Release v0.3.5

[sanil-23]

Version bump for v0.3.5, routed through a PR because the release workflow can no longer push it directly.

Why this is a PR and not the workflow's own commit

The Protect Main ruleset (id 24168751, created today 09:06 UTC) requires the Rust status check on main and has no bypass actors. The workflow's Prepare release job pushes the bump straight to main as github-actions[bot], and a direct push carries no check, so the ruleset rejects it — run 36555489654:

[main 6df9add] Release v0.3.5
remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Required status check "Rust" is expected.
 ! [remote rejected] HEAD -> main (push declined due to repository rule violations)

Every gate passed before that point — fmt, clippy -D warnings, build, test, the 90%-per-file coverage check, docs. It is a release-path/ruleset conflict, not a problem with the tree. v0.3.4 released cleanly on 2026-09-28, before the ruleset existed, which is why this is the first release to hit it.

Going through a PR satisfies the rule on its own terms: Rust runs here, so the bump lands on main checked rather than around the check.

Contents

Exactly what the workflow's Update crate version step produces:

• [workspace.package] version → 0.3.5
• Cargo.lock via cargo update --workspace (the two workspace members; both inherit with version.workspace = true)

2 files changed, 3 insertions(+), 3 deletions(-) — the same shape as 418f9c0 Release v0.3.4.

After this merges

1. Push the v0.3.5 tag at the merge commit — the ruleset targets branches, so tags are unaffected.
2. Run Release with bump=current, which skips the version edit and the push (if: inputs.bump != 'current') and goes to bundling plus gh release create --verify-tag.

What v0.3.5 carries

• fix(stdio): spawn the command the preflight resolved (Windows: every bare-name stdio server fails) #26 — Windows: spawn the command the preflight resolved, so bare-name stdio MCP servers (npx, uvx) start at all
• feat(tools): expose server tools as tinytools with a persistent tool cache #27 — mcp-tool-cache

Worth a separate decision

The release workflow is currently unable to complete for anyone, not just this release. A permanent fix is either a bypass actor for the Actions token, or reshaping the workflow to bump via PR by default. Whoever added the ruleset this morning is best placed to choose; this PR only unblocks v0.3.5.

🤖 Generated with Claude Code

[tinysweeper]

Tiny Sweeper review

This pull request bumps the workspace package version from 0.3.4 to 0.3.5 and updates Cargo.lock accordingly. The change is minimal and follows the established release pattern. No problems are introduced.

State: Incomplete
Priority: none
Reviewed head: 9b69e38be8a2
Updated: 1790686828 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	2

Completeness: Incomplete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

version bump from 0.3.4 to 0.3.5 in workspace.package, plus Cargo.lock update

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Could not review: Cargo.toml

Before merge

• Complete the critique review for Cargo.toml.
• Complete the security review for Cargo.toml.

Agent review details

critique

• Conclusion: Neutral
• Scope reviewed: incomplete; unanswered: Cargo.toml
• Lane summary: Reviewed 0 files; 0 findings. 1 file could not be reviewed: Cargo.toml.

security

• Conclusion: Neutral
• Scope reviewed: incomplete; unanswered: Cargo.toml
• Lane summary: Reviewed 0 files; 0 findings. 1 file could not be reviewed: Cargo.toml.

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This pull request bumps the workspace package version from 0.3.4 to 0.3.5 and updates Cargo.lock accordingly. The change is minimal and follows the established release pattern. No problems are introduced. _The code index is behind this pull request (indexed at `68f6a4f5bad4`), so retrieved context may be out of date._ _Memory was unavailable (model: cortex: v1/recall: timed out after 10s), so this review ran without it._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: ladder/vectors, deepseek/deepseek-v4-flash
• Spend: $0.000585
• Tokens: 5092 input · 1377 output · 1024 cached · 27 embedding

Head	State	Pass summary
9b69e38be8a2	incomplete	0 active finding(s), 0 resolved finding(s) (at 1790686828)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a6ef0170-9c4a-4941-809c-724b80eda98c

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: Cargo.toml.

             $0.0006 · 5,092 in / 1,377 out · 1,024 cached (20%) · ladder/vectors, deepseek/deepseek-v4-flash · 27 embedded
description: $0.0005 · 3,861 in / 1,268 out · 1,024 cached (27%) · deepseek/deepseek-v4-flash