[steipete]

Prepare acpx 0.21.1 as a patch release for the existing prompting documentation correction and dependency updates, including four URI normalization and scheme/host confusion security fixes in the development toolchain.

Preserves every existing changelog bullet, orders the security entry first, adds release highlights, and retains an empty Unreleased section. No runtime code changes.

Validation: independent review found no actionable P0–P2 findings; changelog preservation and version consistency checked. Passed pnpm run check and pnpm run check:docs on AWS Crabbox (3,077 tests passed, 15 skipped; separate coverage run: 220 passed). Coverage for the declared target: 93.55% statements/lines, 89% branches, 97.2% functions. Publication follows the documented dry-run, signed-tag, and GitHub Actions flow.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T03:04:41.472739Z	4998e16	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR bumps acpx to 0.21.1 and moves the existing Unreleased entries into a dated release section with highlights.

Example: Read the package version and release notes.

• Before: The package declares 0.21.0 and two fixes appear under Unreleased.
• After: The package declares 0.21.1 and both fixes appear under its release heading.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Focused, policy-aligned release preparation with no actionable findings; one exact-head check has not finished.
Proof confidence	🌊 off-meta tidepool	Not applicable: This maintainer-authored release preparation changes metadata and notes only; reported checks support validation without claiming live behavior proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The landed documentation correction and dependency updates have not yet received a new acpx release version.
Reason: The maintainer-authorized patch release follows the documented versioning and changelog contract.

Merge readiness

✅ Ready for maintainer review

Keep open: this PR prepares an unreleased patch version, follows the release policy, and introduces no actionable defect; the exact-head Test check remains pending.

Priority: P3
Reviewed head: 4998e16847a56bbdb669756ade76ed151c3fe914

Before merge

None.

Findings

None.

Agent review details

How this fits together

Package metadata supplies the CLI version and release tag validation, while the changelog supplies GitHub release notes.

flowchart LR
  A[Package metadata] --> B[CLI version]
  A --> C[Release validation]
  D[Changelog] --> E[Release notes]
  C --> F[Signed tag publication]
  E --> F

Loading

Technical review

Best possible solution:

Land this focused release preparation after exact-head CI succeeds, then follow the documented dry-run and signed-tag publication process.

Do we have a high-confidence way to reproduce the issue?

No new bug fix is implemented here; source inspection confirms the version bump and preservation of the existing release entries.

Is this the best way to solve the issue?

The two-file change is the smallest complete release preparation described by the repository's release guide.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 26849fd33785.

Provenance checked

• Package release version keeps the original intent (c0b9dfd: The preceding release preparation set version 0.21.0; this change advances it for the next patch release.)
• Changelog entries keeps the original intent (docs(prompting): a prompt command with no prompt text exits 2, it does not print help #908: The prompting correction and subsequent dependency update were recorded under Unreleased; release preparation moves both intact into the versioned section.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Verified introduced changes: The pinned diff changes only the package version and release-note organization; both existing bullets and contributor attribution are preserved. (CHANGELOG.md:9, 4998e16847a5)
• Release policy: The release guide calls for a patch version for fixes and dependency updates, dated notes with highlights, an empty Unreleased section, and green exact-head CI. (docs/releasing.md:11, 26849fd33785)
• Existing changes being released: The dependency updates already landed in build(deps): refresh runtime tooling and patch URI advisories #910; this PR packages their release notes without changing dependencies again. (package.json:3, 26849fd33785)
• Latest published release: GitHub still identifies v0.21.0 as the latest release; the release search found no competing acpx 0.21.1 preparation. (c0b9dfdfad12)
• Exact-head validation: Fifteen checks succeeded and Test remains in progress; no failing check was reported. (4998e16847a5)
• Release ownership history: Repeated release preparation and the current release-process refactor identify steipete as the strongest routing owner, including chore: release acpx 0.21.0 #907 and fix(release): publish directly from repository Actions #887. (CHANGELOG.md:18, 26849fd33785)

Likely related people:

• Peter Steinberger: Raw commit c0b9dfd adds CHANGELOG.md:9 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c0b9dfdfad12; files: CHANGELOG.md)

Labels

Label changes:

• add P3: This is focused release metadata preparation with no runtime implementation change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is focused release metadata preparation with no runtime implementation change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 26, 2026, 11:16 PM ET / October 27, 2026, 03:16 UTC.

[steipete]

Released acpx 0.21.1 from e6c7824.

The release preserves both changelog entries and includes the dependency security fixes. Independent review found no actionable P0–P2 issues. The release candidate passed the full check and documentation gates; PR CI, post-merge CI, and the exact-commit release dry run passed.

Verified the fleet-signed tag, GitHub release notes against the changelog, both release assets, SHA-256 and npm integrity, matching npm/GitHub tarballs, npm version/latest, and provenance. The downloaded package reports 0.21.1 and successfully initializes and reads configuration in an isolated synthetic project.