Versioning and Releases

Versioning & Releases

Current line: 0.2.x (codna 0.2.86 in this repo). The package follows SemVer: patch for fixes, minor for backward-compatible additions (new tools, new optional flags), major for breaking CLI or tool-contract changes — announced in advance. History lives in CHANGELOG.md (Keep a Changelog, generated).

The release train

Releasing is automatic: pushes to the CLI source in the private repo drive a release-please-style train that bumps the version, regenerates the changelog, tags cli-vX.Y.Z, builds the wheel (staging the agent-runtime binaries in the process), and publishes. No human edits a version string by hand; the same train republishes this mirror.

The version pins in this repo, all bumped by the train:

File	What it pins
pyproject.toml and codna/__init__.py	The package version (0.2.86)
server.json	The MCP Registry version + the codna PyPI package pin

The mirror carries no git tags and no GitHub Releases — the cli-v* tags referenced in the changelog live in the private source repo; the published artifacts are the release.

The registry pin-bump rule

Glama's TDQS grades the pinned version of the server it inspects — a stale pin means the grade (and what users install) lags the code. The rule: server.json is bumped in the same release commit as the package version, every release, never by hand between releases. That file is also what the Official MCP Registry serves for io.github.thyn-ai/codna, so one bump keeps both registries honest.

Where things publish:

Destination	Name	Cadence
PyPI	codna	Every release (wheel; sdist excludes runtime binaries/keys/logs)
Official MCP Registry	io.github.thyn-ai/codna	Every release (from server.json)
Glama	io.github.thyn-ai/codna	Inspects the pinned registry entry

Verifying what you installed

• Check the version: codna --version should match pyproject.toml in this repo.
• Install from PyPI with hash checking (pip install codna==0.2.86 --require-hashes in a locked requirements file) or via pipx / uv tool install.
• The staged runtime binaries ride inside the signed-off release wheel; the on-device memory engine arrives via the login-gated install from the signed Telys bundle.

Related

• Architecture — the mirror model and what ships in the wheel
• Security — credential handling and the trust model