[ViperJuice]

Release-prep PR for v1.5.0. It ships the treesitter-chunker 6 / tree-sitter 0.26 parser-stack upgrade (#116, issue #115) and the baml-bridge 0.23.0 alignment (#120, issue #119). It can be reverted: nothing is tagged, published, signed or dispatched. Publishing is a separate step that needs owner approval (listed at the end).

Re-cut on 2026-11-08 on top of origin/main bba0941 (#120 merge). The only conflict was in CHANGELOG.md, where #120's [Unreleased] entry now sits under [1.5.0].

✅ Fleet co-install goal met

1.5.0 now installs in one environment with agent-harness phase-loop-runtime==0.7.30 from PyPI, which pins tree-sitter==0.26.0 and baml-bridge==0.23.0. The baml-bridge blocker from the first cut is gone: #120 moved this repo to baml-bridge==0.23.0.

Fresh Python 3.12.14 venv, uv pip install dist/index_it_mcp-1.5.0-py3-none-any.whl 'phase-loop-runtime==0.7.30', then uv pip check:

Using Python 3.12.14 environment at: venv312
Checked 126 packages in 2ms
All installed packages are compatible

Resolved versions: index-it-mcp 1.5.0, phase-loop-runtime 0.7.30, baml-bridge 0.23.0, tree-sitter 0.26.0, treesitter-chunker 6.0.0, tree-sitter-language-pack 1.20.0, protobuf 7.36.2 and pydantic 2.14.3.

Version choice: 1.5.0 (minor)

The repo follows SemVer 2.0.0 (CHANGELOG header). There's no separate policy doc, so I judged against SemVer and this repo's past releases:

• The public API is unchanged and only grows. MCP tool schemas, the mcp-index/index-it-mcp CLI and the mcp_server.client API keep their contracts. The new pieces are grammars prefetch|check and a grammars block in get_status. The client_id() → requested_model() rename is in the generated baml_sdk/, an internal SDK. Only a test read it.
• Index incompatibility is covered by an existing contract. Old chunker-4 indexes report scheme_mismatch, fail closed and are rebuilt by reindex. That is the CHUNKERSAFE path, which shipped as part of a minor release: 1.4.0 adopted chunker v4 and CHUNKERSAFE. P10's breaking schema-compat flip (BREAKING-CHANGES.md) also shipped without a major bump.
• SemVer does not treat dependency or platform floors as public API. The tree-sitter 0.26 / pack 1.20 / baml-bridge 0.23 pins, glibc 2.34+ and mandatory grammar prefetch are operational changes. The upgrade notes cover them, and so does BREAKING-CHANGES.md.
• The project is still beta / pre-GA. AGENTS.md says "Expect API surface changes before stable release".
• A 2.0.0 would also clash on PyPI. PyPI still hosts the abandoned index-it-mcp 2.14.6–2.14.9 (yanked) and 2.15.0a1 (not yanked), so a "2.0.0" would sort below an older line.

If the owner treats mandatory prefetch plus the glibc floor as breaking, the only change needed is renaming 1.5.0 → 2.0.0 in the same files.

Contents since the last release (v1.4.1, published 2026-10-13)

From git log v1.4.1..origin/main:

• docs(v13): record v1.4.1 release; let post-release commits pass the tag test #102: v1.4.1 post-merge notes.
• Add repo icon for T3 Code #103: repo icon.
• Restore validation gates and authenticated Qdrant health checks #104: validation gates and authenticated Qdrant health checks.
• Fix decorated Python symbols and deterministic definition lookup #105: decorated Python symbols and deterministic definition lookup.
• docs(plans): add historical dev0 symbol-lookup plan #108: historical plan doc.
• Require authenticated Qdrant, least-privilege workflow tokens, scoped dependency triage #109: authenticated Qdrant, least-privilege workflow tokens and dependency triage.
• docs(qdrant): deployment inventory, Compose binding and 2026-11-05 runtime triage #110: Qdrant deployment inventory.
• deps: treesitter-chunker 6 / tree-sitter 0.26 (#115) #116: chunker 6 / tree-sitter 0.26 / language-pack 1.20. It adds the grammar prefetch/check CLI, get_status.grammars, sandbox grammar hardening, fail-closed grammar_unavailable, treesitter_chunk_id_v6, the Python 3.12–3.14 agent gate and the bookworm devcontainer.
• deps: baml-bridge 0.23.0 (#119) #120: baml-bridge / BAML toolchain 0.20.1 → 0.23.0. It regenerates baml_sdk/ and bakes BAML call recording to off, with the MCP_BAML_TELEMETRY opt-in. It also adds the 5 min total / 10 s connect LLM timeouts, the client_id() → requested_model() rename, DO_NOT_TRACK=1 for baml-cli, and a release-smoke assertion that nothing is recorded by default.

