Release checklist

• Candidate: OKF Workbench 0.2.1
• Target identifier: straydog.okf-workbench
• Registry: Open VSX
• Published 0.2.1 disposition: Released on 2026-07-28; the signed tag, GitHub Release, Open VSX package set, package-manager manifests, and available post-publication lifecycle checks passed
• Publication authority: a matching signed v* tag pushed for a reviewed commit contained in main

This checklist prepares and records the 0.2.1 patch release. It does not make 0.2.0 evidence apply to new bytes. The candidate fixes orphan-only sidebar warning counts and hidden-Webview graph refresh delivery without changing the OKF compatibility contract, dependencies, or renderer. All checked pass results below bind the named 0.2.1 revisions and artifacts. They establish the published release facts but do not qualify the current Rust/Wasm source candidate.

The completed 0.2.0 release record is archived at docs/releases/0.2.0.md.

Release blockers

• The project remains MIT licensed and the root license and manifest agree.
• The locked production graphs remain 78 npm runtime packages and 26 Rust/Wasm dependencies; generated notices are current.
• The production-only npm audit reports zero vulnerabilities.
• PR #40 passed required CI and CodeQL checks before the two fixes were merged to main.
• Fixed-toolchain local source, Rust, unit, acceptance, dependency, security, and browser gates passed with Node.js 24.18.0, npm 11.16.0, and Rust 1.92.0.
• Local VS Code integration passed on minimum 1.121.0 and genuine current 1.129.1; all 16 Webview browser tests passed.
• A fresh genuine headed VS Code 1.129.1 capture for 0.2.1 passed QR-002 at 677 ms p95 across 20 samples, passed QR-003 with d3 selected, and recorded zero remote HTTP(S)/WS or other-scheme Webview requests.
• The local universal VSIX passed the closed-set package, license/notices, packaged security, and production audit gates. It is 978322 bytes with SHA-256 7a88adb4091d2de5c5e5f99310257153f97cb829db8d9e2f6fd0d2d29e723073; this is local pre-merge evidence, not the final hosted digest.
• The orphan-only sidebar state and hidden-graph post-write refresh were manually verified in dark, light, and dark high-contrast themes. The sidebar exposed zero curation warnings and two separately identified orphan concepts, the restored graph reported current data without an interaction-error dialog, and keyboard focus traversed the Resources tree.
• The immutable merged packaged candidate revision is 80ae7d560337cbe8d97af864c77aee410d5e5988; this evidence update changes documentation only.
• Compatibility run 30335399539 passed acceptance/Webview and all seven editor/OS lifecycle lanes for that revision, using the published v0.2.0 universal VSIX as the verified upgrade predecessor.
• Package smoke run 30335400890 passed the browser boundary, all four target packages, and aggregate package-set consistency for the same revision.
• Repository secret names OPEN_VSX_TOKEN, TAP_REPO, and STRAY_TOOLS_TOKEN exist. Their values remain unreadable and must be validated only by the tagged workflow.
• On 2026-07-28, the maintainer requested this release. Publication remains fail-closed on every unchecked gate above.

Version, changelog, and links

• package.json, package-lock.json, the Cargo workspace, the Rust lockfile, package validation, and version assertions agree on 0.2.1.
• CHANGELOG.md contains one dated 0.2.1 entry and no Unreleased heading.
• The extension identifier remains straydog.okf-workbench.
• The public manifest retains the approved repository, issue, homepage, privacy, support, security, license, and notice routes.
• No dependency, remote runtime resource, telemetry, account, upload, or AI-provider flow was added.

Build the immutable candidate

1. Freeze all packaged inputs, merge the release PR, and record its exact main revision.
2. Use Node.js 24.18.0, npm 11.16.0, Rust 1.92.0, and the installed wasm32-unknown-unknown target.

