v0.1.0-rc.2

AgentAPI Doctor v0.1.0-rc.2

Summary

This release candidate adds one reproducible raw wire → pinned SDK case to
the existing fast endpoint checks. On Linux amd64, doctor reproduce openai-python-responses runs OpenAI Python SDK 2.38.0 with CPython 3.12.12
against a task-owned loopback Responses fixture and writes a deterministic,
checksummed evidence ZIP.

The four frozen cases cover a valid reference stream, a missing terminal event,
a duplicate terminal event, and a terminal response whose SDK-modeled output
array is null. They correlate the raw SSE with the real SDK observation from
the same request. The command never contacts a provider or reads an API key.

Before the SDK request, the helper verifies CPython, platform, and the exact
installed distribution names and versions from the lock. The evidence bundle
separates observed and expected environment data and binds the result to the
Doctor and Python executable digests, release build identity, source revision,
and canonical fixture, runner, and lock digests.

The ordinary doctor test command remains a cross-platform, bounded raw-HTTP
checker for authorized OpenAI Chat Completions, OpenAI Responses, and Anthropic
Messages endpoints. This release is not a vendor certification or a claim of
general SDK or Agent compatibility.

Compatibility and breaking changes

The new doctor reproduce command is additive. Existing doctor test, demo,
report, baseline, configuration, run-store, and exit-code behavior remains
pre-1.0 and unchanged by this slice.

The synthetic reference server now exposes 13 targeted mutation modes. Its
Responses fixtures include the stable envelope fields required by the pinned
SDK, and the new null-completed-output mutation changes only the terminal
response's output field. These local fixtures are test inputs, not public
provider behavior.

The pinned reproducer supports Linux amd64 only. Release archives remain
available for Linux, macOS, and Windows on amd64 and arm64 because the normal
endpoint checker and credential-free demo remain cross-platform. On other
platforms, doctor reproduce fails clearly without starting a fixture.

Migration

Replace an older binary with the exact archive for this release and confirm
doctor version --json reports 0.1.0-rc.2. Existing local run records and
baselines remain private local state and do not need to be moved into the
installation directory.

The real-SDK reproducer does not bundle Python or third-party wheels. To use
it, create a separate CPython 3.12.12 environment from the checked-in
Linux-x86_64 wheel-only hash lock, then pass that environment's executable with
--python. The reproducible case documentation shows a two-stage wheelhouse
download and --no-index install. The CLI refuses to overwrite an existing
bundle path.

No Registry, reference-server, OCI image, Homebrew tap, Scoop bucket, composite
Action, reusable workflow, Python package, or hosted service is published as a
supported v0.1.0-rc.2 installation channel.

Known issues

• The pinned SDK command is a frozen loopback regression baseline, not an
  arbitrary-endpoint SDK driver. It does not run a proxy, Agent loop, tool
  execution, or vendor service.
• openai==2.38.0 accepts the duplicate-terminal fixture and yields both
  terminal events. Doctor preserves that SDK observation alongside the raw
  count; it does not rewrite it into a client exception.
• A client exception alone is not attributed to an endpoint. If the controlled
  wire identity or frozen SDK observation differs, the result is UNKNOWN
  rather than a provider fault.
• A normal endpoint PASS still covers four selected raw-HTTP checks for one
  exact endpoint, model, and artifact set. It is not complete SDK or Agent
  compatibility.
• Redaction is not anonymization. Review structured model content, tool
  arguments, and every evidence bundle before sharing.
• Runtime dependency attestation checks installed distribution metadata. The
  checked-in hashes protect wheel download and installation; Doctor does not
  rehash every installed package file afterward.
• There is no project-operated hosted verifier, public Registry, compatibility
  matrix, telemetry service, verified external adopter set, or long-term
  support commitment.

Support window

Support for this release candidate begins when its GitHub Release becomes
public and ends on 2026-08-13 or when a newer release candidate or stable
release supersedes it, whichever occurs first. Security reports remain welcome
after that date, but fixes may require upgrading to a newer release.

Publication of v0.1.0-rc.2 supersedes the v0.1.0-rc.1 release-candidate support
window; the immutable rc.1 artifacts remain available for reproduction.

Verification

The release tag identifies the exact source commit. doctor version --json
inside every archive reports the release version and that full commit ID.

The release workflow builds six native Doctor archives, publishes
checksums.txt and one SPDX JSON SBOM, signs the checksum manifest with
Sigstore keyless signing, and records GitHub build-provenance attestations for
every published file. Linux amd64, macOS arm64, and Windows amd64 runners verify
the asset set, checksum, archive identity, version, and credential-free demo
before publication. After publication they repeat the checks through anonymous
public downloads; Linux also exercises the fixed-tag installer.

Before building those archives, the exact tag workflow reconstructs the
hash-locked Python environment and repeats all four real-SDK cases twice.

Protected Product CI separately creates the pinned Python wheelhouse from the
checked-in hashes, installs it with --no-index, and runs all four real-SDK
cases twice on a clean Ubuntu runner. That check is part of Product CI / aggregate; the release does not imply real-SDK coverage on macOS, Windows, or
arm64.

The canonical artifact-verification commands and certificate identity are in
docs/operations/release-verification.md. A failed workflow does not justify a
compatibility or publication claim.