Skip to content

v108-release-notes.md

Latest commit

 

History

History
124 lines (98 loc) · 4.07 KB

v108-release-notes.md

File metadata and controls

124 lines (98 loc) · 4.07 KB
Raw

Code Mower v1.0.8 Release Notes

Code Mower v1.0.8 closes the remaining trust gaps found while dogfooding the multi-provider release-qualification campaign. It preserves supervised-pilot gate semantics, the Python 3.12+ requirement, and the metadata-only privacy boundary.

Install the pinned package:

export CODE_MOWER_PYTHON="$(command -v python3.12)"
pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.0.8
code-mower --version

Hosted agents and CI boxes can use:

uv tool install --python 3.12 code-mower==1.0.8
code-mower --version

What Is New

  • Codex and Claude audit verdict transport preserves valid metadata-only P3 findings with line 0 while still requiring actionable source lines for blocking P0/P1/P2 findings (#681, PR #715).
  • Campaign retries retain ordered attempt chronology and terminal failure evidence without persisting provider output (#711, PR #716).
  • Local adapters prove the requested Python 3.12+ runtime, truthful authentication readiness, and the expected closed result artifact (#710, PR #719).
  • Campaign status, watch, upload, and Board find the same campaign after a checkout or worktree changes through a metadata-only user index (#712, PR #720).
  • Release qualification can install the exact candidate from a closed TestPyPI source before production publication (#713, PR #723).
  • Cursor Cloud Agent is the builder identity, distinct from Cursor BugBot and Grok Bot reviewer identities (#717, PR #722).
  • Antigravity campaigns use explicit project identity and isolated execution rather than ambient IDE state (#721, PR #724).
  • Hosted Cursor Cloud Agent and Devin profiles require verified dispatch and result transport through five explicit readiness checks (#718, PR #725).

Run A Campaign

Qualify one provider environment against the exact release:

code-mower release qualify \
  --release-tag v1.0.8 \
  --package-spec code-mower==1.0.8 \
  --output adoption-result.json \
  --execute

Check the whole campaign posture and preview before applying:

code-mower doctor --adoption --repo OWNER/REPO
code-mower release campaign \
  --release-tag v1.0.8 \
  --package-spec code-mower==1.0.8 \
  --repo-slug OWNER/REPO

For a TestPyPI candidate, add --package-source testpypi. Applied hosted providers also require the issue that receives their trusted dispatch and result comments.

code-mower release campaign dispatch \
  --release-tag v1.0.8 \
  --apply \
  --repo-slug OWNER/REPO \
  --issue ISSUE_NUMBER
code-mower release campaign watch --release-tag v1.0.8

Preview the closed cloud bundle, then upload it explicitly:

code-mower release campaign upload --release-tag v1.0.8 --json
code-mower release campaign upload --release-tag v1.0.8 --yes --json

Qualification writes the closed code_mower.adoptionResult.v1 artifact. Campaign upload converts completed results into additive, metadata-only adoption_run events. It does not upload source, raw diffs, prompts, transcripts, issue body text, raw provider output, authentication output, local paths, or secrets.

Recommended Update

For an existing pipx install:

export CODE_MOWER_PYTHON="$(command -v python3.12)"
PIP_NO_CACHE_DIR=1 pipx install --force --python "$CODE_MOWER_PYTHON" code-mower==1.0.8
code-mower --version
code-mower board list

For hosted agents using uv:

uv tool install --python 3.12 --reinstall --refresh-package code-mower code-mower==1.0.8
code-mower --version

Restart a Board that still serves an older package. For existing repositories, review migration setup-drift output in a pull request before applying any generated changes.

Quality And Privacy Proof

The implementation PRs passed package CI on Python 3.12, 3.13, and 3.14, Gitar, and exact-head peer audits. Four exact-head audit rounds on the hosted transport work found and corrected readiness, remediation, and timeout defects before merge.

Campaign upload remains opt-in and metadata-only. It excludes source, raw diffs, prompts, transcripts, issue body text, raw stdout/stderr, authentication output, local paths, and secrets.