chore(release): bump to 1.6.1 and cut CHANGELOG 1.6.1 — 2026-09-02 - #156
Merged
Conversation
Lockstep bump across workspace, packaging, Python plugin, fixtures and their sha256 sidecars + authority-note hash tables, mirroring 39f6b43. README status paragraph now reads "Public release: v1.6.1. Local checkout: v1.6.1"; the install-example pins and site badges the docs sweep left at v1.5.1 move to v1.6.1 (README, getting-started, www/, site/). CHANGELOG 1.6.1: security patch — .env credential sidecar (ADR-062), exclusive staging for every atomic write, Filigree MCP launcher -I, LLM source-excerpt jail; CI action refresh; docs sweep; the three Codex PRs closed with tickets. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0183ccEmYnCh5Nx2Y6weYfHy
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
The Filigree authority (tests/fixtures/contracts/weft/issues-get.json, f1a9681) added a `requires_seeded_state: true` marker to the seeded example — metadata only, no wire-shape change. Re-vendored byte-identical and GOLDEN_BLAKE3 recomputed so the Layer-1 oracle is green with the sibling present (it is skip-clean in CI without it, which is how the drift landed unnoticed). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0183ccEmYnCh5Nx2Y6weYfHy
The previous commit's hash extraction matched no test and wrote an empty pin; this is the recomputed value from the oracle's own Layer-1 check. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0183ccEmYnCh5Nx2Y6weYfHy
There was a problem hiding this comment.
🟡 Changes recommended
There are documentation/release-record inconsistencies (notably a future-dated CHANGELOG entry and a backdated handoff doc now claiming 1.6.1 provenance) that should be clarified before tagging/publishing.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR prepares the 1.6.1 release by performing a lockstep version bump across the Rust workspace, Python plugins, packaging artifacts, documentation snippets, and federation fixture authorities, and by cutting the CHANGELOG.md entry for 1.6.1.
Changes:
- Bump versions from 1.6.0 → 1.6.1 across Rust crates, Python packages, and packaging manifests/lockfiles.
- Update public-facing docs/site/www install snippets and status text to reference v1.6.1.
- Refresh federation seam fixtures and their
.sha256sidecars/authority tables to reflect regenerated bytes for 1.6.1.
File summaries
| File | Description |
|---|---|
| www/index.html | Updates displayed version/install snippet to v1.6.1. |
| www/getting-started.html | Updates install snippet to v1.6.1. |
| site/src/pages/index.astro | Updates homepage copy/comments and “latest release” link text to v1.6.1. |
| README.md | Updates status + install examples and local install notes to v1.6.1. |
| plugins/python/tests/test_server.py | Updates expected plugin version to 1.6.1 in server initialize test. |
| plugins/python/tests/test_package.py | Updates expected module/manifest versions to 1.6.1. |
| plugins/python/src/loomweave_plugin_python/init.py | Bumps Python plugin __version__ to 1.6.1. |
| plugins/python/pyproject.toml | Bumps Python plugin package version to 1.6.1. |
| plugins/python/plugin.toml | Bumps Python plugin manifest version to 1.6.1. |
| packaging/rust-plugin-dist/wheel-data/data/share/loomweave/plugins/rust/plugin.toml | Bumps packaged Rust plugin manifest version to 1.6.1. |
| packaging/rust-plugin-dist/pyproject.toml | Bumps Rust plugin wheel project version to 1.6.1. |
| packaging/rust-plugin-dist/Cargo.toml | Bumps dist crate + dependency pin to loomweave-plugin-rust 1.6.1. |
| packaging/rust-plugin-dist/Cargo.lock | Regenerates dist lockfile for 1.6.1 (includes loomweave-core dependency set). |
| docs/operator/getting-started.md | Updates operator install snippet to v1.6.1. |
| docs/implementation/handoffs/2026-07-12-plainweave-federation-seam-fixtures.md | Updates producer version and recorded fixture digests for refreshed bytes. |
