OKF Workbench 0.4.0 release record

Status: Published and verified on 2026-09-05; remaining platform/credential scope is recorded below.

Scope

Node 24/CommonJS Extension Host output, @types/node 24.13.3, VS Code 1.123 minimum, and VSCodium 1.126.04524 qualification, as accepted in ADR 0012. Development dependency updates include undici, fast-uri, js-yaml, postcss, and nanoid. The format semantics, local-first behavior, Wasm ABI, and native CLI features are unchanged.

Windows watcher events now compare canonically serialized VS Code URIs so /C:/ roots accept /c:/ events while retaining containment checks. Valid UTF-8 documents within the source-size limit cross the Wasm JSON ABI as strings. Malformed and oversized byte inputs retain their original diagnostics. Regression coverage includes BOM, CRLF, Unicode, invalid UTF-8, source-size boundaries, and all watcher event types.

Release compilation uses optimization level 3 with existing LTO and one codegen unit. Provider operations use fixed batches of sixteen, retaining the per-document/aggregate byte limits, parent-generation checks, and draining of canceled physical calls. The headed runner supports Windows process counters, CLI invocation, and signaled process exit. Performance thresholds and the 250 ms watcher debounce are unchanged.

Qualification

The final packaged-input revision is 06287122d3ceaa028875643276fdaca8e92aef7b. CI 33965910248 passes all four jobs, including minimum/current VS Code integration. Compatibility 33965909336 passes all seven editor/OS lifecycle lanes using the published 0.3.0 universal VSIX (SHA-256 d96aa19cc3ada5d4e34618d41bedc4195efa368e2b51b8ff8977984e815caf57). Package smoke 33965908284 passes the browser boundary, four target packages, and aggregate package-set consistency. Both hosted workflows completed successfully before tagging. Subsequent evidence and release-record documentation changes do not change packaged inputs.

The hosted universal candidate is 1,459,446 bytes, SHA-256 ac11074af65f02ddeb1ff3bbf0f58d12a2b1327281a13d72fa21b0d3d5b5dcf8. It is byte-for-byte identical to the deterministic package made from the measured runtime, including all 13 extension payload files. The canonical Wasm SHA-256 is 000f1fd0a721285e31ec4ec6673b4717892a468a77116225dd656eccbb37dc2f. The CI build receipt binds Rust inputs 80916738fa3be41c86ade827e392ebf484282d9f8438f325c51ae0fd96c29a92.

The genuine Windows performance report and raw schema-v3 capture pass the strict current-input evaluator: QR-002 p95 851 ms across 20 samples, QR-003 selects d3, and remote HTTP(S)/WS and other-scheme request counts are zero. This capture is specific to Windows 11, Ryzen 9 9900X, RTX 5070, and VS Code 1.129.1; it is not a cross-machine guarantee. See performance evidence for all hashes and reproduction.

Earlier captures remain historical, including 1,252 ms with mismatched local Wasm, 961 ms on a676122, and 1,190 ms after the byte-limit fix on f793844. None is reused to qualify the final bytes.

Local checks pass: 108 Wasm/provider tests, 52 Rust core/Wasm tests, workspace clippy, type checking, focused lint, and formatting. Earlier immutable-evidence/materialization tests also passed. Local Windows could not create one symbolic-link fixture (EPERM) or load Microsoft.PowerShell.Security for a CLI ACL test. Hosted Linux/Windows gates cover these checks; no test or safety threshold was weakened to conceal workstation limits.

Publication

Annotated tag v0.4.0 points to reviewed main commit ed45214b1d3afc4cd017a2ecc250ae182ab038ab (PR #59). The main CI 33966425043 passed. Release workflow 33966653519 completed all jobs successfully, creating the GitHub Release at 2026-09-05T12:52:42Z, publishing all five Open VSX packages, and updating Homebrew/Scoop. This follows the maintainer’s 2026-09-05 authorization and ADR 0006; tag signatures are not required by the decision or workflow. Historical signed releases remain historical records.

Post-publication verification

All five Open VSX packages match their GitHub Release bytes (registry receipt). The registry’s metadata became available after a short post-upload delay; final comparison passed at 2026-09-05T12:57:56Z.

• Remote tag identity matches the reviewed commit.
• All 18 GitHub assets were downloaded; all nine payload checksums and the measured Wasm in all five VSIX packages match. The published universal VSIX is identical to the qualified candidate.
• Each of the four standalone CLI executables is byte-for-byte identical to its target VSIX’s bundled executable (parity receipt).
• VSCodium 1.126.04524 on Windows x64 passes clean install, offline activation observation, untrusted workspace behavior, genuine 0.3.0 upgrade, uninstall, and workspace/settings preservation using the published Windows target VSIX (lifecycle receipt).
• stray-tools commit b6fd873 contains the 0.4.0 Homebrew/Scoop manifests with matching archive checksums (receipt).
• A clean isolated Scoop install returned CLI/core 0.4.0 and uninstalled successfully (receipt). The test shim PATH entry was removed. The temporary 7-Zip shortcuts created during test preparation were also removed with the maintainer’s explicit authorization; unrelated PATH entries were preserved.

Outstanding scope

A live Homebrew install/test/uninstall of 0.4.0 was not run on this Windows workstation. The successful 0.3.0 Mac/Homebrew check is historical. Release-credential ownership, scope, retention, and rotation disposition have not been audited in this release task. Open VSX versions are immutable; preserve evidence and fix forward with a higher version.