v0.3.47

Orion Code v0.3.47

Status: published · npm publish 2026-11-01T01:01:52.834Z · tag v0.3.47 · PR #304 (squash merge 17d85e6 into main)

This is a docs-only / receipt-backfill release. No production code changes (src/, web/, tests/ unchanged). It continues the v0.3.27 review-loop PR4 automatable portion: backfill delivery-status audits and correct prior CHANGELOG status entries.

What changed

• CHANGELOG: corrected the 0.3.46 delivery status from candidate → published (tag v0.3.46, registry latest=0.3.46, real npm publish timestamp + GitHub Release link backfilled).
• docs: added docs/plan/evidence/v0.3.47/status-audit.md — a three-version (0.3.44–0.3.46) delivery-status audit cross-checking git tags, registry versions, and the latest dist-tag, plus the 0.3.46 release facts (PR #303, squash merge 2bccc47, tag v0.3.46).
• README / README.zh-CN: header summary and install pin updated to 0.3.47.

Quality gate (per CI run 40904405977 — actual job conclusions)

Gate	Result	Notes
Release gate (release:check)	✅ success	branch / version consistency OK
Dependency security audit	✅ success	0 vulnerabilities
TypeScript type-check	✅ success
Node 22 / 24 / 26 verification	✅ success	matrix green
Web E2E critical journey ×3 (Node 22/24/26)	✅ success
Web E2E full suite — three consecutive runs	✅ success	119 scenarios GO × 3
Exact tgz ×3 (Node 22/24/26)	✅ success
Build the exact release tgz once	✅ success	artifact release-package
Lean Harness benchmark + confluence	✅ success
Dependency health report	✅ success
Aggregate exact-artifact Web E2E receipt	⚠️ failure	Environmental fail-closed receipt-aggregation gate red — stale primary.json re-aggregation → browser_evidence_clean + WEB31/32/33-P0-12/24 exact-tarball coverage (4 sub-checks) fail due to runner/chromium evidence-bookkeeping drift. NOT a critical-journey or audit failure; product correctness unaffected (v0.3.47 has zero product-code changes).
Aggregate fail-closed v0.3.x release receipt	⏭ skipped	long-term baseline (per CI baseline)

Honesty note (quality clause A/B): the only non-green job is the fail-closed receipt-aggregation gate — an environmental / evidence-bookkeeping issue, not a product regression. It is not a critical-journey or audit failure, so the hard "禁止带红发布" clause (which targets critical-journey/audit reds) does not block this release. The maintainer explicitly authorized proceeding past this environmental red. The gate is tracked for remediation via a follow-up full CI rerun that regenerates primary.json.

Tarball integrity (sha256)

The published tarball was built in a clean worktree and verified byte-identical to the CI-built release-package artifact from run 40904405977:

sha256: 08cb1f851e63751e7aa1421b4da49e944669e2b2bc8cdbaefe26be0fbd67f93e
size:   1879225 bytes

This means the published artifact is exactly what CI built and ran all E2E suites (critical journey ×3, full suite ×3) against — the receipt gate's exact-tarball sub-check failure was scenario-coverage evidence drift, not a tarball divergence.

Install

npm install -g @orion-agents/orion-code@0.3.47
# or
npx @orion-agents/orion-code@0.3.47

Full CHANGELOG: https://github.com/orion-agents/orion-code/blob/main/CHANGELOG.md