v1.6.0 release: qualify telemetry, soak, and publish

[jeffhuber]

Part of #1066.

Goal

Qualify and publish one immutable v1.6.0 candidate after every v1.6 implementation dependency has merged.

Entry criteria

• v1.6.0: align Board inventory filters, versions, and service guidance #1063 is merged as PR v1.6: align Board inventory and service guidance #1109 (3cfd554ec3e63356d97ea44ea7453531b9b33fbd).
• v1.6.0: make audit comment ingestion payload-aware #1104 is merged as PR v1.6.0: harden audit comment ingestion #1107 (166013b017988938d0085a870993ca975b0413dd).
• v1.6.0: minimum control-surface telemetry contract and OSS emitters #921 / OSS telemetry is merged as PR v1.6.0: add minimum control-surface session summaries #1098 (9f6a89d).
• v1.6.0: minimal CodeMower.com Slack telemetry ingestion and aggregates #978 / hosted telemetry consumer is deployed from CodeMower.com PR v0.9: harden install and upgrade docs #542 (bcddaa25c633f2dcf8fa2077d6ecb8004c1d8f88) and advertises the exact accepted contract identity.
• The v1.6 epic and current-state documentation reflect the final scope (release PR Prepare v1.6.0 immutable release qualification #1110, merge ac585cb65ab910a48866ae784e09dab193dc8ec6).

Qualification

• Built and retained one immutable source distribution and wheel from release commit ac585cb65ab910a48866ae784e09dab193dc8ec6 in first-attempt candidate run 35679417608.
• Run the complete CI, release-integrity, privacy, documentation, package, Graphify, Board, Slack, and cloud capability checks against that exact candidate (candidate run 35679417608, plus independent Python 3.12/3.13 installed-wheel qualification).
• Run one bounded private Slack telemetry canary and reconcile local Board state with authenticated hosted totals.
• Verify the metadata-only privacy boundary, tenant isolation, capability gating, retention, export/deletion, and rollback behavior.
• Exercise clean install, v1.5.2 upgrade, rollback, basic Slack, Graphify, Board service, and public-package installation.
• Soak the retained candidate for at least 24 hours.
• Obtain two independent installation/adoption passes against the retained candidate.
• Obtain independent exact-head Code Mower release audits with every P0/P1/P2 resolved (PR Prepare v1.6.0 immutable release qualification #1110 exact reviewed head 98eea9a793cd3e2739175016693d2e447b852ac8: Claude PASS and Codex PASS).
• Publish GitHub/PyPI artifacts from the retained candidate and verify public checksums and installation.
• Update release facts, release notes, current-state roadmap, and milestone/epic state.

Rollback

Retain the v1.5.2 package and documented rollback path. Production telemetry emission must remain capability-gated and independently disableable from the hosted consumer.

Delivery

This issue is serial-release work. Do not publish or enable production telemetry until all entry criteria and exact-candidate evidence are complete.

[jeffhuber]

Immutable v1.6.0 candidate retained

The one allowed candidate build completed successfully on its first attempt:

• release PR: Prepare v1.6.0 immutable release qualification #1110
• release merge/source SHA: ac585cb65ab910a48866ae784e09dab193dc8ec6
• candidate run: https://github.com/codemower-ai/code-mower/actions/runs/35679417608
• wheel: code_mower-1.6.0-py3-none-any.whl
• wheel SHA-256: 3dfa8ac0c5c72fce2d18c186153820e97e01ad35ac756cccf665b5f0e59f4698
• sdist: code_mower-1.6.0.tar.gz
• sdist SHA-256: 58165ebc84eb31f6444d7865d2b803e782f21cd168b7fa3cb08b493b77346ce4
• candidate manifest SHA-256: 7b442c53fd6260a2288722f1afbaca0c863f25147b298513de0e17989b9668f1
• rehearsal manifest SHA-256: 8c782062b00b80f2e745a8c91e1fdbde01a39b2db8a68b16ef046baa3c87596f

release_candidate.py verify --require-candidate passed against the retained download. candidate.json binds version 1.6.0, PR #1110, the exact source SHA, both artifact digests, required modules/docs, and full wheel/sdist inventories. rehearsal.json is status: pass, binds the same source and wheel digest, verifies the digest-pinned v1.5.2 rollback wheel, and records ten installed-wheel rehearsals including Graphify, Slack-free defaults, state-preserving upgrade/rollback, and uninstall.

No rerun will be attempted. Live Slack/capability canary, 24-hour soak, and independent adoption remain open.

[jeffhuber]

Exact-candidate upgrade and rollback qualification

An independent disposable qualification passed against the retained candidate:

• release source: ac585cb65ab910a48866ae784e09dab193dc8ec6
• v1.6.0 wheel SHA-256: 3dfa8ac0c5c72fce2d18c186153820e97e01ad35ac756cccf665b5f0e59f4698
• canonical v1.5.2 rollback wheel SHA-256: 44c7082b1fec2983d85ac7ce7feb7cf54b2b7d26e020e073716614d480118147
• clean Python 3.13.12 disposable environment
• v1.5.2 safe initialization produced 48 synthetic state files; doctor had zero failures
• upgrade to the retained v1.6.0 wheel preserved all 48 files byte-for-byte and passed package identity and dependency checks
• v1.6 doctor, synthetic Graphify generation/query, and disposable loopback Board identity/health/version checks passed
• offline Slack readiness stayed fail-closed; the generated command-only manifest was credential-free and mode 0600
• forced rollback to the exact v1.5.2 wheel passed with all state unchanged
• uninstall removed the package and entry point while preserving state

No live service, Slack workspace, provider, or paid work was used. This is upgrade/rollback evidence; it does not substitute for the retained-candidate live Slack canary or the two independent adoption passes during soak.

