chore(release): prepare v1.0.40

Author: juancarlosrodicio

README.md

@@ -327,7 +327,7 @@ After a tagged release is published, you can install the same CLI directly
 from GitHub without keeping a checkout:
 
 ```bash
-npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.39"
+npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.40"
 oc-switch
 ```
 
@@ -741,7 +741,7 @@ Validate only the canonical identity and current release note with:
 
 ```bash
 npm run check:version
-node scripts/version.mjs --check-tag v1.0.39
+node scripts/version.mjs --check-tag v1.0.40
 ```
 
 Tag validation compares an explicitly supplied tag with the package identity.

docs/models.md

@@ -26,7 +26,7 @@ oc-switch
 Once a release tag exists, a checkout is optional:
 
 ```bash
-npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.39"
+npm install --global "git+https://github.com/jcarlosrodicio/opencode-agent-orchestration-kit.git#v1.0.40"
 oc-switch
 ```
 

docs/releases/v1.0.40.md

@@ -0,0 +1,55 @@
+# v1.0.40 - Safe lifecycle and canonical release identity
+
+This release publishes the reviewed portable mission runtime and strengthens
+the boundary between the public orchestration kit and private harness
+configuration.
+
+## Highlights
+
+- Add a durable mission-status projection for bounded loop workflows, including
+  iteration state, blocking cause, session identity, and the next safe action.
+- Add a read-only mission runtime observer that tracks root sessions, ignores
+  child-session noise and duplicate events, and reports optional TUI activity
+  without writing durable loop state.
+- Add a closed runtime permission policy and harness checks that keep agent
+  identities, tool decisions, delegation, and frontmatter contracts aligned.
+- Add an explicit public synchronization boundary and checks for excluding
+  private providers, MCP wiring, credentials, endpoints, paths, and raw runtime
+  evidence.
+- Improve package provenance, isolated installation and package smoke coverage,
+  rollback verification, and native tool-path performance baselines.
+
+## Installation or upgrade
+
+Install or upgrade the public kit using the normal manifest-owned flow:
+
+```bash
+./install.sh --dry-run
+./install.sh
+./upgrade.sh --dry-run
+./upgrade.sh
+./doctor.sh
+```
+
+After installation, run `oak check` and review the installed target before
+using the harness.
+
+## Migration
+
+No migration is required. Existing installation manifests without the optional
+release provenance block remain readable, and the new mission runtime state is
+created only by an explicit loop workflow.
+
+## Validation performed
+
+Release readiness passed with the public contract checks, 1,067 unit and
+script tests, typechecking, dependency vulnerability and signature audits,
+installation smoke, package smoke, rollback checks, compatibility checks, and
+the public-boundary leak scan.
+
+## Public safety boundary
+
+The public release excludes private OpenCode and Pi configuration, local
+providers and MCP wiring, credentials, authentication files, raw transcripts,
+private evidence, absolute machine paths, and runtime state. Pi uses its own
+native model catalog and is not included in this OpenCode package.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-agent-orchestration-kit",
-  "version": "1.0.39",
+  "version": "1.0.40",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",

scripts/benchmark-tool-paths.mjs

@@ -143,7 +143,7 @@ async function benchmarkFixture(fixture, iterations, temporaryRoot) {
         const result = await createInstallationManager({
           sourceRoot: fixture.sourceRoot,
           repositoryRoot: fixture.root,
-          versionProvider: () => "1.0.39",
+          versionProvider: () => "1.0.40",
         }).run("install", { targetRoot });
         if (result.exitCode !== 0) throw invalid(`installation benchmark failed for ${fixture.id}`);
       } finally {

scripts/package-smoke.test.mjs

@@ -17,7 +17,7 @@ import {
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const HASH = "a".repeat(64);
-const BASENAME = "opencode-agent-orchestration-kit-1.0.39.tgz";
+const BASENAME = "opencode-agent-orchestration-kit-1.0.40.tgz";
 const REQUIRED = [
   "package/package.json",
   "package/supply-chain.json",
@@ -210,7 +210,7 @@ test("smokeTarball validates both archive listings before extraction", async ()
   await assert.rejects(
     smokeTarball({
       repositoryRoot: ROOT,
-      tarball: "/public/opencode-agent-orchestration-kit-1.0.39.tgz",
+      tarball: "/public/opencode-agent-orchestration-kit-1.0.40.tgz",
       captureTarball(_source, destination) {
         fs.writeFileSync(destination, "fixture");
         return { size: 1 };

scripts/version.test.mjs

@@ -109,7 +109,7 @@ test("[V004] direct version entrypoints are exact and mutation-free", (t) => {
   for (const args of [["scripts/version.mjs"], ["scripts/manage-installation.mjs", "--version"]]) {
     const result = run(process.execPath, args, { HOME: home });
     assert.equal(result.status, 0, result.stderr);
-    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.39\n");
+    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.40\n");
     assert.equal(fs.existsSync(target), false);
   }
 });
@@ -118,7 +118,7 @@ test("[V005] all lifecycle wrappers expose the canonical version", () => {
   for (const wrapper of ["install.sh", "upgrade.sh", "doctor.sh", "uninstall.sh", "rollback.sh"]) {
     const result = run(path.join(REPOSITORY_ROOT, wrapper), ["--version"]);
     assert.equal(result.status, 0, `${wrapper}: ${result.stderr}`);
-    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.39\n", wrapper);
+    assert.equal(result.stdout, "opencode-agent-orchestration-kit 1.0.40\n", wrapper);
   }
 });