Release: publish and qualify Code Mower v1.4.0 with Devin peer support

[jeffhuber]

Part of #901.

Problem

The completed Devin capability must ship as an installable, reproducible release before Slack depends on it.

Scope

Prepare version, changelog/release notes, final docs, package artifacts, exact-head review, GitHub release, PyPI publication, package-index installation, release campaign, Board restart/verification, and CodeMower.com metadata upload.

Dependencies

• Devin: peer-support qualification and public scorecard #911

Acceptance criteria

• All required Devin epic children are closed with evidence.
• Release PR passes independent exact-head review, CI, privacy, package rehearsals, and gate.
• GitHub and PyPI v1.4.0 artifacts match.
• Published-package campaign and local installation pass.
• Board and CodeMower.com show the sanitized completed release evidence.

Code Mower delivery

Produce exactly one independently reviewable PR for this issue. Record the named builder, keep one writer on the branch, run focused tests and applicable full checks, obtain an independent Code Mower review against the exact current head, resolve every P0/P1/P2 finding, and pass normal CI plus code-mower/gate. Update the parent epic with PR/head, review, validation, outcome, and safe metadata-only upload evidence. Do not put credentials, source, diffs, prompts, transcripts, private context, task/message prose, or raw provider output in cloud data.

[jeffhuber]

Release work is active under one hosted Devin work order on
devin/912-release-v1.4.0 with a 5 ACU cap. Qualification #911 is complete and
its Board/privacy inspection plus zero-report CodeMower.com upload are recorded.

One blocking P2 found during qualification recovery is included in work-order
round 1: after a new message, a stale structured completion could make the
projected session state say complete while Devin was actively running. The
release PR must keep current-result precedence, preserve rejection/verification
safety, and present the rejected stale round as logically running until an
exact-round replacement arrives. Focused regression coverage is required.

No tag, package-index publication, GitHub Release, qualification campaign,
local release installation, Board restart, or release metadata upload has been
performed yet. Those remain orchestrator-owned post-merge steps.

[jeffhuber]

v1.4.0 release status — preaudit fix round active

Draft release PR #959 remains on exact reviewed head 82a76fe7f04b2e432b0f28fcdfa7be969d2aeee3 while its existing Devin work order handles release-blocking preaudit findings. One hosted session and one create are still being used; the provider is actively running and no merge authority is delegated.

Blocking corrections in the current sequence:

• make rejected completion markers durable before compare-bound private-result cleanup, including restart-boundary regression coverage;
• regenerate the complete package manifest and make readiness compare the full normalized inventory;
• package the Graphify lifecycle document referenced by other packaged docs;
• add an executable, immutable-head v1.4.0 release runbook covering no-publish, TestPyPI, PyPI, artifact digest comparison, GitHub Release assets, three-provider qualification, Board restart, and metadata-only cloud upload.

Current exact-head evidence already green: focused release/Devin tests, package build, Twine, privacy scan, easy-mode smoke, fresh-clone rehearsal, package-install rehearsal, GitHub Python 3.12/3.13/3.14 matrices, Linux/macOS graph containment, and package CI. The full local suite is in progress. Codex and Claude gate audits will run on the replacement exact head after these blockers are resolved.

[jeffhuber]

Release qualification update: PR #959 remains draft while the existing hosted Devin work order completes one final exact-head hardening round.

• Builder evidence is verified through head 5caab6abec3e277229d4a4c28a219902526759b5 on issue Release: publish and qualify Code Mower v1.4.0 with Devin peer support #912 / PR Prepare the v1.4.0 release and stop stale completions projecting complete #959.
• GitHub CI, the focused 276-test release-hygiene suite, 576 subtests, Ruff, and privacy scanning pass on that head.
• Independent adversarial review found that release readiness could still pass after deleting several schema/identity assertions from the post-merge runbook. Round 8 is adding schema-complete campaign, Board, cloud-upload, Release-asset, Devin-permission, pip-isolation, and manifest-JSON gates plus deletion tests.
• No tag, package publication, GitHub Release, Board restart, or cloud upload has occurred.

After the new head is pushed, it will receive fresh exact-head Codex and Claude audits before the PR is made ready.

[jeffhuber]

Code Mower Release Qualification Dispatch

• Release Tag: v1.4.0
• Package Spec: code-mower==1.4.0
• Provider: devin
• Posture: required
• Context: cold_install
• Package Source: pypi
• Idempotency Key: decac54b3f7701d0

Run this exact candidate qualification command:

code-mower release qualify --release-tag v1.4.0 --package-spec code-mower==1.4.0 --package-source pypi --qualification-context cold_install --provider devin --executor devin --repo-slug codemower-ai/code-mower --output adoption-result.json --execute --json

Then reply with a comment containing a CODE_MOWER_ADOPTION_RESULT marker wrapping schema code_mower.releaseCampaignResult.v1 with matching campaign_id, provider, release_tag, package_source, and idempotency_key, plus an embedded adoption_result equal to the complete JSON object written to adoption-result.json; embed that object unchanged, without renaming, dropping, or synthesizing fields. The marker must be a single-line HTML comment on a line of its own. The embedded adoption_result must report qualification_context cold_install with an empty starting_version. See docs/release-qualification.md.

[jeffhuber]

v1.4.0 release complete

• Delivery: PR #959 merged from final head a56b309 as c2a3850.
• Review and validation: the final exact-head independent Claude audit passed with no P0/P1/P2 findings. The clean final head passed 3,391 tests with 11 skips, release readiness 20/20, privacy and static checks, Python 3.12–3.14 package CI, containment checks, and the Code Mower gate.
• Publication: GitHub Release v1.4.0 is published. The no-publish, TestPyPI, production PyPI, and release-event workflows completed successfully at the exact release commit. Workflow, canonical PyPI, and GitHub Release wheel/sdist filenames and SHA-256 values matched.
• Qualification: campaign-v1.4.0 completed with exactly Claude, Codex, and hosted Devin required and accepted: 3 providers, 3 complete, 0 skipped, and 0 rejected.
• Runtime: the canonical PyPI package is installed locally at 1.4.0. All three inventoried Boards report serving and installed version 1.4.0, with every required doctor check passing.
• Cloud evidence: the inspected campaign upload contributed three adoption_run events and the exact-release Board snapshot contributed one board_snapshot event. Both were accepted in metadata-only mode with zero reports.

No credentials, identities, repository paths, endpoints, prompts, messages, transcripts, private context, source, diffs, report prose, or raw provider output were uploaded.