[Daniel Meppiel (danielmeppiel)]

ship(release): prepare v0.35.0

Description

TL;DR

Prepare v0.35.0 with 37 user-facing changelog entries dated 2026-10-22 and matching versions in pyproject.toml and uv.lock. The cycle warrants a minor bump because it adds opt-in root source replacements and candidate schema contracts. This PR changes release metadata only; tagging, publication and specification ratification remain separate decisions.

Important

The full local lint mirror passed. This is not a claim that full release validation is green: the latest inspected nonpublishing dispatch failed on an earlier main revision, and no test suite or binary build was run for this preparation.

Problem (WHY)

• The merged root replace capability in add(deps): support consumer-root source replacements #3309 adds a manifest surface, triggering row 3 of the repository's release rubric, rather than a patch-only cycle.
• The existing Unreleased section omitted merged user-facing fixes and listed fix(audit): fail closed when an explicit --policy cannot be loaded #3230 twice. The release notes now keep one concise entry per included PR, applying "Add what the agent lacks, omit what it knows".

Approach (WHAT)

• Reconcile GitHub PR records with first-parent history from v0.34.0 through main 52415c281: 49 merged PRs, comprising 37 user-facing changes and 12 internal-only changes.
• Preserve contributor credit, earlier release history and the proposed status of OpenAPM amendments; retain an empty Unreleased placeholder.
• Refresh version metadata without upgrading dependencies, and leave release qualification and the post-merge tag to the maintainer.

Why MINOR (0.35.0), not PATCH (0.34.1)

The new root replace manifest capability (#3309, rubric row 3) and distinct candidate schema contracts (#3308 and #3309, row 4) require a minor bump. The remaining entries repair existing behavior. The project remains pre-1.0; this is not a new API-stability commitment or adoption of the proposed specifications.

Implementation (HOW)

File	Intent and boundary
CHANGELOG.md	Add the approved dated release section; consolidate #3230 under Security and preserve all earlier releases.
pyproject.toml	Set the package version to 0.35.0; dependency requirements are unchanged.
uv.lock	Set the editable root package version to 0.35.0; all external versions, hashes, URLs and timestamps are unchanged.

Diagrams

The dashed nodes are the three files changed here; review, qualification and tagging remain human-gated steps outside this preparation.

flowchart LR
    subgraph Prep["This PR"]
        C["CHANGELOG.md: 37 release entries"]
        V["pyproject.toml: 0.35.0"]
        L["uv.lock: apm-cli 0.35.0"]
        V --> L
    end
    C --> R["Release PR"]
    L --> R
    R --> H["Human review and merge"]
    H --> T["Human tags v0.35.0 after qualification"]
    T --> W["Existing release workflow"]
    classDef new stroke-dasharray: 5 5;
    class C,V,L new;

Loading

Trade-offs

• Choose a curated user-facing changelog rather than a commit dump. The enumeration helper missed merge-commit PRs and included older side-branch history, so live GitHub merge SHAs were reconciled against first-parent history; internal-only fix(tests): align full-route fixtures with canonical receipt contracts #3353 landed during preparation without changing the approved notes.
• Keep this an asset/version-bump-only PR, not another implementation or release-validation campaign. Scenario Evidence is omitted under that skip clause; tests, binary builds, specification ratification and publication are explicitly outside this PR's executed scope.

Benefits

1. Both package-version sources agree on 0.35.0.
2. All 37 included PRs appear exactly once, with external contributor attribution retained.
3. Prior release sections and every external dependency pin remain unchanged.

Issue and approved scope

Issue: Fixes #3354.

Human scope-approval comment: no separate human-authored GitHub approval comment was created by this automation. The linked issue transparently records Daniel Meppiel (@danielmeppiel)'s explicit session approvals of v0.35.0, the changelog diff, the bounded version/lint/PR scope and this tracking issue. It is not presented as a machine-verified apm-scope:v1 comment.

This PR completes release preparation only. Review contact: Daniel Meppiel (@danielmeppiel). Full release qualification, merge, tag and publication remain separate.

Type of change

• Bug fix
• New feature
• Documentation
• Maintenance / refactor

Testing

• Tested locally
• All existing tests pass
• Added tests for new functionality (if applicable)

Validation

Checks ran with main 52415c281 integrated. Only the three release files changed afterward; no product source was edited. Results below are local, not hosted-PR CI results.

