[ViperJuice]

This replaces the "prepared candidate" wording for 1.5.0 with the published state and adds the delivered-acceptance record (in the format of #95 and #102). Acceptance did not fully pass, so this PR records published=true, accepted=false (partial), deployed=false. It does not claim acceptance. The requested title, "published and accepted", would have been inaccurate.

Published. Release Automation run 42539192667 built tag v1.5.0 from 81980d0 (tree 5d43fdf). It published the PyPI wheel and sdist, the GitHub release, and the signed image ghcr.io/consiliency/code-index-mcp@sha256:6ef6aa54….

Passed (dev0, Python 3.12.14, clean worktree at 81980d0):

• Downloads. The PyPI wheel and sdist sha256 values match the recorded values and the GitHub release assets. image-reference.txt and image-digest.txt both name the published digest.
• Image signature. Pulled anonymously by digest; the labels are v1.5.0 and revision 81980d0. cosign v2.5.2 (the workflow's version; its release checksum verified) verified the keyless signature with the workflow's identity (release-automation.yml@refs/heads/main), issuer and workflow SHA 81980d0.
• Wheel and STDIO smoke. release_smoke.py --wheel-path <PyPI wheel> --wheel-sha256 931f8ed7… --stdio --image-ref <digest> passed, using a fresh prefetched TREE_SITTER_LANGUAGE_PACK_CACHE_DIR.
• Container smoke. dev0 can't reach bridge-published container ports (a plain http.server in the same image confirmed it). One deliberate rerun with --docker-network host passed: cosign, offline BAML, schema/prepare/Python as uid 999, HTTP queries before and after restart, log privacy, lifecycle and the safety probe.
• Co-install of index-it-mcp==1.5.0 with phase-loop-runtime==0.7.30:
  • uv pip check is clean, and the installed files match the wheel's RECORD.
  • Resolved: baml-bridge 0.23.0, tree-sitter 0.26.0, treesitter-chunker 6.0.0, language-pack 1.20.0.
  • mcp-index --version reports 1.5.0. grammars prefetch verified 47/47; grammars check found 47 offline, 0 missing.
  • With MCP_BAML_TELEMETRY unset or blank, a BAML import writes nothing under ~/.baml.
• PMCP prepare. Ran with the PyPI wheel: registry-origin manifest, PMCP 2.7.3. dev0's PMCP 2.7.3 tooling releases are archived symlinks that the binder refuses, so I installed PyPI pmcp==2.7.3 as a private uv tool. The live dev0 gateway wasn't used.

Failed / not run:

• Unconstrained PyPI install is broken. The wheel declares mcp>=1.0.0 with no upper bound, so pip install index-it-mcp==1.5.0 (alone or co-installed) resolves mcp 2.3.0. index-it-mcp stdio then fails at import with cannot import name 'McpError' from 'mcp.shared.exceptions'. 1.4.1 has the same unbounded requirement. Release smoke and the pilot missed this because both install with lock constraints (mcp 1.27.0). Adding "mcp<2" resolves mcp 1.30.0 and STDIO passes, so the docs now pin it. A corrective release needs an owner decision.
• PMCP offline failed. reindex returned SandboxCallError. The pilot fixture uses a fresh XDG_CACHE_HOME with no prefetched grammar cache, and network-denied sandbox workers can't download grammars. This is the ci(release): give the release gates an explicit grammar cache (#115) #122 gap, still present in scripts/v13_pmcp_pilot.py. The same installed probe fails with a cold cache and passes with a warm one.
• PMCP rehearsal and browser not run. Both use the same fixture. Rehearsal's Qdrant can't use bridge port publishing on dev0, and in host mode its gRPC port 6334 is held by dev0's live Qdrant. Browser also needs Inspector 2.6.0 and an operator session.

Deployed: no. The dev0 code-index child still runs build b79cc7c and wasn't changed.

Changes

• README, GETTING_STARTED, MCP_CONFIGURATION and SUPPORT_MATRIX now say "published 1.5.0" and add "mcp<2" to PyPI install guidance.
• v13-release.md: Release Status and a new "1.5.0 Delivered Acceptance" record.
• V13_EXECUTION.md and public-package-identity.md updated.
• Version-pinned docs tests updated in lockstep: test_release_metadata, test_pubname_public_docs, test_p8_customer_docs_alignment, test_p26_public_alpha_decision.

Tests (dev0, one file per run, serial, under nice):

• All 66 tests/docs files, tests/test_release_metadata.py, tests/test_v13_release_candidate.py and tests/smoke/test_release_smoke_contract.py pass.
• tests/root_tests/test_readme_parsing.py has 4 failures. That file only parses synthetic READMEs in tmp_path and reads no repo files, and this PR changes no code.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T00:59:19.829221Z	e3a0851	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.