consecutive runs	success（首轮 2/3 轮 WEB32-P0-08 OpenAI fixture 45s 超时，历史同族 flake，rerun 后通过）
Lean Harness benchmark and confluence	success
Aggregate fail-closed v0.3.x release receipt	success
Aggregate exact-artifact Web E2E receipt	success

共 18/18 作业 success。sha 核验：本地 tarball sha256 == CI release-receipt / web-e2e-receipt tarballSha256（6 次运行一致，两个 receipt decision 均 GO）。本地全量 Jest：382 套件 / 4587 测试全绿。

制品

tarball：orion-agents-orion-code-0.3.39.tgz（791 files）
sha256：a73c6ec3f862d304f5b2eec73fcab5f2feaae29546a8b824b02641ea3f517d51
registry shasum (SHA-1)：00ed86afcab446a5ce9fbf8c80199af23d3688f8
npm 入库时间：2026-10-26T03:17:19.937Z（dist-tags.latest=0.3.39）

安装

npm install -g @orion-agents/orion-code@0.3.39

明确 not_run

人工标注付费质量评测、真实 Host + Chrome 全链路审查 E2E：自动化环境无模型凭据，如实记 not_run。

Assets 2

v0.3.38 — receipt backfill and delivery-status audit

Linux2010 released this 25 Oct 20:52

v0.3.38

4cb727e

Changes

Docs-only slice (PR4 automatable portion of the v0.3.27 review loop). No production code changes.

CHANGELOG: 0.3.37 entry corrected candidate → published with the real npm publish timestamp (2026-10-25T15:03:25.053Z) and the GitHub Release v0.3.37 link; new 0.3.38 candidate entry added.
Evidence: docs/plan/evidence/v0.3.38/status-audit.md — three-version (0.3.35–0.3.37) delivery-status audit (git tag → main merge commit + npm registry version + dist-tags.latest), all satisfied; v0.3.37 release facts backfilled (PR #293, merge 8fb6ef0, tag v0.3.37, registry shasum 31754d58…8512).
Plan: docs/plan/v0.3.38-plan.md (task breakdown, files, acceptance criteria).
Version bump to 0.3.38 (six places) + tests/coding-task-eval.test.ts packageVersion pin.

Quality gates

Gate	Conclusion	Evidence
Release gate (release:check)	✅ success	job
Build the exact release tgz once	✅ success	job
Dependency health report (offline)	✅ success	job
Dependency security audit	✅ success (0 vulnerabilities)	job
Lean Harness benchmark and confluence	✅ success	job
TypeScript type-check	✅ success	job
Node 22 / 24 / 26 verification	✅ success ×3	22 · 24 · 26
Exact tgz on Node 22 / 24 / 26 floor	✅ success ×3	22 · 24 · 26
Web E2E critical journey ×3 (Node 22/24/26)	✅ success ×3	22 · 24 · 26
Web E2E full suite three consecutive runs	✅ success	job
Aggregate exact-artifact Web E2E receipt	✅ success (GO)	job
Aggregate fail-closed v0.3.x release receipt	✅ success	job

CI run: https://github.com/orion-agents/orion-code/actions/runs/40230160849 — 18/18 jobs success (one timing flake in Exact tgz on Node 26 terminal_journey was rerun once via gh run rerun --failed per the single-flake policy and passed).

Note: the "Web E2E full suite three consecutive runs" gate in this repository runs three full E2E passes within the job; the run above is the GO evidence for this release (previous rounds established the three-consecutive-runs contract).

Integrity

Local tarball sha256: 1e720787719ca4abaf4398e5e42918e35abfc53db9f85e3c2c72e868b1668540
CI web-e2e-receipt artifact tarballSha256: identical, byte-for-byte verified.
npm registry shasum (SHA-1): 5c15a05421c53d66cc543c9d9ab4516e1e04d18f (matches local tarball).
npm publish time: 2026-10-25T20:50:25.203Z (registry dist-tags.latest=0.3.38).

