Release open-scaffold@0.34.0 — ambient capture trust package sync

[graphanov]

Status: issue intake captured.

Evidence:

• Public-safe request recorded below.

Request:

Summary

Prepare open-scaffold@0.34.0 as the next public package release. This replaces the earlier mistaken 0.4.0/0.5.0 target: 0.4.0 already exists on npm, and 0.5.0 is technically free but lower than the current npm latest (0.33.0), so publishing it as latest would regress the public package tag.

Evidence checked

• npm latest is open-scaffold@0.33.0.
• npm has no open-scaffold@0.34.0 entry.
• GitHub has no visible v0.34.0 release/tag.
• Release should be cut from origin/main, not the current feature branch.
• Mainline changes since v0.33.0 are:
  • chore(release): close out open-scaffold@0.33.0 — record publication proof #229 — record 0.33.0 publication proof closeout.
  • chore(deps-dev): bump @types/node from 25.9.3 to 26.0.0 in the development-dependencies group #230 — development dependency refresh for @types/node to 26.0.0.
  • docs: add MCP coding-agent quickstart #232 — MCP coding-agent quickstart docs.
  • Add ambient capture setup helper for Codex and Claude Code #236 — ambient capture setup helper for Codex and Claude Code.
  • Add ambient record verification and trust report #237 — ambient record verification and trust report.

Draft release notes

v0.34.0 — Ambient capture trust and setup package sync

What’s changed

v0.34.0 publishes the post-0.33.0 mainline work to the npm latest package surface. The release focuses on making ambient capture easier to install, safer to verify, and clearer for coding-agent/MCP onboarding.

Added

• Ambient capture setup helper for Codex and Claude Code, including dry-run/setup-all behavior and guarded config writes.
• Ambient record verification and trust-report behavior for validating captured records without exposing raw transcript contents.
• MCP coding-agent quickstart documentation.
• Additional capture fixtures and regression coverage for setup, rollback, record validation, token-fact failure cases, and safe output.

Changed

• Capture documentation now covers setup and verification paths more directly.
• Codex notify hook documentation reflects the ambient capture setup/verification flow.
• Development dependency baseline refreshes @types/node to 26.0.0.
• 0.33.0 release evidence is closed out as published/superseded history.

Boundaries

• Open Scaffold core still records and verifies repo-native work artifacts; it does not grant runtime, publish, merge, or release authority by itself.
• Ambient capture remains observational. Verification checks record shape/trust signals; it is not semantic correctness, compliance certification, or transcript truth beyond the captured evidence boundary.
• The release must be cut from origin/main. The current feature branch contains additional unmerged work and should not be included unless it lands first.

Links

• Previous release: https://github.com/graphanov/open-scaffold/releases/tag/v0.33.0
• npm current latest: https://www.npmjs.com/package/open-scaffold/v/0.33.0

Acceptance criteria

• package.json and lockfile version are bumped from 0.33.0 to 0.34.0.
• docs/CHANGELOG.md gets a v0.34.0 entry with the notes above and evidence links.
• A release evidence note is created for the package sync.
• Release PR links the source PRs and states no merge/publish/release authority was used by automation.
• After owner gate and trusted publishing, npm shows open-scaffold@0.34.0 as latest and GitHub Release v0.34.0 exists.

Verification observed during prep

• Quick repo compliance gate passed.
• 0.34.0 availability checked on npm/GitHub: not found.
• Release-target dry-run from origin/main after local version bump to 0.34.0 produced package id open-scaffold@0.34.0, tarball open-scaffold-0.34.0.tgz, and 228 files.
• origin/main verification before version bump: build passed; full test suite passed with 51 test files and 619 tests.

Verification to run in the release PR

• npm run build
• npm test
• npm pack --dry-run --json
• strict Open Scaffold verification
• post-publish smoke for open-scaffold@0.34.0

Owner gate

Publishing npm, creating/moving GitHub Release latest, and any tag/release action require explicit owner approval. This issue is release coordination only.

Next: triage follows the issue labels, forge capacity, and owner gates.

[graphanov]

Status: issue intake captured.

Evidence:

• Public-safe request recorded below.

Request:
Status: release-sync proceed intent recorded.\n\nEvidence:\n- Discord operator confirmed proceeding with the release-sync path.\n- Issue is already routed for implementation via .\n\nNext: prepare the release-sync PR from ; npm publish, tag creation, GitHub Release, and Latest movement remain owner-gated after review/merge.

Next: repo maintainers can use this comment as public context for the existing issue.

[graphanov]

Status: issue intake captured.

Evidence:

• Public-safe request recorded below.

Request:
Status: release-sync proceed intent recorded.

Evidence:

• Discord operator confirmed proceeding with the open-scaffold@0.34.0 release-sync path.
• Issue is already routed for implementation via ready-for-implementation.
• Corrects the immediately previous intake comment, which lost inline code values during shell quoting.

Next: prepare the release-sync PR from origin/main; npm publish, tag creation, GitHub Release, and Latest movement remain owner-gated after review/merge.

Next: repo maintainers can use this comment as public context for the existing issue.

[graphanov]

Status: issue intake captured.

Evidence:

• Public-safe request recorded below.

Request:
Status: release-sync PR merged; owner publish gate is next.

Evidence:

• PR Prepare open-scaffold@0.34.0 release sync #240 merged to main at 9fe5f1aa2e906860ded9f427cb8788eb311e75cb.
• main now has package.json version 0.34.0.
• Post-merge main CI passed.
• npm still shows latest as 0.33.0; open-scaffold@0.34.0 is not published yet.
• No v0.34.0 GitHub Release/tag is visible yet.

Next:

1. Owner runs the Publish npm package workflow on main with expected-version=0.34.0 and npm-tag=latest.
2. After the workflow succeeds, verify npm shows open-scaffold@0.34.0 and latest=0.34.0.
3. Create the v0.34.0 GitHub Release using the merged changelog/release-note text.
4. Run fresh install/post-publish smoke and record publication proof before closing Release open-scaffold@0.34.0 — ambient capture trust package sync #239.

Next: repo maintainers can use this comment as public context for the existing issue.

[graphanov]

Status: forge deferred this issue with status KILL.

Evidence:

• Reason: design found a hard owner/product gate
• Cycle: issue-239-20260628T185441Z
• Retry policy: hard stop — forge will not pick this up again until the issue changes or local defer state is cleared

Next: close/relabel the issue if repo truth says it is done/stale, or update the issue with narrower acceptance criteria to let forge reconsider it.

[graphanov]

Status: release publish observed; no maintainer PR action remains.

Evidence:

• PR Prepare open-scaffold@0.34.0 release sync #240 is merged and there are no open PRs. npm dist-tags now reports latest=0.34.0 and open-scaffold@0.34.0 exists. GitHub Release tag 0.34.0 is published from main. Post-publish temp-dir smoke: npm exec --yes --package=open-scaffold@0.34.0 -- open-scaffold --version -> 0.34.0. Local checkout is clean on main.

Next: Owner can close or relabel #239 after any desired publication-proof record; this tick did not merge, publish, tag, create a release, dispatch workflows, force-push, change settings, or touch secrets.

[graphanov]

Status: forge deferred this issue with status KILL.

Evidence:

• Reason: design found a hard owner/product gate
• Cycle: issue-239-20260628T213000Z
• Retry policy: hard stop — forge will not pick this up again until the issue changes or local defer state is cleared

Next: close/relabel the issue if repo truth says it is done/stale, or update the issue with narrower acceptance criteria to let forge reconsider it.