release: ship GraphForge v0.5.2 (publish-track)

[DecisionNerd]

Objective

Ship one version-consistent GraphForge v0.5.2 patch release across the approved public surfaces (crates.io, PyPI, npm native + main/CLI/skills, GitHub Release).

Scope (candidate tip after Dependabot)

Post-deps main tip (before version bump): d02e56cbdc067afd7baf41d572bfa8f05e0f4406

Included themes for release notes:

• Bug fixes already on main: fix(bindings): remove advertised Node bulk-construction stubs and repair parity policy #348/fix(bindings): repair Node bulk API contract #351, fix(concurrency): optimistic Node rebase can report transaction identity conflict #290/fix(storage): abort stale optimistic validation attempts #364, Repair the advertised node inspection API #346
• CI / testing track: ci: speed coverage, PR CI, and publish-track certification #383; coverage test(core): raise behavioral Rust coverage for weak core contracts #360/test(storage-api): prove publication, checkpoint, and facade boundaries #369
• Dependabot CI action/tool bumps: ci(deps): bump actions/setup-python from 6 to 7 #370–ci(deps): bump actions/setup-go from 6 to 7 #373

Deferred (out of release): #336 (do not wait). Do not expand scope for M1/checkpoint/m20/m21 human-close gates — this is ordinary publish-track.

Acceptance criteria

1. Root version is aligned to 0.5.2 across Cargo, PyPI, Node/native npm, CLI, and agent skills on reviewed main (python3 scripts/set_release_version.py --check).
2. Binding Release Candidate succeeds for the exact post-bump main SHA and retains unexpired manifest, python, npm, crates, and evidence partitions (same SHA; no rebuild-on-write).
3. Maintainer dispatches Publish Track with create_release=true, confirm_registry_publish=true, and release_tag=v0.5.2 against that SHA (or equivalent authorized tag → publish.yaml path).
4. publish.yaml reconciles all public registry nodes for 0.5.2 without overwriting prior versions; short release record cites candidate SHA, Binding RC run, GitHub Release, and registry URLs.
5. Close this tracker only after publish-track success evidence is recorded (not when the version-bump PR merges).

Non-goals

• fix(storage): stream adjacency index builds past the 134,217,727-edge Arrow limit #336 adjacency-index streaming fix.
• M1 load / checkpoint / m20 / m21 certification cascade.
• Replaying or mutating v0.5.0 / v0.5.1 immutable records.

References

• docs/engineering/PUBLISHING.md
• docs/development/publication-order.md
• Prior style: release: ship GraphForge v0.5.1 with fast-fail recovery #192 (v0.5.1)

[coderabbitai]

🔗 Related PRs

#282 - fix(release): resume immutable v0.5.0 publication [merged]
#289 - fix(release): amend unpublished main npm artifact [merged]
#297 - docs(release): require one shared product version [merged]
#305 - feat(release): orchestrate resumable publication [merged]
#308 - fix(release): align crate path+version pins to 0.5.1 [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[DecisionNerd]

Prep progress

Phase A — Dependabot merged (squash):

• ci(deps): bump actions/setup-python from 6 to 7 #370 → 02eb27d53903e67935e74973289b3c30bcc68456
• chore(deps-dev): bump ruff from 0.16.0 to 0.16.1 in the development-dependencies group #371 → 2020b1d51eee2a451ddf7754eb2fa6298592b864
• ci(deps): bump actions/setup-node from 6 to 7 #372 → 93b83fa0791408d3067ab363478f27c02931c849
• ci(deps): bump actions/setup-go from 6 to 7 #373 → d02e56cbdc067afd7baf41d572bfa8f05e0f4406 (post-deps tip)

Phase C — version bump: #397 (release/0.5.2) opened with Refs #396 (will not close this tracker on bump merge).

Next: CI Gate on #397 → squash-merge → Binding RC on post-bump main SHA → maintainer Publish Track (create_release + confirm_registry_publish + v0.5.2).

[DecisionNerd]

Phase C merged + Phase D Binding RC started

• Version bump PR: chore(release): freeze GraphForge surfaces at 0.5.2 #397 → squash merge c2b782cd833d54aa14bb097b69bd23f3c2a93a9b
• Frozen publish tip SHA: c2b782cd833d54aa14bb097b69bd23f3c2a93a9b
• Binding Release Candidate dispatched for that exact SHA: https://github.com/CurateLabs/graphforge/actions/runs/30936629911 (run 30936629911)

Next maintainer step (after Binding RC succeeds): dispatch Publish Track with:

• create_release=true
• confirm_registry_publish=true
• release_tag=v0.5.2

Do not tag/publish until Binding RC retains unexpired manifest/python/npm/crates/evidence for this SHA. #336 remains deferred. M1/checkpoint/m20/m21 not required for publish-track.

[DecisionNerd]

v0.5.2 publish-track close-out evidence

Candidate SHA: c2b782cd833d54aa14bb097b69bd23f3c2a93a9b (current main tip at authorize time; still tip at publish)

Binding RC

• Run: https://github.com/CurateLabs/graphforge/actions/runs/30936629911
• Conclusion: success on exact SHA c2b782cd833d54aa14bb097b69bd23f3c2a93a9b
• Retained unexpired partitions (expire ~2026-09-03): manifest, python, npm, crates, evidence

Publish Track (release identity)

• Run: https://github.com/CurateLabs/graphforge/actions/runs/30938375933
• Inputs: create_release=true, confirm_registry_publish=true, release_tag=v0.5.2, commit_sha=c2b782cd833d54aa14bb097b69bd23f3c2a93a9b
• Conclusion: success (created immutable Release identity)

GitHub Release

• https://github.com/CurateLabs/graphforge/releases/tag/v0.5.2
• Tag v0.5.2 → c2b782cd833d54aa14bb097b69bd23f3c2a93a9b

Registry publish (publish.yaml)

• Release-event did not auto-start publish.yaml (Release created by github-actions[bot] / GITHUB_TOKEN).
• Authorized recovery dispatch per publication-order recovery path:
  https://github.com/CurateLabs/graphforge/actions/runs/30938635907
• Conclusion: success; reconciliation artifact M1-Release-Reconciliation-30938635907: 24/24 verified, complete=true, blockers=[], version 0.5.2, candidate SHA match.

Public spot-checks

• PyPI graphforge==0.5.2 present (not yanked)
• npm @curatelabs/graphforge@0.5.2, CLI, agent-skills, and native linux-x64-gnu present
• crates.io sample: graphforge-core, graphforge-api, graphforge-cli, graphforge-exec 0.5.2 not yanked

AC met; closing tracker. #336 remains deferred / out of this release.

[DecisionNerd]

Closing: publish-track AC met for v0.5.2 (RC 30936629911, Publish Track 30938375933, publish.yaml recovery 30938635907, Release https://github.com/CurateLabs/graphforge/releases/tag/v0.5.2, 24/24 registry nodes verified).