Release: promote agent-v0.1.0 to stable #26

Goal

Promote the existing signed rewrite preview agent-v0.1.0 to the first stable release of the current no-Shizuku architecture after the documented real-device gates are completed.

Release candidate

• Tag: agent-v0.1.0
• Source commit: d8728804e575e6ae13c190891f37cd56445fff02
• APK: rish-mcp-agent-0.1.0.apk
• Size: 9,630,749 bytes
• SHA-256: 210fb90f4abcdf37b8483e3df4144c40edb9f173ff5cdfbc7ce7c35338162220
• Android metadata: versionName=0.1.0, versionCode=1
• Release workflow: passed; APK was built, signed with the official key, signature-verified, metadata-checked, and checksum-published.
• Current master has no Android app/ changes after this candidate; changes since the tag are release-source hardening, docs, container base updates, and web UI changes.

Stable release gates

• Release APK build and Android unit tests passed in the tag-triggered release workflow
• Official signing key used and APK signature verified
• Tag / APK versionName match
• APK size and SHA-256 published
• Current master CI passes
• Current master CodeQL passes
• Install the preview APK on a real supported Android device
• Complete wireless-debugging pairing from the app
• Confirm the agent connects to the relay
• list_devices returns the device and reports agent 0.1.0
• run_shell({"cmd":"id"}) succeeds and shows shell uid (uid=2000)
• run_shell({"cmd":"printf rish-release-ok"}) returns rish-release-ok
• Restart/reconnect smoke test succeeds without re-pairing regression
• Record upgrade gate as N/A if there is no prior supported rewrite release; do not treat legacy v0.5.0 as a supported rewrite upgrade source

Dependency freeze for this release

Do not fold unrelated major toolchain upgrades into the stable promotion:

• build(deps): bump the android-dependencies group across 1 directory with 8 updates #16 Android/AGP/Kotlin/OkHttp major dependency group — post-release
• build(deps): bump eclipse-temurin from 17-jdk-jammy to 25-jdk-jammy in /app #24 JDK 17 → 25 build image — post-release
• build(deps): bump the web-dependencies group across 1 directory with 6 updates #25 grouped web dependencies mixes the Next.js 16.3.3 security update with ESLint 10, TypeScript 7, and Node type majors. Split/land the Next.js security fix separately rather than merging the whole group into the release path.

Promotion steps after hardware gates

• Edit the existing GitHub release for agent-v0.1.0: remove prerelease status; do not create a duplicate tag or rebuild a different APK under the same version
• Keep the existing APK + checksum assets unchanged
• Update release notes from preview wording to stable notes, including the exact APK SHA-256
• Update README / docs/RELEASES.md to state that agent-v0.1.0 is the first stable rewrite release
• Ensure production public-version-server deployment does not enable RELEASE_INCLUDE_PRERELEASE=true
• Verify the public version endpoint resolves agent-v0.1.0 with prerelease serving disabled

Notes

The stable release should preserve the rewrite channel boundary (agent-v*). Historical v0.2.0–v0.5.0 releases are legacy Shizuku artifacts and are not part of this upgrade channel.