chore(release): v0.18.4 — dependabot infra + memory-leak fix + docstring polish

[cmeans-claude-dev]

Linked issue

Fixes # — release-stamp PR; no underlying ticket.

Summary

Version stamp only. No source code changes, no tests, no schema, no migrations. Every functional change in this release landed as its own QA-reviewed feature PR since v0.18.3 (2026-04-24); this PR collapses [Unreleased] to a dated [0.18.4] heading and bumps pyproject.toml.

What's in v0.18.4

Section	Entry	PR	Squash
Added	Dependabot CHANGELOG automation + ecosystem labels (auto-prepends ### Changed entry on Dependabot PRs, App-token push so CI re-fires, fetch-metadata v3.1.0, KaC ordering, post-#63 inline composer)	#400	5a6e229
Changed	remind() docstring clarifies the three deliver_at modes (future / current-or-past / omitted)	#399	5cbf34e
Changed	docker-compose group bump: ollama/ollama 0.21.0→0.21.2	#398	5609c2a
Changed	github-actions group bumps: docker/build-push-action 6.19.2→7.1.0, docker/setup-buildx-action 3.12.0→4.0.0	#397	6f9bef6
Changed	.github/dependabot.yml commit-message prefix corrected to bare chore (drops the chore(deps)(deps): doubled-prefix bug)	#400	5a6e229
Fixed	Bound AuthMiddleware._owner_inflight and RateLimiter._hits to prevent unbounded growth in long-running deployments — operational memory-leak fix	#396	691481f
Security	CLA bypass workflow for whitelisted bot authors on workflow-touching PRs	#387	da6f9bf

Headlines:

• Operational memory-leak fix (fix(sec): bound AuthMiddleware concurrency dict and RateLimiter hits dict #396) — the load-bearing item for long-running multi-tenant deploys.
• Dependabot infra is now end-to-end validated on this repo — single-prefix titles, auto-CHANGELOG with populated arrows, KaC ordering, App-token CI re-firing, ecosystem labels. Validated live by recreating chore(deps): bump the github-actions group across 1 directory with 2 updates #397 (github-actions ecosystem) and chore(deps): bump ollama/ollama from 0.21.0 to 0.21.2 in the docker-compose group across 1 directory #398 (docker-compose ecosystem) post-chore(deps,ci): port dependabot-pr-hygiene playbook to mcp-awareness #400 merge.

Scope

CHANGELOG.md   | 5 ++++-
pyproject.toml | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)

AI-assistance disclosure

• No AI used in producing this PR
• AI assisted with code generation (release stamp + PR body)
• AI assisted with the PR body or commit messages

QA

Prerequisites

Per project CLAUDE.md release-process: release PRs are version-stamp only — no manual QA tests required, since all code was already tested and QA-approved as feature PRs. Lightweight QA below is for mechanical correctness of the stamp itself.

Manual checks

1. • Version bump — grep '^version =' pyproject.toml returns version = "0.18.4"
2. • CHANGELOG date heading — grep '## \[0.18.4\]' CHANGELOG.md returns ## [0.18.4] - 2026-04-27
3. • Comparison links — grep '^\[0.18.4\]\|^\[Unreleased\]' CHANGELOG.md returns:

   [Unreleased]: https://github.com/cmeans/mcp-awareness/compare/v0.18.4...HEAD
   [0.18.4]: https://github.com/cmeans/mcp-awareness/compare/v0.18.3...v0.18.4
   

4. • No source diff — git diff main...HEAD --stat shows only CHANGELOG.md and pyproject.toml
5. • Suite still green — python -m pytest tests/ -q returns 1014 passed, 7 skipped (unchanged from main; no new tests in this PR)

Post-merge sequence

After this PR is QA-approved and merged, the maintainer:

1. Tag the merge commit: git tag -a v0.18.4 -m "v0.18.4 — dependabot infra + memory-leak fix + docstring polish"
2. Push the tag: git push origin v0.18.4
3. Tag push triggers docker-publish.yml → builds and pushes ghcr.io/cmeans/mcp-awareness:v0.18.4 + updates :latest
4. Holodeck prod (venv/systemd LXCs, not Docker) picks up via scripts/holodeck/deploy.sh (operator runs)
5. On first post-deploy get_briefing per owner, the briefing fix from v0.18.3 is already live so accumulated fired handoffs continue to surface (no behavioral change there)
6. v0.18.4 doesn't introduce new tools or schemas — no Claude Desktop / awareness-prompt updates needed

