Prepare the v1.4.0 release and stop stale completions projecting complete

.github/workflows/release.yml

@@ -15,12 +15,32 @@ on:
         required: false
         default: false
         type: boolean
+      expected_sha:
+        description: Exact 40-character release commit this dispatch must build.
+        required: true
+        type: string
 
 permissions:
   contents: read
 
 jobs:
+  release-identity:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Assert the dispatched ref and commit are the expected release
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          EXPECTED_SHA: ${{ inputs.expected_sha }}
+          ACTUAL_SHA: ${{ github.sha }}
+          ACTUAL_REF: ${{ github.ref }}
+        run: |
+          set -euo pipefail
+          printf '%s\n' "$EXPECTED_SHA" | grep -Eq '^[0-9a-f]{40}$'
+          test "$ACTUAL_REF" = "refs/tags/v1.4.0"
+          test "$ACTUAL_SHA" = "$EXPECTED_SHA"
+
   build-distributions:
+    needs: release-identity
     runs-on: ubuntu-latest
     steps:
       - name: Check out
@@ -66,7 +86,7 @@ jobs:
           python -m twine check dist/*
 
   publish-testpypi:
-    needs: verify-distributions
+    needs: [release-identity, verify-distributions]
     runs-on: ubuntu-latest
     if: ${{ (github.event_name == 'workflow_dispatch' && inputs.publish_testpypi == true) || (github.event_name == 'release' && vars.CODE_MOWER_TESTPYPI_PUBLISH == 'true') }}
     permissions:
@@ -86,7 +106,7 @@ jobs:
           repository-url: https://test.pypi.org/legacy/
 
   publish-pypi:
-    needs: verify-distributions
+    needs: [release-identity, verify-distributions]
     runs-on: ubuntu-latest
     if: ${{ (github.event_name == 'workflow_dispatch' && inputs.publish_pypi == true) || (github.event_name == 'release' && vars.CODE_MOWER_PYPI_PUBLISH == 'true') }}
     permissions:

CHANGELOG.md

@@ -5,6 +5,39 @@ project used alpha/beta prerelease tags while the first-user setup path,
 provider posture, and optional cloud sharing loop were hardening; v1.0 and
 later entries are regular releases.
 
+## v1.4.0
+
+Devin can act as an optional peer participant with a durable remote work-order
+lifecycle, Graphify is a bounded optional local repository-graph provider, and
+the Slack command and ingress foundation is in place. Claude Code + Codex remain
+the first-run default and every new integration stays opt-in.
+
+### Added
+
+- One optional Devin setup and readiness path for the local CLI and the hosted
+  v3 API, a provider-neutral remote session lifecycle, trusted hosted work
+  orders, normalized local and hosted review evidence, and authorized context
+  delivery to approved Devin roles.
+- Graphify as an optional bounded local provider behind the packet contract,
+  with an exact pin, revision-bound private graph state, no network access, and
+  no default dependency.
+- The Slack command and identity contract plus authenticated, durable, bounded
+  ingress as a foundation for later worker delivery.
+- A release-hygiene assertion and `release-readiness` check that fail when the
+  committed `code-mower-package-manifest.json` version disagrees with
+  `pyproject.toml` and `src/code_mower/__init__.py`.
+
+### Fixed
+
+- A rejected work-order completion no longer projects a finished session. When a
+  persisted rejection exists and the remote projection reports `complete`, the
+  returned session projection is `running` / `result_not_ready` / `status`,
+  while the authoritative rejection block, the durable remote record, and
+  exact-round and pull-request verification are unchanged.
+- Devin results are recovered across restarts and the merge boundary, running
+  sessions holding a current-round result are recognized, GitHub bot login
+  suffixes are normalized, and collection recovers after a stale completion.
+
 ## v1.3.1
 
 Code Mower can carry optional organizational context through the ordinary

README.md

@@ -9,13 +9,13 @@ The current release is supervised-pilot, bring-your-own-agent-loop software.
 It is not a drop-in unattended merge gate. Humans still own credentials,
 repository policy, reviewer promotion, and exceptional decisions.
 
