| 1 | # Codewhale v0.9.11 local non-benchmark acceptance contract |
| 2 | |
| 3 | Recorded: 2026-08-21 |
| 4 | Scope: the Rust runtime, CLI/TUI, embedded app-server Web client, npm wrapper, |
| 5 | Runtime SDK, VS Code extension, release helpers, install surface, and release |
| 6 | documentation. |
| 7 | |
| 8 | `benchmarks/pi-agent-parity/**` is owned by a separate release lane and is not |
| 9 | part of this ledger. Its source, tests, results, and launch status must remain |
| 10 | separate. |
| 11 | |
| 12 | This file defines the local acceptance contract. It intentionally does not |
| 13 | embed the final source SHA or artifact hash: changing a tracked file after a |
| 14 | SHA-stamped build would invalidate that artifact. The release owner must record |
| 15 | post-freeze results in an ignored receipt named for the full source SHA and in |
| 16 | the final handoff. |
| 17 | |
| 18 | Authority update: the later explicit user grants in this release task authorize |
| 19 | maintainer activity on GitHub, updating the v0.9.11 pull request, merging it to |
| 20 | `main` after the required evidence is green, and replacing the user's local |
| 21 | dogfood installation with the exact merged candidate using a rollback backup. |
| 22 | They do not authorize a tag, GitHub Release, registry publication, deployment, |
| 23 | DNS change, container push, production mutation, or paid-provider canary. |
| 24 | |
| 25 | ## Evidence lanes |
| 26 | |
| 27 | Keep these facts separate. Passing one lane does not imply another passed. |
| 28 | |
| 29 | | Lane | Required local receipt | External boundary | |
| 30 | | --- | --- | --- | |
| 31 | | Source | Clean owned diff, full commit SHA, version checks, formatting, compilation, clippy, tests, package rehearsal, localization, and release-helper checks after the last source edit | A local commit is not proof of GitHub state or review | |
| 32 | | Community | Local commit ancestry and content receipts for #5523, #5524, #5525, and #5526; #5530 described only as reviewed overlap unless independent cached proof says more | Cached refs are not current GitHub evidence | |
| 33 | | DeepSeek vision | Offline catalog and alias discovery; official `/v1` and `/beta` routing; custom-proxy authority boundary; Runtime API `image_input`; Chat text plus `image_url` serialization | No provider success or quality claim without a funded, capped turn | |
| 34 | | Provider completion integrity | Loopback Chat SSE receipts for `[DONE]`, `finish_reason`, premature EOF, protocol-only frame classification, and a tool-result continuation ending with no sendable assistant step; the final case must persist as Failed with no empty assistant message | Local/mock provider fixtures only; no live-provider completion or quality claim | |
| 35 | | Fleet identity/routing | Selected-v2 versus legacy fallback, invalid-selection failure, bounded `agent action=roster`, deterministic selector ambiguity, requested versus resolved identity, root/operator/member/explicit-route precedence, and exact `vision` admission for supported, text-only, and custom-proxy-unknown routes | Fleet selection is independent of legacy project-profile loading; no capability inference, silent rerouting, or live-provider call | |
| 36 | | Embedded Web | Exact built artifact at 1440x900 and 390x844; Ocean/dark hierarchy; responsive rail/modal; keyboard, IME, attention, recovery, reduced-motion, accessibility, console, and loopback-network receipts | Current CWC reference may be blocked by local authentication; light theme and browser image upload are not v0.9.11 contracts | |
| 37 | | Terminal | Exact built artifact; first run/trust/exit; model/alias discovery; slash-command surfaces; multi-file diagnostics; rejected workflow visibility; focused sub-agent scroll; omitted/zero `max_steps`; narrow/standard/wide layouts | Never submit a prompt to a paid provider in this local lane | |
| 38 | | Artifact | Release build stamped with the full committed SHA; absolute binary path, version, SHA-256, byte size, timestamp, app-server smoke, npm-wrapper smoke, fresh terminal/Web captures, and rollback-safe local dogfood installation | The installation grant is local-only and is not registry publication or deployment | |
| 39 | | GitHub/CI | Reopened-authority receipt quoting the exact grant, plus live repository/ref, PR/review/check results and every mutation actually performed | PR updates and the evidence-gated merge to `main` are authorized; tags, GitHub Releases, registry publication, and deployment are not | |
| 40 | | Publication/deployment | None in this local lane | Registries, containers, website, DNS, deploys, and production mutation require destination-specific approval | |
| 41 | |
| 42 | ## Source acceptance |
| 43 | |
| 44 | After the final source edit, run all of the following without invoking the |
| 45 | benchmark-tree command: |
| 46 | |
| 47 | - `cargo fmt --all -- --check` |
| 48 | - `git diff --check` |
| 49 | - `scripts/release/check-versions.sh` |
| 50 | - `scripts/release/check-ohos-deps.sh` |
| 51 | - `scripts/sync-changelog.sh --check` |
| 52 | - README locale/translation and TUI locale/product-vocabulary checks |
| 53 | - `cargo check --workspace --all-targets --locked` |
| 54 | - `cargo clippy --workspace --all-targets --all-features --locked -- -D warnings` |
| 55 | - `cargo test --workspace --all-features --locked` |
| 56 | - `scripts/release/publish-crates.sh dry-run` |
| 57 | - embedded-Web, npm-wrapper, Runtime SDK, VS Code, and release-helper checks |
| 58 | |
| 59 | Stage only explicit owned non-benchmark paths. Preserve community commits and |
| 60 | authorship in local history. Do not reset, clean, stash, blanket-stage, or |
| 61 | discard unrelated work. |
| 62 | |
| 63 | ## Exact artifact acceptance |
| 64 | |
| 65 | From the resulting full 40-character `HEAD`, build: |
| 66 | |
| 67 | ```text |
| 68 | CODEWHALE_BUILD_SHA=<full-sha> cargo build --release --locked \ |
| 69 | -p codewhale-cli -p codewhale-tui |
| 70 | ``` |
| 71 | |
| 72 | Use the resulting binary by absolute path first. Record its reported version, |
| 73 | source SHA, SHA-256, byte size, filesystem timestamp, app-server smoke, |
| 74 | npm-wrapper smoke, and terminal/Web evidence. After the merged-SHA receipt is |
| 75 | valid, install that exact artifact through the release dogfood installer while |
| 76 | retaining the rollback backup, then verify `codewhale` and `codew`. If tracked |
| 77 | source changes afterward, discard that receipt and rebuild from the new `HEAD`. |
| 78 | |
| 79 | ## Stop lines |
| 80 | |
| 81 | - Do not touch `benchmarks/pi-agent-parity/**`. |
| 82 | - Use GitHub only within the exact reopened user grant: update the v0.9.11 PR, |
| 83 | wait for fresh checks, and merge it to `main` only when the evidence supports |
| 84 | that action. Record every live read and mutation. Cached refs remain local |
| 85 | evidence, never current GitHub state. |
| 86 | - Do not call DeepSeek or another external model without an explicit all-in USD |
| 87 | cap and a confirmed provider-side hard quota. |
| 88 | - Do not publish, deploy, tag, create a GitHub Release, mutate production, |
| 89 | change DNS, or push a container. The only installed-binary replacement in |
| 90 | scope is the rollback-safe local dogfood install explicitly authorized for |
| 91 | the exact merged candidate. |
| 92 | - Omitted or zero `max_steps` remains unbounded. Preserve wall-clock, |
| 93 | cancellation, provider, heartbeat, and admission safeguards. |
| 94 |