Exact command	Result
bash .agents/skills/cut-release/scripts/bump-version.sh 0.35.0	Passed; generated lock refresh contained unrelated upload-time churn, removed after proving it was the only non-version difference.
uv lock --check	Passed after normalization; 107 packages resolved.
bash .agents/skills/cut-release/scripts/verify-lint-mirror.sh	Passed all four steps.
uv run --frozen --extra dev ruff check src/ tests/ scripts/lint_architecture_boundaries.py scripts/architecture_linter/ scripts/windows_native_symlink_probe_entry.py	Passed.
uv run --frozen --extra dev ruff format --check src/ tests/ scripts/lint_architecture_boundaries.py scripts/architecture_linter/ scripts/windows_native_symlink_probe_entry.py	Passed; 2091 files already formatted.
uv run --frozen --extra dev python -m pylint --disable=all --enable=R0801 --min-similarity-lines=10 --fail-on=R0801 src/apm_cli/ scripts/lint_architecture_boundaries.py scripts/architecture_linter/ scripts/windows_native_symlink_probe_entry.py	Passed; 10.00/10.
bash scripts/lint-auth-signals.sh	Passed.
bash scripts/lint-architecture-boundaries.sh	Passed; exit 0.
git diff --check	Passed.
uv run --frozen apm --version	Passed; reported 0.35.0.

The YAML I/O, portable-relative-path and 2100-line guards also passed using the CI regexes and covered paths in Python. An initial shell attempt lacked rg; its success-shaped output was discarded, and the guards were re-executed successfully.

Verbatim local output excerpts

bash .agents/skills/cut-release/scripts/verify-lint-mirror.sh:

=== verify-lint-mirror summary ===
  ruff check                     PASS
  ruff format --check            PASS
  pylint R0801 duplication       PASS
  auth-signals boundary          PASS
[+] all lint-mirror checks PASSED

uv run --frozen apm --version (before the release commit):

Agent Package Manager (APM) CLI version 0.35.0 (52415c281)

The diagram was rendered successfully with npx --no-install --package @mermaid-js/mermaid-cli mmdc -i release-diagram.mmd -o release-diagram.svg --quiet using session-artifact paths. Release-note assertions passed for exact PR coverage, unique entries, external attribution, ASCII text and unchanged prior releases.

Not run: pytest suites, PyInstaller builds, package publication or release tagging. The latest inspected full nonpublishing dispatch 39784442659 failed on earlier main abd363ff7; subsequent #3353 repairs test fixtures but explicitly leaves the macOS ARM timeout unresolved. The successful push build 39794865082 is not a substitute for full release qualification.

How to test

• Run uv lock --check; expect exit 0 without modifying the lockfile.
• Run uv run --frozen apm --version; expect 0.35.0 and the actual checkout revision.
• Run the helper and expanded lint commands above; expect every command to exit 0.
• Compare this PR with main; expect only CHANGELOG.md, pyproject.toml and the root package version in uv.lock to change.
• Before tagging, obtain successful full release qualification for the intended main revision; do not infer it from local lint.

Spec conformance (OpenAPM v0.1)

If this PR changes behaviour that an OpenAPM v0.1 req-XXX covers,
confirm the three-step ritual in the
development guide:

• Spec edit: docs/src/content/docs/specs/openapm-v0.1.md updated
  (new/changed <a id="req-XXX"></a> anchor + prose + Appendix C
  row).
• Manifest edit: docs/src/content/docs/specs/manifests/openapm-v0.1.requirements.yml
  updated.
• Test edit: a @pytest.mark.req("req-XXX") test under
  tests/spec_conformance/ added or extended.
• CONFORMANCE.{md,json} regenerated via
  uv run --extra dev python -m tests.spec_conformance.gen_statement
  and committed.
• N/A -- this PR does not change OpenAPM-observable behaviour.

Post-merge

After the release PR is merged and release qualification is complete, the maintainer can tag v0.35.0 to trigger the release workflow:

git tag v0.35.0
git push origin v0.35.0

No tag was created or pushed by this session.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Daniel Meppiel (danielmeppiel)]

Docs sync advisory

Verdict: unavailable * Pages affected: undetermined * LLM calls: 1/15 * Took: not recorded

The classifier could not access file-reading or command-execution tools and returned an invalid classifier result. The advisory run stopped at schema validation; no documentation-impact verdict is claimed, and no panel, documentation edits or companion PR followed.

This is an advisory tooling failure, not a release lint failure or a merge gate. The release PR's local validation evidence remains separate.

[Copilot]

🟢 Approval recommended

The metadata-only changes are consistent with the bounded preparation scope, with no identified blocking defects; full release qualification remains required before tagging.

No open issues 🎉

What changed in this PR

Prepares v0.35.0 through release notes and matching package metadata only. Release qualification, specification ratification, tagging and publication remain separate decisions.

Changes:

• Adds a dated release section with 37 user-facing entries, preserving contributor credit and an empty Unreleased section.
• Updates both package-version sources to 0.35.0 without changing external dependencies.
• Retains explicit caveats for proposed schema and source-replacement contracts.

File	Description
uv.lock	Updates the editable root package version to 0.35.0.
pyproject.toml	Sets the project version to 0.35.0.
CHANGELOG.md	Consolidates and dates the v0.35.0 release notes.

_{Review effort: Balanced}