3. Install from committed lockfiles and run:

   mise x node@24.18.0 -- npm ci
   mise x node@24.18.0 -- npx --no-install playwright install chromium
   mise x node@24.18.0 -- npm run check
   mise x node@24.18.0 -- env VSCODE_TEST_VERSION=1.121.0 npm run test:integration
   mise x node@24.18.0 -- env VSCODE_TEST_VERSION=1.129.1 npm run test:integration
   mise x node@24.18.0 -- npm run test:webview
   mise x node@24.18.0 -- npm run package
   mise x node@24.18.0 -- npm run package:check
   mise x node@24.18.0 -- node scripts/security-check.mjs --check-notices
   mise x node@24.18.0 -- npm run rust:notices:check
   mise x node@24.18.0 -- node scripts/security-check.mjs \
     --vsix artifacts/okf-workbench.vsix
   mise x node@24.18.0 -- npm audit --omit=dev --audit-level=high
   

4. Capture the genuine headed 1.129.1 evidence and require the generated report to pass:

   mise x node@24.18.0 -- node test/benchmarks/headed-editor-evidence.mjs \
     --version 1.129.1 \
     --vscode-executable "/absolute/path/to/VS-Code-1.129.1-executable" \
     --output artifacts/performance/vscode-1.129.1-0.2.1.json
   mise x node@24.18.0 -- npm run benchmark:report -- \
     --measurements artifacts/performance/vscode-1.129.1-0.2.1.json \
     --require-passing
   

5. Run hosted Compatibility with the published v0.2.0 universal VSIX URL and exact checksum, then run hosted Package smoke for the same main revision.
6. Apply evidence-only documentation updates. If any packaged input changes, discard prior qualification and repeat the affected gates.

Approval and publication

Per ADR 0006, the Open VSX release workflow is the only automated publication path. It runs only when a v* tag is pushed.

Before pushing the tag:

1. complete every unchecked release blocker above;
2. merge reviewed candidate and evidence commits into protected main;
3. confirm v0.2.1 matches package.json and does not already exist;
4. verify the signed tag locally and confirm its commit is contained in main; and
5. confirm the release credential names and current Open VSX publisher authorization.

Publish only after those checks:

git tag -s v0.2.1 -m "OKF Workbench 0.2.1"
git tag -v v0.2.1
git push origin v0.2.1

The workflow reruns the deterministic source, dependency, security, audit, reproducibility, and package gates; creates the universal and four target VSIX packages plus four native CLI archives and checksums; creates the GitHub Release; updates Homebrew and Scoop manifests; and publishes the VSIX set to Open VSX.

Never print or pass release tokens as command arguments. Do not run ovsx publish locally as a fallback. Open VSX versions are immutable; recover from a defective release with a higher version.

Post-publication verification

• Confirm the signed v0.2.1 tag and GitHub Release identify the qualified revision.
• Confirm the release contains the universal and four target VSIX packages, four CLI archives, and all checksum files.
• Confirm Open VSX reports straydog.okf-workbench version 0.2.1 and all target packages.
• Download the published universal VSIX and compare it with the release checksum.
• Install 0.2.1 from Open VSX in a clean supported VSCodium profile and run the minimal offline workflow.
• Verify upgrade from 0.2.0, uninstall behavior, and workspace-content preservation.
• Confirm koizumikento/stray-tools contains matching 0.2.1 Homebrew and Scoop manifests.
• Run a clean Homebrew install, verify okf version, and uninstall it afterward.
• Run a clean Scoop install and verify okf version; this requires a Windows environment and was not available for the macOS post-publication check.
• Revoke the one-time token, or record the owner, scope, storage, and rotation date for a retained release credential.

Release record

Rollback

Open VSX has no supported unpublish command. For a defective non-security release, preserve the artifacts and evidence, stop promotion, and fix forward with a higher SemVer version. For a security, privacy, credential, or licensing incident, revoke credentials, use the private security route, contact Open VSX for the exact version, and publish clear update or uninstall guidance.