[frankbria]

Release PR for 0.9.5, the release #1348's definition of done requires: new defaults shipped two weeks before claude-sonnet-4-5 retires on 2026-11-30.

• pyproject.toml and uv.lock: 0.9.4 → 0.9.5. The lock diff is the version line only; the format revision stays at 3, so older uv versions can still read it.

• CHANGELOG.md: [Unreleased] becomes [0.9.5] - 2026-10-12, and the user-facing changes without entries get them:

  • Added: web Finish now ([P2.74] Web UI discovery resume prompt always says 0 answers: DiscoveryPanel reads progress.answered_count, core sends answered #1449) and CLI finish after rejections ([P2.75] cf prd generate: offer 'finish now' when answer attempts are exhausted #1450).
  • Fixed: the resume count ([P2.74] Web UI discovery resume prompt always says 0 answers: DiscoveryPanel reads progress.answered_count, core sends answered #1449) and WCAG contrast ([P1.0] Scheduled Test Suite (Unit + E2E) run is failing #1447).

  The [P1.59] Move the Sonnet-tier defaults to claude-sonnet-5-5 before claude-sonnet-4-5 reaches end of life (2026-11-30) #1348 and [P1.60] PRD discovery asks unbounded, repetitive questions: cap it, stop on coverage plateau, let the user finish #1443 entries were already there. The link references gain the missing 0.9.3/0.9.4 entries.

After merge: tag v0.9.5. release.yml gates on Unlocked Resolution and publishes through PyPI trusted publishing. Then run scripts/quickstart-cleanroom/run.sh against the published package, which #1348 requires per #1112.

Refs #1348

[github-actions]

Claude finished @frankbria's task in 3m 35s —— View job

---

GLM precision review — 1 defect found

Scoped to concrete defects only (logic, contract/version drift, data loss, security) — style/architecture/coverage left to the general review. Verified against the checked-out repo, not the diff alone.

• Gather PR context and full diff (gh pr view, gh pr diff)
• Check existing comments — no overlap with the earlier general review
• Version consistency: pyproject.toml ↔ uv.lock ↔ codeframe/__init__.py (reads dist metadata, no hardcoded bump site) ↔ any other 0.9.4 reference repo-wide
• CHANGELOG structure: heading ↔ link-definition pairing for [0.9.5]/[0.9.4]/[0.9.3], no duplicate entries across release sections
• Post findings (1 inline) + this summary

severity	file:line	finding
major	pyproject.toml:8	Version bump incomplete — README.md:77 still says public beta (0.9.4), so the #950 version-drift guard tests/test_root_docs_950.py::test_the_readme_beta_banner_matches_pyproject (asserts README matches pyproject) fails the CI gate. One-line fix in README. Inline comment →

Checked and clean:

• uv.lock: exactly the one codeframe-ai version line; revision = 3 untouched.
• codeframe/__init__.py:11 resolves __version__ via importlib.metadata — no second bump site to miss.
• CHANGELOG: ## [0.9.5] - 2026-10-12 heading pairs with its new link ref; the added [0.9.4]/[0.9.3] refs match existing headings; none of [P1.59] Move the Sonnet-tier defaults to claude-sonnet-5-5 before claude-sonnet-4-5 reaches end of life (2026-11-30) #1348/[P1.60] PRD discovery asks unbounded, repetitive questions: cap it, stop on coverage plateau, let the user finish #1443/[P1.0] Scheduled Test Suite (Unit + E2E) run is failing #1447/[P2.74] Web UI discovery resume prompt always says 0 answers: DiscoveryPanel reads progress.answered_count, core sends answered #1449/[P2.75] cf prd generate: offer 'finish now' when answer attempts are exhausted #1450 are duplicated in the 0.9.4 section.
• Repo-wide 0.9.4 sweep: only README (the finding), historical CHANGELOG entries, and npm's optionator dep — nothing else load-bearing.

Not verifiable from here (discarded rather than guessed): whether remote tags v0.9.3/v0.9.4 exist for the new compare links — git ls-remote/tags API were not permitted in this run; existing links already rely on the same tag convention.

Note: the "Test Suite (Unit + E2E)" check was still in progress when this review posted — expect it to go red on the README guard above unless the README bump lands first.

[claude]

Review

This is a standard mechanical release PR (0.9.4 → 0.9.5), and it's clean. Checked:

• Version consistency: pyproject.toml and uv.lock both show 0.9.5; uv.lock's revision stays at 3 as described, so the lock diff really is just the version line.
• CHANGELOG accuracy: Spot-checked the referenced features against the current codebase rather than taking the PR body at face value:
  • POST /api/v2/discovery/{session_id}/finish exists in codeframe/ui/routers/discovery_v2.py ([P2.74] Web UI discovery resume prompt always says 0 answers: DiscoveryPanel reads progress.answered_count, core sends answered #1449).
  • The CLI "Finish discovery now" prompt and after-5-rejections finish behavior exist in codeframe/cli/app.py ([P2.75] cf prd generate: offer 'finish now' when answer attempts are exhausted #1450).
  • claude-sonnet-5-5 is indeed the new default in codeframe/adapters/llm/base.py (DEFAULT_PLANNING_MODEL, DEFAULT_EXECUTION_MODEL, etc.) and priced in metrics_tracker.py ([P1.59] Move the Sonnet-tier defaults to claude-sonnet-5-5 before claude-sonnet-4-5 reaches end of life (2026-11-30) #1348).
    All match the changelog's descriptions — no unsubstantiated claims.
• Link references: [Unreleased] now points at v0.9.5...HEAD, and the missing [0.9.3]/[0.9.4] compare links were added alongside [0.9.5], fixing what would otherwise be dangling reference-style links further down in the file.
• Scope: Diff touches only CHANGELOG.md, pyproject.toml, uv.lock — nothing else is bundled in.