The bump (16 files)

• pyproject.toml and mcp_server/__init__.py → 1.5.0. In uv.lock only the index-it-mcp root entry changes (one line), and uv lock --check passes.
• The release workflow's default/example version and both Docker installers → v1.5.0.
• README, GETTING_STARTED (wheel filename), MCP_CONFIGURATION, SUPPORT_MATRIX and docs/operations/v13-release.md:
  • They now name 1.5.0 as the prepared candidate and 1.4.1 as the latest published release.
  • They note that 1.4.1 lacks the parser-stack and baml-bridge 0.23.0 upgrades.
  • SUPPORT_MATRIX's "1.4.0 is published on PyPI" row had been stale since October and now says 1.4.1.
  • The Docker docs' :v1.4.0 tags are unchanged. Since 1.4.1, releases ship digest-only through image-reference.txt, and that tag still exists.
• v13-release.md keeps the 1.4.1 evidence narrative. It adds a note that the owner decides which review seats and live checks from the 1.4.1 Publication Gate apply to 1.5.0.
• CHANGELOG:
  • [Unreleased] → ## [1.5.0] - 2026-11-08, using the 1.4.1 "Prepared … does not imply publication" format.
  • deps: baml-bridge 0.23.0 (#119) #120's entry moves under ### Changed.
  • [Unreleased] is left empty, as tests/test_release_notes.py requires.
• BREAKING-CHANGES.md: two 1.5.0 entries. One covers the chunk-id scheme change and its migration. The other covers baml-bridge 0.23.0: the requested_model() rename, and BAML_TELEMETRY → MCP_BAML_TELEMETRY with the upload caveat.
• Release-gate tests changed in lockstep:
  • tests/test_release_metadata.py, now driven by EXPECTED_VERSION/EXPECTED_TAG;
  • tests/docs/test_pubname_public_docs.py (Published \1.4.1``);
  • the version and image label of the real-wheel fixtures in tests/smoke/test_release_smoke_contract.py.

Upgrade notes (in the CHANGELOG)

• Full reindex required. Indexes use treesitter_chunk_id_v6, and chunker-4 indexes report scheme_mismatch until reindexed.
• Grammar prefetch is mandatory. Run mcp-index grammars prefetch after installing and after every language-pack upgrade. Without it, files fail with grammar_unavailable and the generation isn't published.
• glibc 2.34 or newer (for example Debian 12, Ubuntu 22.04, RHEL 9). Hosts on older glibc should stay on 1.4.1.
• Semantic vectors need re-embedding after the reindex. 4.x vectors read as profile-incompatible, so plan the inference budget.
• baml-bridge 0.23.0. Environments that pin 0.20.1 can't install 1.5.0. Tools that pin 0.23.0, like phase-loop-runtime 0.7.30, now co-install.
• BAML call recording and upload are off by default.
  • Unset, blank or off MCP_BAML_TELEMETRY records nothing.
  • low|medium|high records under ~/.baml. When a BOUNDARY_API_KEY or saved Boundary login exists, it uploads prompts that contain source code to Boundary.
  • The level is read at first import, so a change needs a restart.
• Upstream BAML_TELEMETRY is ignored. Only MCP_BAML_TELEMETRY controls recording.
• New LLM timeouts: 5 min total and 10 s connect. In the worst case, the single-file fallback path takes 5 min for the batch call plus 5 min per chunk.
• client_id() → requested_model() in the generated FunctionSpec. It returns the bare model name.
• Known follow-up: Per-language degradation when a tree-sitter grammar is unavailable #117 (per-language degradation when a grammar is missing).

