feat(runtime): pin published gentle-ai v4.0.0

[Alan-TheGentleman]

Linked Issue

Closes #1643

PR Type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Summary

• Pin the published, signed Gentle AI v4.0.0 archives and extracted-binary digests for darwin/linux amd64/arm64.
• Move the Windows source install to the github.com/gentleman-programming/gentle-ai/v4 module path with its SumDB checksum and tag commit, and point the ODD routing mirror's Go imports at /v4.
• Add the 4.0.0 NATIVE_CLI_CONTRACTS row. The published binary still reports gentle-ai.review-integration/v2 with capabilities/v2.6, and the review-provider contract stays 1.2.0, so no new capability identity is needed.

Changes

File	Change
scripts/gentle-ai-installer.mjs	INSTALLER_VERSION 4.0.0, archive/binary digests, Windows /v4 module path, SumDB Sum, tag commit
scripts/mirror-odd-routing.mjs	Go imports /v3/internal/... → /v4/internal/...
scripts/verify-package-files.mjs	Verifier text for the v4.0.0 runtime
lib/native-review-cli.ts, runtime/native-review-cli.mjs	4.0.0 contract row (runtime regenerated)
lib/review-risk-assessment.ts, runtime/review-risk-assessment.mjs	Comment no longer claims v3.7.0 is the current pin
tests/*	Pin, digest, module-path, fixture, manifest and contract-row assertions for v4.0.0
docs/readme-reference.md, docs/gentle-shell.md	Current-pin statements
odd/tasks/pin-gentle-ai-4.0.0-release.md	ODD task record with upstream evidence

Test Plan

• Upstream evidence: checksums.txt verified all four archives and the provider contract; extracted binaries hashed; go mod download -json github.com/gentleman-programming/gentle-ai/v4@v4.0.0 against sum.golang.org for the Windows Sum; v4.0.0 go.mod declares /v4; published binary review capabilities reports capabilities/v2.6.
• Test-first: published Gentle AI v4.0.0 is the installer pin failed (3.7.0 vs 4.0.0) before the installer change, then passed.
• Independent verification with the v4.0.0 binary installed locally: pnpm test → 4570 tests, 4536 pass, 0 fail, 34 Windows-only skips; check:runtime-modules → 8 modules match; verify-package-files → passed (69 byte-pinned contract artifacts); typecheck → 187 diagnostics, no regressions; git diff --check clean.
• node scripts/test-packed-runner.mjs → packed package E2E passed against the real published v4.0.0 assets.
• Not run: a real Windows Go source build against SumDB (covered by fixtures only).
• Native review (review-reliability): approved and acknowledged; three non-blocking advisories recorded as follow-ups.

Checklist

• Linked an approved issue
• Exactly one type:* label
• Tests cover the behavior change
• Docs updated where behavior changed
• Conventional commit format
• No Co-Authored-By trailers

Summary by CodeRabbit

• Updates
  • The Gentle AI runtime pin has been updated from v3.7.0 to v4.0.0. Installer assets and Windows source-build details now match the new version across supported platforms.
  • The documented runtime version and installation references have been updated. This version change does not indicate that a new package release has been published.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3b07b0da-d102-494d-9db4-78227cb9d394

📥 Commits

Reviewing files that changed from the base of the PR and between afb4549 and e628789.

📒 Files selected for processing (15)

• docs/gentle-shell.md
• docs/readme-reference.md
• lib/native-review-cli.ts
• lib/review-risk-assessment.ts
• odd/tasks/pin-gentle-ai-4.0.0-release.md
• runtime/native-review-cli.mjs
• runtime/review-risk-assessment.mjs
• scripts/gentle-ai-installer.mjs
• scripts/mirror-odd-routing.mjs
• scripts/verify-package-files.mjs
• tests/gentle-ai-binary.test.ts
• tests/gentle-ai-installer.test.ts
• tests/native-review-capability-contract.test.ts
• tests/package-manifest.test.ts
• tests/review-risk-assessment.test.ts

 ____________________________________________
< Let's git serious about your code quality. >
 --------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}