Install

npm install -g @orion-agents/orion-code@0.3.38

Assets 2

v0.3.37 — receipt backfill and delivery-status audit

Linux2010 released this 25 Oct 15:06

v0.3.37

8fb6ef0

Summary

Receipt backfill & delivery-status audit slice (PR4 automatable portion of the v0.3.27 review loop). No production code changes.

Changes

CHANGELOG: 0.3.36 delivery status coordinated to published (tagged v0.3.36, npm registry latest, backfilled GitHub Release link); new [0.3.37] candidate entry with per-item change notes.
docs: added docs/plan/evidence/v0.3.37/status-audit.md — a three-version (0.3.34–0.3.36) delivery-status audit cross-checking git tags, registry versions and the latest dist-tag, plus v0.3.36 release facts (PR #292, merge 6ea1d16, tag v0.3.36, registry latest=0.3.36, backfilled GitHub Release v0.3.36).
plan: added docs/plan/v0.3.37-plan.md (task breakdown, touched files, acceptance criteria).
deps (coordinated on main via PR #294): npm-shrinkwrap resolution of undici moved to 6.29.1, clearing the production audit advisories GHSA-4qv8-2p9j-2685 and GHSA-xjj6-f33q-929c; v0.3.37 is the first tagged release shipping it. Audit now reports 0 vulnerabilities.
version bump (six locations): package.json, npm-shrinkwrap.json (top-level + packages[""]), CHANGELOG.md, README.md, README.zh-CN.md (install pin + header summary) → 0.3.37; tests/coding-task-eval.test.ts pin updated to match.
README / README.zh-CN: header summary and install pin updated to 0.3.37.

Release facts

Item	Value
Merge commit	`8fb6ef0` (squash of PR #293)
Tag	`v0.3.37` → `8fb6ef0`
npm	`@orion-agents/orion-code@0.3.37`, published `2026-10-25T15:03:25.053Z`, dist-tag `latest`
Registry shasum	`31754d58e735d6ff78ce76fc7bed183c6fcf8512`
Tarball sha256 (built from clean worktree `/Users/hope/ai-project/orion-code.worktrees/v0.3.37`)	`fb78c35a1187041788096fd5e941295b697ff85d6657c718487063bd2f011a8d`
SHA cross-check	local tarball == CI `release-receipt.json` `tarball.sha256` == CI `web-e2e-receipt.json` `tarballSha256` (byte-identical)
PR	#293
CI run	https://github.com/orion-agents/orion-code/actions/runs/40200315323

Quality gates (per-job conclusions, run 40200315323)

Job	Conclusion
Dependency security audit	✅ success (0 vulnerabilities, undici 6.29.1)
Web E2E full suite three consecutive runs	✅ success (3× GO, 28m43s)
Web E2E critical journey Node 22.12 / 24 / 26 floors	✅ success ×3
Node 22 / 24 / 26 verification	✅ success ×3
Exact tgz Node 22.12 / 24 / 26 floors	✅ success ×3
Build the exact release tgz once	✅ success
Release gate (release:check)	✅ success (CI) / PASS 10/10 (local)
TypeScript type-check	✅ success
Dependency health report (offline)	✅ success
Lean Harness benchmark and confluence	✅ success
Aggregate exact-artifact Web E2E receipt	✅ success (decision GO)
Aggregate fail-closed v0.3.x release receipt	✅ success (decision GO)

18/18 checks passed on first run — no flake reruns required.

Install

npm install -g @orion-agents/orion-code@0.3.37
orion --version
orion doctor

Assets 2

Orion Code v0.3.36 — Receipt Backfill & Delivery-Status Audit

Linux2010 released this 25 Oct 07:26

v0.3.36

ebbbaa4

Orion Code v0.3.36 — Receipt Backfill & Delivery-Status Audit

Receipt backfill and delivery-status audit slice (PR4 automatable portion of the v0.3.27 review loop, plan: docs/plan/v0.3.36-plan.md). No production code changes.

