chore: prepare v1.0.39 release

Author: juancarlosrodicio

README.md

@@ -327,7 +327,7 @@ After a tagged release is published, you can install the same CLI directly
 from GitHub without keeping a checkout:
 
 ```bash
-npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.38"
+npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.39"
 oc-switch
 ```
 
@@ -732,7 +732,7 @@ Validate only the canonical identity and current release note with:
 
 ```bash
 npm run check:version
-node scripts/version.mjs --check-tag v1.0.38
+node scripts/version.mjs --check-tag v1.0.39
 ```
 
 Tag validation compares an explicitly supplied tag with the package identity.

docs/models.md

@@ -26,7 +26,7 @@ oc-switch
 Once a release tag exists, a checkout is optional:
 
 ```bash
-npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.38"
+npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.39"
 oc-switch
 ```
 

docs/releases/v1.0.39.md

@@ -0,0 +1,44 @@
+# v1.0.39 - Safe lifecycle and canonical release identity
+
+This release hardens the Open Design HTTP and SSE transport and its Docker
+entrypoint for bounded, fail-closed operation.
+
+## Highlights
+
+- Bound Open Design connection, total, and idle-read timeouts.
+- Bound JSON response bodies, SSE bytes, event counts, and captured output.
+- Keep transport failures and diagnostics from returning unbounded remote data.
+- Harden the Open Design Docker entrypoint's startup and signal lifecycle.
+
+## Installation or upgrade
+
+Install or upgrade the public kit using the normal manifest-owned flow:
+
+```bash
+./install.sh --dry-run
+./install.sh
+./upgrade.sh --dry-run
+./upgrade.sh
+```
+
+After installation, run `oak check` and review the installed target before
+using the harness.
+
+## Migration
+
+No migration is required. Existing Open Design configuration remains valid;
+requests that exceed the transport budgets now fail closed with bounded error
+messages.
+
+## Validation performed
+
+The public contract checker, unit and script tests, type checks, dependency
+audits, signature checks, installation smoke, package smoke, and canonical
+version/tag checks pass for this release.
+
+## Public safety boundary
+
+The public release excludes private OpenCode and Pi configuration, local
+providers and MCP wiring, credentials, authentication files, raw transcripts,
+private evidence, absolute machine paths, and runtime state. Pi uses its own
+native model catalog and is not included in this OpenCode package.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-agent-orchestration-kit",
-  "version": "1.0.38",
+  "version": "1.0.39",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",

scripts/package-smoke.test.mjs

@@ -17,7 +17,7 @@ import {
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const HASH = "a".repeat(64);
-const BASENAME = "opencode-agent-orchestration-kit-1.0.38.tgz";
+const BASENAME = "opencode-agent-orchestration-kit-1.0.39.tgz";
 const REQUIRED = [
   "package/package.json",
   "package/supply-chain.json",
@@ -210,7 +210,7 @@ test("smokeTarball validates both archive listings before extraction", async ()
   await assert.rejects(
     smokeTarball({
       repositoryRoot: ROOT,
-      tarball: "/public/opencode-agent-orchestration-kit-1.0.38.tgz",
+      tarball: "/public/opencode-agent-orchestration-kit-1.0.39.tgz",
       captureTarball(_source, destination) {
         fs.writeFileSync(destination, "fixture");
         return { size: 1 };

scripts/version.test.mjs

@@ -109,7 +109,7 @@ test("[V004] direct version entrypoints are exact and mutation-free", (t) => {
   for (const args of [["scripts/version.mjs"], ["scripts/manage-installation.mjs", "--version"]]) {
     const result = run(process.execPath, args, { HOME: home });
     assert.equal(result.status, 0, result.stderr);
-    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.38\n");
+    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.39\n");
     assert.equal(fs.existsSync(target), false);
   }
 });
@@ -118,7 +118,7 @@ test("[V005] all lifecycle wrappers expose the canonical version", () => {
   for (const wrapper of ["install.sh", "upgrade.sh", "doctor.sh", "uninstall.sh", "rollback.sh"]) {
     const result = run(path.join(REPOSITORY_ROOT, wrapper), ["--version"]);
     assert.equal(result.status, 0, `${wrapper}: ${result.stderr}`);
-    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.38\n", wrapper);
+    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.39\n", wrapper);
   }
 });