Packaging verification (dev0, glibc 2.43, Linux x86_64, re-cut head)

• uv build → index_it_mcp-1.5.0-py3-none-any.whl (sha256 3640d9da42145a1c33535dba3d5c083d973df72cbd7c74228b5d535e0dfb9629) and index_it_mcp-1.5.0.tar.gz (sha256 ec4a3f6e8ee568b5953e2f2a04b47d65983d0499a0d9c6407bdf439bedc5ed10). These were built from tree a50816b5, the same tree as this head.
• Fresh Python 3.12.14 venv, wheel + phase-loop-runtime==0.7.30: uv pip check is clean (output above).
• CLI from the installed wheel, with HOME and the grammar cache isolated in a scratch directory:
  • mcp-index --version and index-it-mcp --version → code-index-mcp, version 1.5.0.
  • mcp-index grammars check with a cold cache → exit 1, every grammar MISSING (fails closed as designed).
  • mcp-index grammars prefetch → exit 0, "Prefetched and verified 47/47 grammars."
  • mcp-index grammars check again → exit 0, "47 grammars load offline; 0 missing."
• Release-smoke BAML probe from the wheel. This is the baml_contract script from scripts/release_smoke.py, run with the 3.12 venv's Python instead of inside the container image; baml_sdk was imported from the venv's site-packages. It asserts baml-bridge 0.23.0, builds both summarization requests with sockets patched off, and runs the calls in a child with blank MCP_BAML_TELEMETRY and an isolated HOME/BAML_HOME → exit 0, files= []. Neither the probe HOME nor the outer HOME has a .baml directory or any file.
• The full release_smoke.py --stdio / container run was not repeated for the re-cut. The first cut's --stdio run passed on the earlier head, and the container probe runs in Release Automation.

Tests run locally on the re-cut (one file per invocation, serial, nice, --no-cov, Python 3.14)

• tests/test_release_notes.py: 4 passed.
• tests/test_release_metadata.py: 26 passed.
• tests/test_v13_release_candidate.py: 79 passed.
• tests/test_workflow_release_policy.py: 40 passed.
• tests/smoke/test_release_smoke_contract.py: 24 passed.
• tests/test_schema_strict.py: 10 passed.
• Every tests/docs/test_*.py file (66 files): all passed.
• tests/test_baml_contract.py: 11 passed, 1 skipped. The regeneration-reproducibility test needs the BAML 0.23.0 toolchain, which isn't installed on dev0; hosted CI downloads it.
• tests/test_summarization.py: 72 passed.
• The full suite was not run on dev0 (shared host). Hosted CI covers it.

Remaining publish steps (each needs owner approval, none done here)

These follow docs/operations/v13-release.md (Publication Gate) and .github/workflows/release-automation.yml.

1. Owner decision (needs owner approval):
   • accept 1.5.0 (minor) as is;
   • decide which review seats and live checks from the 1.4.1 gate apply to 1.5.0.
2. Merge (needs owner approval): after review and green CI, merge only the accepted head of this PR, and record the merge commit SHA and tree SHA.
3. Clean publication worktree (needs owner approval): fetch protected main and confirm the merge content and version inputs. Record the publication authorization outside the tree.
4. Collision check (needs owner approval to proceed past it): confirm there is no v1.5.0 tag, no release-claims/v1.5.0 ref, no GitHub release and no PyPI index-it-mcp==1.5.0. As of 2026-11-08 none exist; PyPI latest is 1.4.1.
5. Dispatch (needs owner approval; one-shot, irreversible on PyPI):
   gh workflow run "Release Automation" --ref main -f mode=publish -f version=v1.5.0 -f auto_merge=false -f expected_commit=<merge SHA> -f expected_tree=<tree SHA>.
   • The workflow creates release-claims/v1.5.0 once.
   • It signs the image digest, publishes the wheel/sdist/GitHub release and adds image-reference.txt.
   • Never rerun or redispatch it after a partial failure.
6. Delivered-artifact acceptance (needs owner approval; a separate gate):
   • release_smoke.py --wheel-path <downloaded wheel> --wheel-sha256 <PyPI sha256> --image-ref ghcr.io/consiliency/code-index-mcp@sha256:<registry digest>;
   • a co-install re-check of the PyPI wheel with phase-loop-runtime==0.7.30;
   • PMCP prepare/offline/rehearsal/browser modes as the runbook requires.
   • Record published, accepted and deployed separately.
7. Post-release docs (needs owner approval; follow-up PR): reconcile "prepared candidate" to "published 1.5.0", the same way docs: reconcile 'prepared but unpublished' to the published v1.4.0 #95 and docs(v13): record v1.4.1 release; let post-release commits pass the tag test #102 did.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-08T19:39:32.757956Z We couldn’t complete this review. Comment @codex review to try again.	74b1e07	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.