-The current package-index release baseline is `v1.3.1`, with pinned package
-install spec `code-mower==1.3.1`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.4.0`, with pinned package
+install spec `code-mower==1.4.0`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal.
 
 Documentation on `main` follows the source on `main`. When using the published
 package, start with the
-[`v1.3.1` guide](https://github.com/codemower-ai/code-mower/blob/v1.3.1/docs/try-in-10-minutes.md).
+[`v1.4.0` guide](https://github.com/codemower-ai/code-mower/blob/v1.4.0/docs/try-in-10-minutes.md).
 
 ## What Code Mower Adds
 
@@ -43,7 +43,7 @@ one stable `pipx` installation:
 ```bash
 python3.12 --version
 export CODE_MOWER_PYTHON="$(command -v python3.12)"
-pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.3.1
+pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.4.0
 command -v code-mower
 code-mower --version
 ```
@@ -107,7 +107,7 @@ paths available for each participant and records explicit handoffs where Code
 Mower has no automatic transport.
 
 Codex, Claude Code, and Cursor are qualified for the shared session, telemetry,
-lease, and Jira-authority contract in v1.3.1. Devin, Grok Bot, Antigravity,
+lease, and Jira-authority contract in v1.4.0. Devin, Grok Bot, Antigravity,
 Muse, and custom hosts are recognized for briefs and provenance, while their
 execution remains an explicit handoff or provider-specific transport. See
 [Participants And Sessions](docs/sessions.md) and the
@@ -215,20 +215,22 @@ and the [Cloud Data Contract](docs/cloud-data-contract.md).
 
 ## Current Capabilities And Limits
 
-| Area | v1.3.1 posture |
+| Area | v1.4.0 posture |
 | --- | --- |
 | Default builders and reviewers | Claude Code + Codex |
 | Session hosts | Codex, Claude Code, and Cursor qualified; other identities recognized but require explicit handoff/provider transport |
 | Devin | Maintained local builder and hosted release-qualification transport; local review remains informational and Devin is not yet a qualified peer orchestrator |
-| Organizational context | Optional Coworker delivery to approved Claude/Codex roles |
+| Organizational context | Optional Coworker delivery to approved Claude/Codex/Devin roles |
 | Work trackers | GitHub Issues by default; Jira Cloud is optional and guarded |
 | Forge and merge gate | GitHub |
 | Cloud | Optional metadata/report upload; no upload by default |
-| Graphify and Slack | Tracked future integrations; not included in v1.3.1 |
+| Graphify | Optional bounded local repository-graph provider behind the packet contract; no default dependency and no network access for the provider |
+| Slack | Command and authenticated bounded ingress foundation only; no Slack worker delivery, results, or orchestration authority |
 
 GitLab, Bitbucket, broad unattended rollout, uncalibrated merge gates, Devin
-peer-orchestrator/reviewer parity, Graphify, and Slack task ingress are not
-shipped in v1.3.1. The current priorities and boundaries are recorded in
+peer-orchestrator/reviewer parity, a required Graphify dependency, and Slack
+worker delivery are not shipped in v1.4.0. The current priorities and
+boundaries are recorded in
 [Current State And Roadmap](docs/current-state-and-roadmap.md).
 
 ## Documentation
@@ -282,6 +284,7 @@ shipped in v1.3.1. The current priorities and boundaries are recorded in
 - [Cloud Data Contract](docs/cloud-data-contract.md)
 - [Release Qualification](docs/release-qualification.md)
 - [Public Release Checklist](docs/public-release-checklist.md)
+- [v1.4.0 Release Notes](docs/v140-release-notes.md)
 - [Release History And Archived Plans](docs/release-history.md)
 - [Changelog](CHANGELOG.md)
 - [Contributing](CONTRIBUTING.md)