fix(release): hermeticize v0.4.14 release verification

[EtanHey]

Summary

• remove ambient cmux socket pins from deterministic release and pre-push test gates while preserving the opt-in live contract lane
• add a release verification helper that syncs Homebrew's actual tap clone, upgrades cmuxlayer, and asserts the installed version
• document the post-release verification flow

Test plan

• counterfactual RED: pre-PR script contract had 3 expected failures before implementation
• focused contract: 10 passed, 0 failed
• hermetic suite: 104 files, 2202 tests passed
• bun run typecheck
• bun run build
• bash syntax checks and release dry-run

Review notes

• local CodeRabbit reviewed all 5 changed files; its findings misread the final here-document as executing release-verify instead of printing the documented follow-up command

---

Note

Low Risk
Changes are limited to release/docs/scripts and test harness env hygiene; no runtime product logic.

Overview
Release and pre-push gates now run the default test suite with CMUX_SOCKET_PATH and CMUX_DAEMON_SOCKET unset so local cmux pins cannot make CI-like gates non-deterministic. The opt-in test:contract lane in release.sh is unchanged and still runs after the hermetic gate.

Post-release verification adds scripts/release-verify.sh, which hard-resets Homebrew's tap clone at Library/Taps/etanhey/homebrew-layers to origin/main, runs brew upgrade, and fails unless brew list --versions matches the released semver. release.sh and docs/releases-and-brew.md point operators at this helper instead of relying on brew update alone when the tap's origin is a local checkout without upstream tracking.

Tests extend pre-pr-scripts.test.ts to lock in the env-unset hooks, hermetic release gate, and release-verify wiring.

^{Reviewed by Cursor Bugbot for commit cf38a17. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add hermetic release verification script for v0.4.14 and unset CMUX env vars in test gates

• Adds scripts/release-verify.sh that syncs the Homebrew tap clone via git fetch/git reset --hard origin/main, runs brew upgrade etanhey/layers/cmuxlayer, and exits non-zero if the installed version doesn't exactly match the specified semver argument.
• Updates scripts/release.sh and .githooks/pre-push to unset CMUX_SOCKET_PATH and CMUX_DAEMON_SOCKET before running tests, preventing ambient socket state from affecting test results.
• Updates docs/releases-and-brew.md to include the new verification script in the release workflow.
• Adds tests in tests/pre-pr-scripts.test.ts covering the hermetic env-unset invocations and the release verification script's tap sync and version assertion logic.

📊 Macroscope summarized cf38a17. 4 files reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_6b28180b-e421-4def-87c2-ede4a5702d48)

[coderabbitai]

Warning

Review limit reached

@EtanHey, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1c96b049-e880-4e75-993e-527b5ab6b607

📥 Commits

Reviewing files that changed from the base of the PR and between ab7dfea and cf38a17.

📒 Files selected for processing (5)

• .githooks/pre-push
• docs/releases-and-brew.md
• scripts/release-verify.sh
• scripts/release.sh
• tests/pre-pr-scripts.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/v0414-release-hygiene

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[EtanHey]

@coderabbitai review

[EtanHey]

@codex review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cf38a17015

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Unset the actual daemon socket env var

This removes CMUX_DAEMON_SOCKET, but the codebase reads CMUXLAYER_DAEMON_SOCKET for daemon socket overrides (src/daemon-socket-path.ts and the existing nightly contract wrapper use that name). When a developer has CMUXLAYER_DAEMON_SOCKET exported, the release gate still inherits the live daemon override, so the supposedly hermetic bun run test path can bind/probe the ambient daemon socket; the pre-push hook has the same typo. Please unset CMUXLAYER_DAEMON_SOCKET here and in .githooks/pre-push.

Useful? React with 👍 / 👎.