No code, security, or test-coverage concerns — there's no application logic in this diff to introduce bugs, and release-bump PRs aren't expected to carry new tests.

One minor, non-blocking note: the PR body says "After merge: tag v0.9.5... Then run scripts/quickstart-cleanroom/run.sh against the published package" — per CLAUDE.md this cold-start check is explicitly not optional before a release. Worth confirming that step is actually planned/tracked (e.g., in #1348) rather than just mentioned here, since it's the one thing that previously caught two DOA releases (#1112, #1168).

🤖 Generated with Claude Code

[github-actions]

Claude finished @frankbria's task in 2m 13s —— View job

---

GLM precision review — re-review after 0a2d879

Scoped to concrete defects only (logic, contract/version drift, data loss, security) — style/architecture/coverage left to the general review. Verified against the checked-out repo at 0a2d879, not the diff alone.

• Gather PR context and full diff (gh pr view, git diff origin/main...HEAD)
• Check existing comments — no repeats of already-posted findings
• Verify the 0a2d879 README fix against the [P1.32] Bring the root documentation in line with the shipped product #950 guard (read the test, static check — no test runs per review guardrails)
• Version consistency re-check: pyproject.toml ↔ uv.lock ↔ codeframe/__init__.py ↔ repo-wide 0.9.4 sweep
• CHANGELOG structure re-check: heading ↔ link-ref pairing, no duplicate entries
• Post findings + summary

✅ GLM review: no defects found.

Prior finding resolved. The one defect from the first round — README beta banner still reading 0.9.4 — is fixed in 0a2d879 and verified against the guard itself: tests/test_root_docs_950.py:134 asserts f"public beta (`{version}`)" in readme with version loaded from pyproject.toml (now 0.9.5), and README.md:77 reads exactly public beta (0.9.5). The other two assertions in TestTheVersionAgrees also hold: ## [0.9.5] exists (CHANGELOG.md:10), and codeframe/__init__.py:11 resolves __version__ from installed dist metadata — no second bump site.

Checked and clean:

• New commit scope: 0a2d879 touches exactly one line (README.md 0.9.4 → 0.9.5); nothing else rode along.
• CHANGELOG headings ↔ link refs pair 1:1: headings [Unreleased, 0.9.5, 0.9.4, 0.9.3, 0.9.2, 0.9.1, 0.9.0] ↔ the same seven link definitions at CHANGELOG.md:1258-1264; [Unreleased] now compares v0.9.5...HEAD (correct — the release cut below it). No dangling references in either direction.
• No duplicate entries: all five issue refs this release cites ([P1.59] Move the Sonnet-tier defaults to claude-sonnet-5-5 before claude-sonnet-4-5 reaches end of life (2026-11-30) #1348, [P1.60] PRD discovery asks unbounded, repetitive questions: cap it, stop on coverage plateau, let the user finish #1443, [P1.0] Scheduled Test Suite (Unit + E2E) run is failing #1447, [P2.74] Web UI discovery resume prompt always says 0 answers: DiscoveryPanel reads progress.answered_count, core sends answered #1449, [P2.75] cf prd generate: offer 'finish now' when answer attempts are exhausted #1450) appear only in the 0.9.5 section (lines 14–66); the 0.9.4 section starts at line 68.
• uv.lock: exactly one codeframe-ai stanza (line 586) at 0.9.5; revision = 3 untouched — the lock diff really is the version line only.
• Repo-wide 0.9.4 sweep: only the historical CHANGELOG heading, the two compare-range URL endpoints (where 0.9.4 should appear), and npm's unrelated optionator package in web-ui/package-lock.json.

Discarded rather than guessed (unchanged from the first round): whether remote tags v0.9.3/v0.9.4 exist for the compare links — git ls-remote is not permitted in this run either; the pre-existing [0.9.4]/[0.9.2] links already rely on the same tag convention, so nothing new is at risk.

[claude]

Review

Re-reviewed after the prior two rounds (general Claude review + GLM precision review).

• The GLM review's one flagged defect — README still saying 0.9.4 while pyproject.toml bumped to 0.9.5 (which would have failed tests/test_root_docs_950.py::test_the_readme_beta_banner_matches_pyproject) — is resolved in the current diff: README.md:77 now reads public beta (\0.9.5`), matching pyproject.toml`.
• Confirms the earlier general review's points still hold: pyproject.toml/uv.lock versions match (uv.lock revision untouched at 3), CHANGELOG [0.9.5] heading pairs correctly with its new link reference, and the added [0.9.4]/[0.9.3] compare links fill in previously-dangling references without duplicating any entries.
• Diff is now scoped to exactly CHANGELOG.md, README.md, pyproject.toml, uv.lock — no stray changes.

No new issues found. Non-blocking reminder carried over from the first review: per CLAUDE.md, the cold-start check (scripts/quickstart-cleanroom/run.sh) against the published package is not optional before this release goes out — worth confirming that's tracked post-tag, not just mentioned in the PR body.

🤖 Generated with Claude Code