Repository navigation
v0.3.40
v0.3.40 — Receipt backfill & delivery-status audit
Docs-only release (PR4 automatable portion of the v0.3.27 review loop). No production code changes (src/, web/, tests/ untouched).
Changes
- CHANGELOG: corrected the
0.3.39delivery status fromcandidatetopublished— backfilled the real npm publish timestamp (2026-10-26T03:17:19.937Z) and the GitHub Release link.0.3.40opened asStatus: candidate. - Delivery-status audit: added
docs/plan/evidence/v0.3.40/status-audit.md— a three-version (0.3.37–0.39) cross-check of git tags, registry versions and thelatestdist-tag, plus the v0.3.39 release facts (PR #296, merge5a51932, tagv0.3.39, registrylatest=0.3.39, GitHub Release v0.3.39). - README / README.zh-CN: header summary and install pin updated to
0.3.40. - Plan:
docs/plan/v0.3.40-plan.mdrecorded (task-decomposition / files / acceptance).
The human-labeled paid quality benchmark and real Host + Chrome full-chain E2E remain honestly not_run (no model credentials in the automation environment).
Quality gate (per-job conclusions from CI run 40292157785)
All 18 jobs reported success after a single rerun --failed of the Web E2E full suite three consecutive runs job (historical WEB32-P0-08 OpenAI-fixture timeout flake — rerun green, = transient flake, merge allowed per policy).
| Job | Conclusion |
|---|---|
| Web E2E full suite three consecutive runs | success |
| Web E2E critical journey on Node 22.12.0 floor | success |
| Web E2E critical journey on Node 24.0.0 floor | success |
| Web E2E critical journey on Node 26.0.0 floor | success |
| Exact tgz on Node 22.12.0 floor | success |
| Exact tgz on Node 24.0.0 floor | success |
| Exact tgz on Node 26.0.0 floor | success |
| Build the exact release tgz once | success |
| Release gate (release:check) | success |
| Dependency security audit | success (0 vulnerabilities) |
| TypeScript type-check | success |
| Node 22 verification | success |
| Node 24 verification | success |
| Node 26 verification | success |
| Lean Harness benchmark and confluence | success |
| Dependency health report (offline) | success |
| Aggregate exact-artifact Web E2E receipt | success |
| Aggregate fail-closed v0.3.x release receipt | success |
- Three consecutive E2E runs: GO (rerun resolved the single flake).
- Audit: 0 vulnerabilities.
- tarball sha256:
b56e79a4677333e84380a5cf2a79c4b80a86e4f5b3cfc2508fbb3225fa1f489a(3-way match: local tarball = CIrelease-packageartifact =release-receipt.jsontarballSha256→release:checkdecision GO). - npm SHA-1:
5ab9c3e3c76d4224340736f0351c5e48b1f74f3b. - Published:
2026-10-26T18:21:55.395Z(dist-tags.latest = 0.3.40).
Install
npm install -g @orion-agents/orion-code@0.3.40