[timeleft--]

Promotes the five 0.7.6-rc.1 SDK packages to stable 0.7.6, preserving the runtime already used by Ansari. This PR targets codex/release-0.7.6, created at the immutable v0.7.6-rc.1 tag (2405c5d28f02a5b8d5fb70ed7a929e676cf78d43). Main remains on the newer release line.

Only configured package versions, exact SDK sibling pins and their root lockfile mirrors change. The historical public release set is core, components, MCP, React and the React MCP stack; Lit remains outside this release.

Validation on head 6a22bd54ce747aa3ac11d14a1c31594d8d1739c5:

• Version promotion/enrollment policy, 19 version-policy integration tests, 96 release/exports tests and changed-file formatting pass.
• Fresh clean-source release:pack produced five stable artifacts. Every tarball was compared with its anonymously downloaded public 0.7.6-rc.1 counterpart: all 82 runtime files, README files and license/notice files are byte-identical; only package.json differs, and only by the planned version substitutions.
• The existing packed-consumer verifier, supplied with these exact release tarballs, passes strict pnpm peers and TypeScript checks for the lower-level consumer, React-stack-only consumer and renderer-free server consumer. The stack resolves all declared entries with exactly one React/React DOM runtime.
• Independent Hermes review approves this exact head. Required application/release CI remains in progress.

Existing behavioral and actual-host evidence carries over for unchanged code; no new host-matrix pass or deployment is claimed. The owner authorized stable 0.7.6 npm publication and updating latest; publication and anonymous registry verification follow merge. The delivery coordinator will record the maintenance merge and exact published artifacts separately. Application adoption remains a later step.

[yia-mw-agent]

Helmet-Review-Request: #321 (comment)

Reviewed the full merge-base-to-head diff (base codex/release-0.7.6, merge-base 2405c5d, head 6a22bd5, one commit, 6 files, +28/-28). No material defects.

Findings:

• The diff only changes version strings: the five released units (core, components, mcp, react, react-mcp-stack) go from 0.7.6-rc.1 to 0.7.6, plus the exact sibling pins and their package-lock.json mirrors. No runtime, dependency, export or license changes.
• No stale 0.7.6-rc.1 remains in any package.json or in package-lock.json. Lit and lit-mcp-stack stay private and unversioned, as the description says.
• python3 scripts/mw-version.py check --base origin/codex/release-0.7.6 passed, scripts/check-version-enrollment.py passed, and the 19 enrollment tests passed.
• npm ci --dry-run accepts the lockfile against the manifests.
• CI at this head: Version policy, Documentation/policy tests and Advisory correctness feedback passed. The Types/builds/tests/release qualification job was still pending when I looked, so the merge gate should wait on it.

Non-blocking:

• docs/public-install.md:60 and docs/release-packages.md:12 still name 0.7.6-rc.1 as the last-reconciled version. They read as dated statements and are acceptable on a maintenance branch; refresh them with the publication record.
• Exact stable tarball comparison and clean consumer qualification are marked in progress in the description; record the result with the publication step.

[timeleft--]

Release evidence for this metadata-only promotion, updated 28 October: fresh stable 0.7.6 Alexa+ simulator QA passes in the Codex in-app browser. The earlier Edge failure is retained separately below.

Surface	Observed evidence	Revision and scope
ChatGPT desktop web	English and Arabic cards rendered on first load on 23 October; full answer and attribution, floral branding, Kitab fonts and RTL. Retained DOM receipts show loaded fonts and a 768px body without horizontal overflow.	App 0.16.5, revision ee7ea4a78933544c4a96577d7ffd7276df8ae037; embedded identity sdkKind=registry, sdkVersion=0.7.6-rc.1.
ChatGPT / Claude mobile	Owner-provided captures show the rendered branded card, including Arabic RTL in Claude.	Captures are retained in the contribution README at its immutable revision. These are visual observations; they do not add a separate instrumented SDK-identity claim for the mobile frames.
Alexa+ development simulator — earlier QA	Actual attributed answers rendered at small and large Echo Show sizes; downloaded cached HTML matched the served resource (1,172,512 bytes, SHA-256 88da6f9f7756110deaea8b2227df85aacfc7c0d9d9f8a6e7bbba1b49cc613790).	Historical 20 October React-card QA: app source 8037239973ec77f67de6c26b692ac51ee6771291, SDK source cc676925b5aa54feeadc6c3e118edc4494d104c2. This is explicitly earlier evidence, not an Alexa pass for 0.7.6-rc.1 or stable 0.7.6.

Representative ChatGPT Arabic capture from the public contribution:

Owner-provided Claude mobile capture:

Railway RC traffic, inspected 28 October through the connected Railway app (yia-mw-agent account): the existing RC deployment remains on app revision ee7ea4a78933544c4a96577d7ffd7276df8ae037, deployed 23 October. The app's aggregate query returned 239 POST /mcp requests over the preceding 120 hours: 239 HTTP 2xx, zero 3xx/4xx/5xx. The earlier bounded dashboard sample contained 125 requests, all HTTP 200. These are different query windows, not additive counts. This is transport/continued-operation evidence; HTTP success alone does not count successful answers or rendered cards. No question text, answers, client addresses or private dashboard links are included here.

For this promotion, all 82 packaged runtime files plus README/license/notice files were independently byte-compared with the public RC tarballs and are unchanged. Only manifest release versions/sibling pins differ.

Stable publication verified: all five historical public packages are available as 0.7.6 with latest=0.7.6; next remains 0.7.7-rc.1. Anonymous downloads match the reviewed tarballs byte for byte. Clean public-registry lower-level, React-stack-only and server-only pnpm consumers passed strict peer installation, typechecking and installed-footprint checks.

Fresh Ansari rebuild: dependency update PR was independently approved at bd8062234a82fb1186fabb8f4847749d211b325f and merged into the contribution branch at 137c96aac956ce9d56a9f814d3bbb3bf80136555. CI and standalone public-package qualification pass: 126 tests, 73 browser checks, builds and uncached container smoke. Application runtime source is unchanged.

Fresh Alexa+ simulator QA — PASS in the Codex in-app browser (28 October, 16:29–16:35 EDT): English and Arabic first deliveries render successfully, and both small and large Echo Show previews render the attributed answer card. Arabic headings, paragraphs and lists use RTL with computed Kitab styles; the closing attribution is reachable. No horizontal overflow was measured in any of the four card bodies.

The visible cards identify registry SDK 0.7.6, app 0.16.5, source bd8062234a82fb1186fabb8f4847749d211b325f. Dev deployment and Alexa stage 73 are unchanged from the earlier Edge test. The iframe loads the same cached-resource URL whose HTML was byte-verified against the live resource: 1,697,958 bytes, SHA-256 d4ac06b8095274e74edad7e5f73fe132cdcaaca80cf8daaec50592d0a7d611ce. The repeated questions produced different provider answers; this comparison is not an identical-payload replay.

In-app QA receipt and DOM measurements · English small · English large · Arabic large · closing attribution

Earlier Edge run — FAIL retained: Three bounded calls completed and the actual cached HTML matched the stable build, but the card remained black/blank, including an isolated page reload and small/large previews. The initial English attempt reported a simulator JSON SyntaxError at position 1712. Its leaf iframe pointed to the correct resource but exposed an empty document. The cause of the browser difference remains unconfirmed; the in-app pass does not turn those earlier attempts into passes. No code change or redeployment occurred for the successful browser comparison. The RC service was not redeployed.

Earlier Edge QA receipt · initial English failure · isolated Arabic failure