Checklist

• CHANGELOG.md [Unreleased] renamed to [0.18.4] - 2026-04-27; fresh empty [Unreleased] placeholder above
• Comparison links updated (added [0.18.4], repointed [Unreleased] to v0.18.4...HEAD)
• pyproject.toml version bumped 0.18.3 → 0.18.4
• README.md unchanged — no test count, tool count, or current-status references touched (none were stale)
• No secrets, credentials, or .env content in the diff
• ruff check, mypy clean; pytest 1014/7-skipped (unchanged from main)
• CLA — bot commit; CLA bypass workflow handles cmeans-claude-dev[bot] per .github/cla-bot-allowlist

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cmeans]

LGTM

[cmeans]

Adding QA Active — round 1 review.

[cmeans]

QA Round 1 — Verdict: Ready for QA Signoff

Head a6d2e98. Release-stamp PR for v0.18.4. Per project CLAUDE.md, release PRs don't need feature-level QA — every functional change since v0.18.3 was already QA-approved as its own PR (#387, #396, #397, #398, #399, #400). Verification here is mechanical correctness of the stamp itself.

Manual checks (all 5 verified)

#	Check	Result
1	Version bump	pyproject.toml:3 → version = "0.18.4" ✓
2	CHANGELOG date heading	Line 11 → ## [0.18.4] - 2026-04-27 ✓
3	Comparison links	Line 638 → [Unreleased]: …compare/v0.18.4...HEAD; Line 639 → [0.18.4]: …compare/v0.18.3...v0.18.4 ✓
4	No source diff	git diff numstat: 5/2 across CHANGELOG.md (3/1) and pyproject.toml (1/1). Only stamp files ✓
5	Suite still green	uv run pytest -q -p no:cacheprovider after fresh .hypothesis/ clear: 1014 passed, 7 skipped, 4 warnings in 34.93s — exact match to main baseline ✓

Additional verifications

• Commit completeness (git log v0.18.3..pr-403-qa): all 6 prior PRs since v0.18.3 are present in the [0.18.4] entry table — da6f9bf (#387 Security), 691481f (#396 Fixed), 5a6e229 (#400 Added/Changed), 6f9bef6 (#397 Changed), 5609c2a (#398 Changed), 5cbf34e (#399 Changed). Plus a6d2e98 is this stamp PR itself. No commits missing from CHANGELOG ✓
• KaC v1.1.0 section ordering in [0.18.4]: Added → Changed → Fixed → Security — correct ✓
• [Unreleased] placeholder is present and empty — correct, ready to receive new entries from the next Dependabot or feature PR (the auto-CHANGELOG workflow's idempotency guard handles this) ✓
• Repo-wide grep for stale 0.18.3 references: only one hit in .github/workflows/dependabot-changelog.yml:32 — illustrative comment using ## [0.18.3] - YYYY-MM-DD as a heading-format example, not a version reference. Not a finding ✓

Verdict

Ready for QA Signoff — handing off to maintainer for QA Approved + merge + tag + push (per the post-merge sequence in the PR body).

Headline of v0.18.4: operational memory-leak fix (#396) for long-running multi-tenant deploys, plus the end-to-end-validated Dependabot infra (#400 / #397 / #398) that will keep CHANGELOG hygiene self-maintaining from here forward.

🤖 Generated with Claude Code

[cmeans]

QA Audit — round 1

• Reviewed at head a6d2e98
• All 5 PR-defined manual checks verified clean (version bump, CHANGELOG date heading, comparison links, no source diff, pytest 1014/7)
• Commit completeness audit: all 6 prior PRs since v0.18.3 (#387, #396, #397, #398, #399, #400) accounted for in the [0.18.4] entry table
• KaC v1.1.0 section ordering correct (Added → Changed → Fixed → Security)
• Repo-wide grep: no stale 0.18.3 references that need bumping
• All 5 PR-body manual check checkboxes ticked
• Verdict: see review above

Label transitioning: QA Active → Ready for QA Signoff.