| docs/federation/fixtures/classification.python.json.sha256 | Updates sha256 sidecar to match refreshed fixture. |
| docs/federation/fixtures/classification.python.json | Updates generated-with versions to 1.6.1. |
| docs/federation/2026-07-12-federation-seam-golden-authority.md | Updates authoritative digests table for refreshed fixtures. |
| crates/loomweave-storage/tests/fixtures/classifier-coverage-v1.golden.json.sha256 | Updates sha256 sidecar to match refreshed golden. |
| crates/loomweave-storage/tests/fixtures/classifier-coverage-v1.golden.json | Updates embedded plugin version to 1.6.1. |
| crates/loomweave-storage/Cargo.toml | Bumps loomweave-core dependency pin to 1.6.1. |
| crates/loomweave-plugin-rust/plugin.toml | Bumps Rust plugin manifest version to 1.6.1. |
| crates/loomweave-plugin-rust/Cargo.toml | Bumps loomweave-core dependency pin to 1.6.1. |
| crates/loomweave-plugin-fixture/Cargo.toml | Bumps loomweave-core dependency pin to 1.6.1. |
| crates/loomweave-mcp/Cargo.toml | Bumps internal crate pins/dev-deps to 1.6.1. |
| crates/loomweave-federation/Cargo.toml | Bumps loomweave-core dependency pin to 1.6.1. |
| crates/loomweave-core/tests/classifier_coverage.rs | Updates fixture JSON expectations to plugin_version 1.6.1. |
| crates/loomweave-cli/tests/analyze.rs | Updates fixture SQL insert version string to 1.6.1. |
| crates/loomweave-cli/pyproject.toml | Bumps PyPI package version + plugin dependency pins to 1.6.1. |
| crates/loomweave-cli/Cargo.toml | Bumps internal crate dependency pins to 1.6.1. |
| CHANGELOG.md | Adds 1.6.1 release notes and updates compare links. |
| Cargo.toml | Bumps workspace.package version to 1.6.1. |
| Cargo.lock | Regenerates workspace lockfile for 1.6.1. |
Review details
- Files reviewed: 33/35 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
3
to
5
| **Date:** 2026-07-12 | ||
| **Producer:** Loomweave 1.6.0 worktree artifacts | ||
| **Producer:** Loomweave 1.6.1 worktree artifacts | ||
| **Consumer owner:** Plainweave ticket `plainweave-f8303b4b50` |
The lockfile records the editable plugin's own version; `uv sync --locked` refuses the 1.6.1 pyproject against a 1.6.0 lock (Verify / Python plugin). Mirrors the uv.lock hunk of the 1.6.0 bump (39f6b43) that the first bump commit here missed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0183ccEmYnCh5Nx2Y6weYfHy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lockstep bump 1.6.0 → 1.6.1 (mirrors #131's recipe: workspace, packaging, Python plugin, fixtures + sha256 sidecars + authority-note hash tables) and the CHANGELOG 1.6.1 cut.
Contents of 1.6.1 (all already merged on
release/1.6.0).envcredential sidecar (ADR-062, fix(core,cli,mcp): repository .env is a credential sidecar, never environment (ADR-062) #155); exclusive staging for every atomic write (fix(cli,federation): exclusive, unpredictable staging for every atomic write #154); Filigree MCP launcher-I(fix(federation): isolate Filigree MCP Python imports (-I) #152); LLM source-excerpt jail (fix(mcp): jail LLM source-excerpt reads to the project root #153); session hook never parses.env(fix(cli): prevent session hook from inheriting repository dotenv #149).Verification (local, full CI floor)
scripts/check-*lockstep scripts pass.cargo fmt --check,clippy --workspace -D warnings,cargo build --workspace --bins,nextest --workspace(2472/2473 — the one failure isissue_detail_conformance_oracle::vendored_golden_matches_filigree_authority, which fails identically on the untouched branch because the local Filigree sibling'sissues-get.jsonauthority has moved; CI is skip-clean without the sibling; tracked separately),cargo doc -D warnings,cargo deny.After merge: tag
v1.6.1on the merge commit →release.ymlpublishes PyPI (3 packages) + GitHub Release + crates.io; thenrelease/1.6.0→mainsync PR as with #141.🤖 Generated with Claude Code