[jeffhuber]

Exact-candidate clean/offline qualification

A separate Python 3.12.13 plain-pip run passed against the retained v1.6.0 wheel 3dfa8ac0c5c72fce2d18c186153820e97e01ad35ac756cccf665b5f0e59f4698 from source ac585cb65ab910a48866ae784e09dab193dc8ec6:

• installed identity and code-mower --version both reported 1.6.0
• checkout-free and synthetic-repository safe initialization passed without applying changes
• share-safe adoption doctor exited successfully and exposed no disposable local path
• two transient candidate Boards proved repository filtering, identity confidence, invoking/serving/installed version parity, and stale 1.5.x recovery guidance
• an installed Graphify generation with a valid doc_ref node passed all four query types; bounded partial output stayed usable and reported truncation
• 27 installed-package audit-history/control-marker tests passed, including large histories, adaptive pagination/restart, stable terminal proof, mutation/budget refusal, malformed controls, and explanatory marker prose
• Slack setup produced a mode-0600 command-only manifest; both offline doctor paths remained not-ready with dispatch_authorized: false
• the current hosted health capability matched the installed contract; a local metadata-only summary validated, omitted the raw session identifier, suppressed a timestamp-only poll, and emitted a meaningful lifecycle-count transition; no upload occurred
• uninstall removed package/import/entry point while preserving synthetic repository state

No provider, paid work, live Slack message, repository edit, candidate mutation, or cloud upload occurred. Together with first-attempt candidate workflow rehearsals, exact-head release audits, green Python 3.12–3.14 CI, and the independent v1.5.2 upgrade/rollback run, the complete offline candidate check row is satisfied. Live canary, privacy control exercises, soak, adoption, and publication remain separate.

[jeffhuber]

Independent external installation/adoption pass 1 of 2 is complete against the retained v1.6.0 candidate.

• Evaluator: Cursor Agent 2026.09.08-6caf4ff at launch (self-updated after the evaluation to 2026.09.18-9a7762b).
• Exact wheel SHA-256: 3dfa8ac0c5c72fce2d18c186153820e97e01ad35ac756cccf665b5f0e59f4698.
• Installed version: code-mower 1.6.0.
• Result: PASS, 5/5.
• Clean install/init and share-safe doctor passed; local paths were redacted.
• Graphify produced a complete graph containing a valid doc_ref node, and the v1.6 reader returned an available code_mower.contextPacket.v1 query packet.
• A disposable Board reported v1.6.0 identity and health and left no listener after shutdown.
• Offline Slack readiness correctly remained non-dispatching with transport, campaign, and live probe disabled.
• No Slack message, provider session, cloud mutation, candidate-byte change, or repository mutation occurred.

Public-safe evidence archive SHA-256: df631228c64e395b958d1ed51e295ad8dce18c611bd6b5d2eaa535c0197902fd; content bundle SHA-256: 69587119dcf4b90a2fb61bfdcc2006e6102209d6bf44377ce75542d3d32858d6. The retained local evidence was rescanned and contains no username, home path, or original absolute candidate path.

[jeffhuber]

Independent external installation/adoption pass 2 of 2 is complete against the retained v1.6.0 candidate.

• Evaluator: Claude Code 2.1.274.
• Exact wheel SHA-256: 3dfa8ac0c5c72fce2d18c186153820e97e01ad35ac756cccf665b5f0e59f4698.
• Clean Python 3.12.13 environment installed code-mower 1.6.0.
• Result: PASS after correcting the evaluator criterion to the documented Graphify reader contract.
• Safe initialization and share-safe doctor passed; 16 fake sentinels produced zero leaks.
• The graph contained two valid doc_ref nodes. The exact v1.6 reader parsed it without ReaderIncompatible; symbol, dependency, and impact queries were available.
• Disposable Board identity/health returned 200 and the process/listener were removed afterward.
• Offline Slack setup/doctor completed without contacting Slack, starting OAuth, sending a message, or creating a provider session.

Transparency: the first Claude run is retained as FAIL because its prompt incorrectly required doc_ref nodes to appear in answer packets. Code Mower deliberately excludes non-code nodes from those packets. That run nevertheless demonstrated the intended #1007 behavior: a valid graph containing doc_ref parsed successfully. First-run evidence manifest SHA-256: 10fe40d54ac8ec2ac677c502f1dbf05b2ddb58193d18a4093eb3f84bacdf6057; corrected sanitized evidence manifest SHA-256: e4427e3a8bfd355c412a7e88243f5ea4551edb9160b6eaefe3e1fcc2d895111b.

Nonblocking adoption findings for later follow-up: group-writable Homebrew Cellar ancestry makes Graphify fail closed unless a private interpreter is used; /tmp versus /private/tmp realpath strictness is visible on macOS; init --graphify retains a v1.4.1 docs URL; and the combined doctor --slack --share-safe flags are rejected even though Slack doctor output is already redacted.