Changed

CHANGELOG: corrected the 0.3.35 delivery status from candidate to published (tagged v0.3.35, npm registry latest).
docs: added docs/plan/evidence/v0.3.36/status-audit.md — a three-version (0.3.33–0.3.35) delivery-status audit cross-checking git tags, registry versions and the latest dist-tag, plus the v0.3.35 release facts (PR #291, merge cfbb4e2, tag v0.3.35, registry latest=0.3.35).
Version bump to 0.3.36 across package.json, npm-shrinkwrap.json, CHANGELOG.md, README.md, README.zh-CN.md.

Quality gates

Gate	Result
CI (18 checks)	17/18 green; sole failure is the long-standing Dependency security audit baseline (js-yaml GHSA), same as prior rounds
Web E2E critical journeys ×3 / Node 22·24·26 / exact-tgz ×3	Green
`npm run release:check`	Green locally (4 known better-sqlite3 environment-bound Jest failures, CI-green)

Install

npm install -g @orion-agents/orion-code@0.3.36

npm registry: published 2026-10-25T01:59:21.552Z, dist-tags latest=0.3.36, shasum cce4f6cff28966986046d170eac14a9b155fc51f.

Assets 2

Releases: orion-agents/orion-code

Release list

v0.3.46

@orion-agents/orion-code v0.3.46

What changed

CI gate (run 40851844422 — all green)

Artifact integrity

Install

Uh oh!

v0.3.45

Orion Code v0.3.45 — Release Notes

Summary

Changed

Quality Gate (CI run 40680689814 — 18/18 success)

Tarball Integrity (hard safety net — must match)

Install

Not run (honest)

Note on versioning (flagged for maintainer)

Uh oh!

Orion Code v0.3.44 — receipt backfill & delivery-status audit

Orion Code v0.3.44 — Receipt backfill & delivery-status audit

Changes

Quality gate (CI run 40638305758 — all 18 jobs success)

Tarball integrity

Install

Honest not_run

Uh oh!

v0.3.43

v0.3.43

Changes

Quality gate (per-job, from CI run 40502417532)

Install

Dependabot

Uh oh!

v0.3.41 — receipt backfill and delivery-status audit

Orion Code v0.3.41 — 发布收据回填与交付状态审计（Docs-Only Slice）

Changes

Quality gate table (CI run 40422765672 — every job conclusion pulled from gh pr checks / gh run view)

Artifact integrity

Install

Publish record

Uh oh!

v0.3.40

v0.3.40 — Receipt backfill & delivery-status audit

Changes

Quality gate (per-job conclusions from CI run 40292157785)

Install

Uh oh!

v0.3.39 — receipt backfill & delivery-status audit

v0.3.39 — 发布收据回填与交付状态审计（Docs-Only Slice）

改动说明

质量门禁表（CI run 40257670040，rerun --failed 一次后）

制品

安装

明确 not_run

Uh oh!

v0.3.38 — receipt backfill and delivery-status audit

Changes

Quality gates

Integrity

Install

Uh oh!

v0.3.37 — receipt backfill and delivery-status audit

Summary

Changes

Release facts

Quality gates (per-job conclusions, run 40200315323)

Install

Uh oh!

Orion Code v0.3.36 — Receipt Backfill & Delivery-Status Audit

Orion Code v0.3.36 — Receipt Backfill & Delivery-Status Audit

Changed

Quality gates

Install

Uh oh!

Quality gate (CI run 40638305758 — all 18 jobs `success`)

Honest `not_run`

Quality gate (per-job, from CI run `40502417532`)

Quality gate table (CI run 40422765672 — every job conclusion pulled from `gh pr checks` / `gh run view`)

Quality gate (per-job conclusions from CI run `40292157785`)